Summer of Pwnage

Cross-Site Request Forgery in WordPress Connection Information
July 2016 | Installs: Gazillion (WP Core) | Yorick Koster | OVE-20160717-0004 | Status: fixed
Cross-Site Request Forgery & Cross-Site Scripting in Contact Form Manager WordPress Plugin
March 2017 | Installs: 80k+ | Edwin Molenaar | OVE-20160718-0003 | Status: not fixed
Stored Cross-Site Scripting vulnerability in User Login Log WordPress Plugin (Exploitable as Subscriber)
March 2017 | Installs: 8k+ | Axel Koolhaas | OVE-20160724-0011 | Status: not fixed
WordPress Adminer plugin allows public (local) database login
March 2017 | Installs: 20K+ | David Vaartjes | OVE-20160728-0001 | Status: not fixed
VaultPress - Remote Code Execution via Man in The Middle attack
July 2016 | Installs: 20K+ | David Vaartjes | OVE-20160728-0002 | Status: resolved
Cross-Site Scripting in Alpine PhotoTile for Instagram WordPress Plugin (CSRF against Admin)
March 2017 | Installs: 40k+ | C. Rex | OVE-20160725-0010 | Status: not fixed
Cross-Site Scripting in Charitas Lite WordPress Theme (Pre auth)
March 2017 | Installs: 2k+ | C. Rex | OVE-20160725-0001 | Status: not fixed
Cross-Site Scripting in Google Analytics Dashboard WordPress Plugin (CSRF against Admin)
March 2017 | Installs: 50k+ | Yorick Koster | OVE-20160724-0026 | Status: not fixed
Popup by Supsystic WordPress plugin vulnerable to Cross-Site Request Forgery
March 2017 | Installs: 20k+ | Awesomo | OVE-20160724-0013 | Status: not fixed
Reflected Cross-Site Scripting in FormBuilder WordPress Plugin (CSRF against Admin)
March 2017 | Installs: 10k+ | Blangus | OVE-20160724-0006 | Status: not fixed
Cross-Site Scripting in Atahualpa WordPress Theme (CSRF against Admin)
March 2017 | Installs: 40k+ | Zorbas Nachos | OVE-20160724-0004 | Status: not fixed
Cross-Site Request Forgery in Atahualpa WordPress Theme
March 2017 | Installs: 40k+ | Zorbas Nachos | OVE-20160724-0003 | Status: not fixed
Cross-Site Request Forgery in WordPress Download Manager Plugin (CSRF against Admin)
March 2017 | Installs: 80k+ | Blangus | OVE-20160722-0005 | Status: not fixed
Cross-Site Scripting vulnerability in WP-SpamFree Anti-Spam WordPress Plugin (CSRF against Admin)
March 2017 | Installs: 40K+ | Awesomo | OVE-20160712-0026 | Status: not fixed
Cross-Site Scripting vulnerability in WP-Filebase Download Manager WordPress Plugin (CSRF against admin)
March 2017 | Installs: 40K+ | Yorick Koster | OVE-20160712-0019 | Status: not fixed
Cross-Site Scripting vulnerability in Trust Form WordPress Plugin (CSRF against admin)
March 2017 | Installs: 10K+ | Yorick Koster | OVE-20160712-0018 | Status: not fixed
Admin Custom Login WordPress plugin custom login page affected by persistent Cross-Site Scripting (CSRF against Admin)
March 2017 | Installs: 20K+ | Burak Kelebek | OVE-20160712-0003 | Status: not fixed
Admin Custom Login WordPress plugin affected by persistent Cross-Site Scripting via Logo URL field (CSRF against Admin)
March 2017 | Installs: 20K+ | Burak Kelebek | OVE-20160712-0002 | Status: not fixed
Analytics Stats Counter Statistics WordPress Plugin unauthenticated PHP Object injection vulnerability (Pre Auth)
March 2017 | Installs: 20K+ | Yorick Koster | OVE-20160803-0005 | Status: not fixed
nBill Lite WordPress Plugin unauthenticated PHP Object injection vulnerability (Pre auth)
March 2017 | Installs: 40+ | Han Sahin | OVE-20160712-0009 | Status: not fixed
Cross-Site Scripting vulnerability in Tribulant Slideshow Galleries WordPress Plugin (CSRF against Admin)
March 2017 | Installs: 50k+ | Zorbas Nachos | OVE-20160714-0016 | Status: not fixed
Cross-Site Scripting in Doctors WordPress Theme (Pre auth)
March 2017 | Installs: 600+ | C. Rex | OVE-20160725-0002 | Status: not fixed
Simple Ads Manager WordPress plugin unauthenticated PHP Object injection vulnerability (Pre auth)
March 2017 | Installs: 10k+ | Yorick Koster | OVE-20160712-0041 | Status: not fixed
Cross-Site Request Forgery in Global Content Blocks WordPress Plugin
March 2017 | Installs: 20K+ | Yorick Koster | OVE-20160712-0031 | Status: not fixed
Cross-Site Request Forgery in File Manager WordPress plugin
July 2016 | Installs: 20K+ | El Duderino | OVE-20160712-0029 | Status: resolved
WordPress audio playlist functionality is affected by Cross-Site Scripting
July 2016 | Installs: Gazillion (WP Core) | Yorick Koster | OVE-20160717-0003 | Status: fixed
Cross-Site Request Forgery in WordPress Press This function allows DoS
July 2016 | Installs: Gazillion (WP Core) | Sipke Mellema | OVE-20160718-0005 | Status: fixed
Stored Cross-Site Scripting vulnerability in Contact Form WordPress Plugin (Pre auth)
July 2016 | Installs: 200k+ | Julien Rentrop | OVE-20160712-0042 | Status: partially fixed
Cross-Site Scripting vulnerability in Quotes Collection WordPress Plugin (CSRF against admin)
July 2016 | Installs: 20K+ | Yorick Koster | OVE-20160712-0015 | Status: fixed
Persistent Cross-Site Scripting in the WordPress NewStatPress plugin (Pre auth)
July 2016 | Installs: 70K+ | Falcon | OVE-20160712-0030 | Status: fixed
Gwolle Guestbook mass action vulnerable for Cross-Site Request Forgery
July 2016 | Installs: 20k+ | Awesomo | OVE-20160724-0001 | Status: fixed
Cross-Site Scripting vulnerability in Gwolle Guestbook WordPress Plugin
July 2016 | Installs: 20K+ | Awesomo | OVE-20160712-0033 | Status: fixed
Cross-Site Scripting in Magic Fields 1 WordPress Plugin (CSRF against Admin)
July 2016 | Installs: ? | Blangus | OVE-20160724-0019 | Status: fixed
Multiple blind SQL injection vulnerabilities in FormBuilder WordPress Plugin (Exploitable as Author)
July 2016 | Installs: 10k+ | Blangus | OVE-20160724-0008 | Status: fixed
Cross-Site Request Forgery vulnerability in FormBuilder WordPress Plugin allows plugin permissions modification (CSRF against Admin)
July 2016 | Installs: 10k+ | Blangus | OVE-20160724-0005 | Status: fixed
Persistent Cross-Site Scripting vulnerability in User Access Manager WordPress Plugin (CSRF against admin)
July 2016 | Installs: 40K+ | Blangus | OVE-20160712-0025 | Status: fixed
InfiniteWP Client WordPress Plugin unauthenticated PHP Object injection vulnerability (Pre auth)
July 2016 | Installs: 400K+ | Yorick Koster | OVE-20160803-0004 | Status: fixed
CMS Commander Client WordPress Plugin unauthenticated PHP Object injection vulnerability (Pre auth)
July 2016 | Installs: 20K+ | Yorick Koster | OVE-20160803-0003 | Status: fixed
Google Forms WordPress Plugin unauthenticated PHP Object injection vulnerability (Pre auth)
July 2016 | Installs: 20K+ | Yorick Koster | OVE-20160803-0001 | Status: fixed
Google Analytics Counter Tracker WordPress Plugin unauthenticed PHP Object injection vulnerability (Pre auth)
July 2016 | Installs: 20K+ | Remco Vermeulen | OVE-20160712-0035 | Status: fixed
Cross-Site Request Forgery in Insert Html Snippet WordPress Plugin
July 2016 | Installs: 30k+ | Yorick Koster | OVE-20160724-0027 | Status: fixed
Stored Cross-Site Scripting in Gallery - Image Gallery WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 70k+ | Sipke Mellema | OVE-20160724-0015 | Status: fixed
Stored Cross-Site Scripting in WP Canvas - Shortcodes WordPress Plugin (Exploitable as Contributor)
July 2016 | Installs: 30k+ | Yorick Koster | OVE-20160724-0031 | Status: fixed
Persistent Cross-Site Scripting in Instagram Feed plugin via CSRF (CSRF against Admin)
July 2016 | Installs: 200k+ | Sipke Mellema | OVE-20160724-0014 | Status: fixed
Cross-Site Scripting in Huge IT Portfolio Gallery WordPress Plugin (CSRF against Subscriber+)
July 2016 | Installs: 50k+ | C. Rex | OVE-20160724-0009 | Status: fixed
Cross-Site Scripting in Check Email WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 10k+ | C. Rex | OVE-20160725-0009 | Status: fixed
Cross-Site Scripting in All In One WP Security & Firewall WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 400k+ | Yorick Koster | OVE-20160731-0003 | Status: fixed
