Wp Image News Slider Vulnerabilities

Unspecified vulnerability in the Image News slider plugin before 3.3 for WordPress has unspecified impact and remote attack vectors.

CVSS:

7.3

Affected:

up to 3.2

Fixed in:

3.3

Disclosed:

Aug 1, 2014

CVE-2012-4327 on NVD →

[en] Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.

Affected:

up to 3.5

Fixed in:

3.5

Disclosed:

Jul 19, 2013

CVE-2012-3414 on NVD →

The Image News Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ~/js/swfupload/js/upload.php file in versions up to, and including, 3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may mak...

CVSS:

9.8

Affected:

up to 3.3

Fixed in:

3.4

Disclosed:

Nov 12, 2012

The Image News Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ~/js/swfupload/js/upload.php file in versions up to, and including, 3.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may mak...

Affected:

up to 3.4

Fixed in:

3.4

Disclosed:

Nov 12, 2012

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.

CVSS:

6.1

Affected:

up to 3.4

Fixed in:

3.5

Disclosed:

Nov 9, 2012

CVE-2012-3414 on NVD →

[en] Unspecified vulnerability in the Image News slider plugin before 3.3 for WordPress has unspecified impact and remote attack vectors.

Affected:

up to 3.3

Fixed in:

3.3

Disclosed:

Aug 14, 2012

CVE-2012-4327 on NVD →

The wp-image-news-slider WordPress plugin was affected by an Arbitrary File Upload security vulnerability.

Affected:

up to 3.5

Fix:

No patched version reported

The wp-image-news-slider WordPress plugin was affected by a Multiple Unspecified Remote Issues security vulnerability.

Affected:

up to 3.2

Fixed in:

3.2

The wp-image-news-slider WordPress plugin was affected by an Unspecified Vulnerabilities security vulnerability.

Affected:

up to 3.4

Fixed in:

3.4