WPGlobus – Multilingual WordPress [wpglobus] < 1.9.7
unknown
[en] The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[more_languages] parameter to wp-admin/options.php.
- Affected:
- up to 1.9.7
- Fixed in:
- 1.9.7
- Disclosed:
- Jan 12, 2018
CVE-2018-5366 on NVD →
WPGlobus – Multilingual WordPress [wpglobus] < 1.9.7
unknown
[en] The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][post] parameter to wp-admin/options.php.
- Affected:
- up to 1.9.7
- Fixed in:
- 1.9.7
- Disclosed:
- Jan 12, 2018
CVE-2018-5367 on NVD →
WPGlobus – Multilingual WordPress [wpglobus] < 1.9.7
unknown
[en] The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language) parameter to wp-admin/options.php.
- Affected:
- up to 1.9.7
- Fixed in:
- 1.9.7
- Disclosed:
- Jan 12, 2018
CVE-2018-5363 on NVD →
WPGlobus – Multilingual WordPress [wpglobus] < 1.9.7
unknown
[en] The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php.
- Affected:
- up to 1.9.7
- Fixed in:
- 1.9.7
- Disclosed:
- Jan 12, 2018
CVE-2018-5364 on NVD →
WPGlobus – Multilingual WordPress [wpglobus] < 1.9.7
unknown
[en] The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options.php.
- Affected:
- up to 1.9.7
- Fixed in:
- 1.9.7
- Disclosed:
- Jan 12, 2018
CVE-2018-5365 on NVD →
WPGlobus – Multilingual WordPress [wpglobus] < 1.9.7
unknown
[en] The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php.
- Affected:
- up to 1.9.7
- Fixed in:
- 1.9.7
- Disclosed:
- Jan 12, 2018
CVE-2018-5361 on NVD →
WPGlobus – Multilingual WordPress [wpglobus] < 1.9.7
unknown
[en] The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php.
- Affected:
- up to 1.9.7
- Fixed in:
- 1.9.7
- Disclosed:
- Jan 12, 2018
CVE-2018-5362 on NVD →
WPGlobus – Multilingual WordPress [wpglobus] < 1.9.7
unknown
Stored Cross-site scripting and Cross-site request forgery issues were found in WPGlobus WordPress plugin. Please update to the latest version.
- Affected:
- up to 1.9.7
- Fixed in:
- 1.9.7
- Disclosed:
- Jan 12, 2018
WPGlobus – Multilingual Everything! <= 1.9.6 - Cross-Site Request Forgery
high
The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php.
- CVSS:
- 8.8
- Affected:
- up to 1.9.6
- Fixed in:
- 1.9.7
- Disclosed:
- Jan 11, 2018
CVE-2018-5361 on NVD →
WPGlobus – Multilingual Everything! <= 1.9.6 - Cross-Site Request Forgery to Cross-Site Scripting via wpglobus_option[selector_wp_list_pages][show_selector]
medium
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options.php.
- CVSS:
- 6.1
- Affected:
- up to 1.9.6
- Fixed in:
- 1.9.7
- Disclosed:
- Jan 11, 2018
CVE-2018-5365 on NVD →
WPGlobus – Multilingual Everything! <= 1.9.6 - Cross-Site Scripting via wpglobus_option[more_languages]
medium
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[more_languages] parameter to wp-admin/options.php.
- CVSS:
- 4.8
- Affected:
- up to 1.9.6
- Fixed in:
- 1.9.7
- Disclosed:
- Jan 11, 2018
CVE-2018-5366 on NVD →
WPGlobus – Multilingual Everything! <= 1.9.6 - Cross-Site Scripting via wpglobus_option[post_type][post]
medium
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][post] parameter to wp-admin/options.php.
- CVSS:
- 4.8
- Affected:
- up to 1.9.6
- Fixed in:
- 1.9.7
- Disclosed:
- Jan 11, 2018
CVE-2018-5367 on NVD →
WPGlobus – Multilingual Everything! <= 1.9.6 - Cross-Site Scripting via wpglobus_option[enabled_languages]
medium
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language) parameter to wp-admin/options.php.
- CVSS:
- 4.8
- Affected:
- up to 1.9.6
- Fixed in:
- 1.9.7
- Disclosed:
- Jan 11, 2018
CVE-2018-5363 on NVD →
WPGlobus – Multilingual Everything! <= 1.9.6 - Cross-Site Scripting via wpglobus_option[browser_redirect][redirect_by_language]
medium
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php.
- CVSS:
- 4.8
- Affected:
- up to 1.9.6
- Fixed in:
- 1.9.7
- Disclosed:
- Jan 11, 2018
CVE-2018-5364 on NVD →
WPGlobus – Multilingual Everything! <= 1.9.6 - Cross-Site Scripting via wpglobus_option[post_type][page]
medium
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php.
- CVSS:
- 4.8
- Affected:
- up to 1.9.6
- Fixed in:
- 1.9.7
- Disclosed:
- Jan 11, 2018
CVE-2018-5362 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database