[FD] CSRF in Disqus for Wordpress 2.77

2014-08-16 Thread Voxel@Night
Disqus for Wordpress https://wordpress.org/plugins/disqus-comment-system Version affected: up to v2.77 CSRF allows for activation and deactivation of the plugin and syncing comments between Disqus servers and the WP database. They supposedly just fixed the CSRF issues. Ugh. Sorry Nik. Even when

[FD] Wordpress Plugin Vulnerability Dump - Part 1

2014-09-02 Thread Voxel@Night
Album Plus v5.4.5 - XSS Details and POCs located: https://vexatioustendencies.com/wordpress-plugin-vulnerability-dump-part-1/ (Many) more to follow. -Voxel@Night ___ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo

[FD] WordPress Plugin Vulnerability Dump - Part 2

2014-09-09 Thread Voxel@Night
Stored XSS Details and POCs located: https://vexatioustendencies.com/wordpress-plugin-vulnerability-dump-part-2/ More to follow. -Voxel@Night ___ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives &

[FD] Wordfence v5.2.3 (Wordpress Security Plugin) - Multiple Vulnerabilities

2014-09-15 Thread Voxel@Night
ging-throttle-bypass-exploit-detection-bypass/ -Voxel@Night ___ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/