TUCoPS :: Web :: Blogs :: bt-22027.htm

WordPress plugins vulns

Better a bottle in front of me than a frontal lobotomy.

Vulnerabilities in plugins for WordPress
Vulnerabilities in plugins for WordPress



Hello Bugtraq!

I want to tell you about different vulnerabilities in plugins for WordPress.
About some of them there were posts to the list earlier.

This August I made a summary about all vulnerabilities in plugins for
WordPress (http://websecurity.com.ua/3397/), which I found during 2006-2009. 

In this list 135 different vulnerabilities are mentioned in 20 plugins for
WordPress. Including Cross-Site Scripting, Insufficient Anti-automation,
Cross-Site Request Forgery, Directory Traversal, Arbitrary File Deletion,
Denial of Service, Full path disclosure, Insufficient Authorization,
Information Leakage, Abuse of Functionality, HTTP Response Splitting, SQL
Injection and CRLF Injection vulnerabilities.

Most posts mentioned in the list are on Ukrainian (so use Google Translate),
but some of them are on English - posts from my Month of Bugs in Captchas
(MoBiC) project, which I made in 2007. Take care of your plugins for WP and
web sites which use them.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 



TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH