gVectors wpDiscuz

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.

Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.)

Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider

wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()

WordPress Comments – wpDiscuz plugin 7.4.2 - Auth. Insecure Direct Object References (IDOR) vulnerability

WordPress wpDiscuz plugin <= 7.6.3 - Broken Access Control vulnerability

WordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Request Forgery (CSRF)

Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi

wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType

wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email

WordPress wpDiscuz plugin <= 7.3.11 - Sensitive Information Disclosure

WordPress wpDiscuz plugin <= 7.6.10 - Broken Access Control vulnerability

WordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Scripting (XSS)

wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass

wpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in Plaintext

wpDiscuz before 7.6.47 - IP Address Spoofing in getIP()

WordPress wpDiscuz Plugin <= 7.6.3 is vulnerable to Insecure Direct Object References (IDOR)

WordPress wpDiscuz plugin <= 7.6.18 - Cross Site Scripting (XSS) vulnerability

wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text

wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient

Comments – wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection

WordPress wpDiscuz plugin <= 7.6.10 - Content Injection vulnerability

wpDiscuz before 7.6.47 - Stored Cross-Site Scripting in Inline Comment Preview

wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs

WordPress wpDiscuz Plugin <= 7.6.12 is vulnerable to Cross Site Scripting (XSS)

wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Custom CSS in Style Tag

wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage

wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease

wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease

Beghelli Sicuro24 SicuroWeb AngularJS Template Injection

Comments - wpDiscuz <= 7.3.0 - Admin+ Stored Cross-Site Scripting

wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF