Wordpress Multiple Third Party Plugins Multiple Vulnerabilities
Description
Several vulnerabilities have been identified in Wordpress third party plugins:
- dzs-zoomsounds: arbitrary file upload via "admin/upload.php"
- Store Locator Plus: data injection allowing to modify the receiver of an email
- Incoming Links: cross-site scripting in "referrers.php"
- Esplanade: cross-site scripting in "theme-options.php"
- Ultimate Social Media and Share Icons: cross-site scriping in "sfsi_buttons_controller.php"
- Formidable Forms: information disclosure in "FrmFormsController.php"
- UserPro: cross-site scripting in "login/?redirect_to"
- XCloner: cross-site scripting in "functions.php"
- Coppermine Photo Gallery: open redirect in "mode.php" (CVE-2015-3922)
- Coppermine Photo Gallery: open redirect in "referer" (CVE-2015-3921)
- LeagueManager: SQL injection via "getMatch()"
- Simple Share Buttons Adder: cross-site scripting via "hello-world"
- Codestyling Localization: several remote code execution via cross-site request forgery exploitation
- N-Media Website: local file inclusion
- zM Ajax Login and Register: local file inclusion
- grand-media: several vulnerabilities such as cross-site scripting, local file inclusion and denial of service
- wp-mobile-edition : several vulnerabilities such as local file inclusion and denial of service
- wp-fastest-cache : cross-site scripting
- leaflet-maps-marker : cross-site scripting
- landing-pages : cross-site scripting in admin session
- extended-catagories-widget : undisclosed vulnerability
- gallery-images : cross-site scripting in admin session
- gallery-video : cross-site scripting in admin session
- easy-google-fonts : cross-site scripting in admin session
- cta : cross-site scripting and cross-site request forgery in admin session
- constant-contact-api : cross-site scripting
Proofs of concept are available.
Vulnerable Products
Vulnerable Software: WordPress (WordPress)
Solution
New versions of the following plugins fix these vulnerabilities:- Store Locator Plus: 4.2.27- Incoming Links: 0.9.10b- Esplanade: 1.1.5- Ultimate Social Media and Share Icons: 1.1.1.12- Formidable Forms: 2.0.08- Coppermine Photo Gallery: 1.5.36- Simple Share Buttons Adder: 6.0.1- N-Media Website: 1.6- zM Ajax Login and Register: 1.1.0
