MALWARELIST.net – Your Information Security Source

WordPress vulnerabilities

Vulnerability: Security Bypass WordPress MailUp

Danger level: Avarage
Patch: None
Number of vulnerabilities: 1

CVE ID: CVE-2013-0731
Vector of operation: Remote
Impact: Security Bypass

Affected products: WordPress MailUp Plugin 1.x

Affected versions: WordPress MailUp 1.3.2, perhaps the only one.

Description:

Which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is caused due to the application improperly restrict access to certain functions in the script wp-content/plugins/wp-mailup/ajax.functions.php (when cookies “wordpress_logged_in_test” set.) This can be exploited to bypass security restrictions and manipulate specific application settings.

Manufacturer URL: http://wordpress.org/extend/plugins/wp-mailup/

Solution: The way to eliminate the vulnerability does not exist at present.

Vulnerability: Cross-site scripting WordPress podPress

Danger level: Low
Availability of fixes: Insturktsii to eliminate
Number of vulnerabilities: 1

Vector of operation: Remote
Impact: Cross Site Scripting

Affected products: WordPress podPress Plugin 8.x

Affected versions: WordPress podPress 8.8.10.13, possibly earlier.

Description:

The vulnerability allows malicious people to conduct XSS attacks.

The vulnerability is caused due to insufficient input validation in the parameter “playerID” in script wp-content/plugins/podpress/players/1pixelout/1pixelout_player.swf. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Manufacturer URL: http://wordpress.org/extend/plugins/podpress/

Solution: Install the latest version from the SVN repository.

Links:
http://wordpress.org/extend/plugins/podpress/changelog/