Wp Levoslideshow Vulnerabilities

The Levo Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘image_description’ parameter in versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that wi...

CVSS:

6.4

Affected:

up to 2.3

Fix:

No patched version reported

Disclosed:

Jun 6, 2016

The Levo Slideshow plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation via lvo_single_image_uploadrn action in versions up to, and including, 2.3. This makes it possible for authenticated attackers to upload arbitrary files on the affected sites server which may make re...

CVSS:

8.8

Affected:

up to 2.3

Fix:

No patched version reported

Disclosed:

Jan 29, 2013

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.

CVSS:

6.1

Affected:

up to 2.2

Fixed in:

2.3

Disclosed:

Nov 9, 2012

CVE-2012-3414 on NVD →