Wp Rokintroscroller Vulnerabilities

This plugin is prone to cross site scripting, denial of service, full path disclosure and arbitrary file upload vulnerabilities. Update plugin.

Affected:

up to 1.8

Fix:

No patched version reported

Disclosed:

May 15, 2015

The RokIntroScroller plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'src' parameter in the 'thumb.php' file in versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which m...

CVSS:

9.8

Affected:

up to 1.8

Fixed in:

1.9

Disclosed:

Sep 19, 2013

The RokIntroScroller plugin for WordPress is vulnerable to Full Path Disclosure via the 'src' parameter in the 'thumb.php' file in versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to read the full path to an arbitrary file within the vulnerable service, the information gathered c...

CVSS:

7.5

Affected:

up to 1.8

Fixed in:

1.9

Disclosed:

Sep 19, 2013

The RokIntroScroller plugin for WordPress is vulnerable to Denial of Service via the 'src' parameter in the 'thumb.php' file in versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to slow the response time of the vulnerable service to an unusable speed and/or completely deny it.

CVSS:

7.5

Affected:

up to 1.8

Fixed in:

1.9

Disclosed:

Sep 19, 2013

The RokIntroScroller plugin for WordPress is vulnerable to Abuse of Functionality via the 'src' parameter in the 'thumb.php' file in versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to use implemented functions from the vulnerable service to invoke unintended/malicious outcomes.

CVSS:

7.3

Affected:

up to 1.8

Fixed in:

1.9

Disclosed:

Sep 19, 2013

The RokIntroScroller plugin for WordPress is vulnerable to Cross-Site Scripting via the 'src' parameter in the 'thumb.php' file in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that exec...

CVSS:

6.1

Affected:

up to 1.8

Fixed in:

1.9

Disclosed:

Sep 19, 2013

WordPress RokIntroScroller plugin's "thumb.php" is prone to multiple security vulnerabilities, such as an arbitrary file-upload, cross-site scripting, information disclosure and denial-of-service vulnerabilities. Because of these issues, attackers can execute arbitrary script code in the browser of an unsuspecting use...

Affected:

up to 1.9

Fixed in:

1.9

Disclosed:

Sep 19, 2013

The RokIntroScroller plugin for WordPress is vulnerable to Full Path Disclosure via the 'src' parameter in the 'thumb.php' file in versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to read the full path to an arbitrary file within the vulnerable service, the information gathered c...

Affected:

up to 1.9

Fixed in:

1.9

Disclosed:

Sep 19, 2013

The RokIntroScroller plugin for WordPress is vulnerable to Cross-Site Scripting via the 'src' parameter in the 'thumb.php' file in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that exec...

Affected:

up to 1.9

Fixed in:

1.9

Disclosed:

Sep 19, 2013

The RokIntroScroller plugin for WordPress is vulnerable to Denial of Service via the 'src' parameter in the 'thumb.php' file in versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to slow the response time of the vulnerable service to an unusable speed and/or completely deny it.

Affected:

up to 1.9

Fixed in:

1.9

Disclosed:

Sep 19, 2013

The RokIntroScroller plugin for WordPress is vulnerable to Abuse of Functionality via the 'src' parameter in the 'thumb.php' file in versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to use implemented functions from the vulnerable service to invoke unintended/malicious outcomes.

Affected:

up to 1.9

Fixed in:

1.9

Disclosed:

Sep 19, 2013

The RokIntroScroller plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'src' parameter in the 'thumb.php' file in versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which m...

Affected:

up to 1.9

Fixed in:

1.9

Disclosed:

Sep 19, 2013

The wp_rokintroscroller WordPress plugin was affected by a XSS,DoS,Disclosure,Upload Vulnerabilities security vulnerability.

Affected:

up to 1.8

Fix:

No patched version reported