Wordpress Multiple Third Party Plugins Vulnerabilities
Description
(#Several vulnerabilities have been identified in third-party plugins for WordPress:#- Ultimate Member: local file inclusion. This vulnerability stems from a lack of validation of user-supplied inputs in the "page" parameters#- All in One SEO: stored cross-site scripting. This vulnerability is located in the "Bot Blocker" functionality#- Profile Builder: privilege escalation#- Lazy Content Slider: cross site request forgery (CSRF) in the "Add Category" feature#- WP-DownloadManager : arbitrary file upload#- WP Maintenance Mode: several vulnerabilities. Information disclosure, missing authorization and remote code execution vulnerabilities#- WP Job Manager: arbitrary file upload#- WP Live Chat Support: stored cross-site scripting#- Activity Log: stored cross-site scripting##Proof of concept are available.)