Weak validation of Amazon SNS push messages in W3 Total Cache WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 1+ million | Sipke Mellema | OVE-20160724-0012 | Status: fixed
Information disclosure race condition in W3 Total Cache WordPress Plugin (Pre-auth)
July 2016 | Installs: 1+ million | Sipke Mellema | OVE-20160724-0002 | Status: fixed
Reflected Cross-Site Scripting vulnerability in W3 Total Cache plugin (CSRF against Admin)
July 2016 | Installs: 1+ million | Sipke Mellema | OVE-20160719-0004 | Status: fixed
Persistent Cross-Site Scripting in WP Google Maps Plugin via CSRF
July 2016 | Installs: 300k+ | Sipke Mellema | OVE-20160724-0007 | Status: fixed
Stored Cross-Site Scripting vulnerability in 404 to 301 WordPress Plugin (Pre-auth)
July 2016 | Installs: 60k+ | Alyssa Milburn | OVE-20160719-0003 | Status: fixed
YITH WooCommerce Compare WordPress Plugin unauthenticated PHP Object injection vulnerability (Pre auth)
July 2016 | Installs: 100K+ | Yorick Koster | OVE-20160803-0006 | Status: fixed
Cross-Site Scripting vulnerability in Caldera Forms WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 20k+ | Jurgen Kloosterman | OVE-20160720-0007 | Status: fixed
Cross-Site Scripting in Calendar WordPress Plugin (Pre-auth)
July 2016 | Installs: 30k+ | Remco Vermeulen | OVE-20160725-0008 | Status: fixed
Persistent Cross-Site Scripting in WassUp Real Time Analytics WordPress Plugin (Pre-auth)
July 2016 | Installs: 50k+ | Burak Kelebek | OOVE-20160717-0002 | Status: fixed
Authorization bypass in InfiniteWP Admin Panel
July 2016 | Installs: 400K+ | Sipke Mellema | OVE-20160712-0006 | Status: fixed
Command injection in InfiniteWP Admin Panel (via CSRF)
July 2016 | Installs: 400K+ | Sipke Mellema | OVE-20160712-0007 | Status: fixed
Reflected Cross-Site Scripting vulnerability in MailPoet Newsletters plugin (CSRF against Admin)
July 2016 | Installs: 300k+ | Sipke Mellema | OVE-20160721-0002 | Status: fixed
Persistent Cross-Site Scripting in Woocommerce WordPress plugin
July 2016 | Installs: 1+ million | Sipke Mellema | OVE-20160719-0002 | Status: fixed
Persistent Cross-Site Scripting vulnerability in WordPress due to unsafe processing of file names (Trick Admin)
July 2016 | Installs: Gazillion (WP Core) | Han Sahin | OVE-20160724-0018 | Status: fixed
Path traversal vulnerability in WordPress Core Ajax handlers (DoS as Subscriber)
July 2016 | Installs: Gazillion (WP Core) | Yorick Koster | OVE-20160712-0036 | Status: fixed
Cross-Site Request Forgery vulnerability in Email Users WordPress Plugin
July 2016 | Installs: 10k+ | Julien Rentrop | OVE-20160718-0001 | Status: fixed
Persistent Cross-Site Scripting in Magic Fields 1 WordPress Plugin (CSRF against Admin)
July 2016 | Installs: ? | Blangus | OVE-20160724-0020 | Status: fixed
Cross-Site Scripting in Link Library WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 20k+ | Blangus | OVE-20160724-0016 | Status: fixed
Persistent Cross-Site Scripting in Magic Fields 2 WordPress Plugin (CSRF against Admin)
July 2016 | Installs: ? | Blangus | OVE-20160724-0017 | Status: fixed
Ajax Load More Local File Inclusion vulnerability (Pre auth)
July 2016 | Installs: 20K+ | Blangus | OVE-20160712-0034 | Status: fixed
Cross-Site Scripting vulnerability in Google Maps WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 30k+ | Julien Rentrop | OVE-20160712-0038 | Status: fixed
Cross-Site Scripting/Cross-Site Request Forgery in Peter's Login Redirect WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 80k+ | Yorick Koster | OVE-20160724-0028 | Status: fixed
Stored Cross-Site Scripting vulnerability in Photo Gallery WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 30k+ | Umit Aksu | OVE-20160722-0004 | Status: fixed
Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows adding of images (CSRF against Admin)
July 2016 | Installs: 30k+ | Umit Aksu | OVE-20160722-0001 | Status: fixed
Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows deleting of images (CSRF against Admin)
July 2016 | Installs: 30k+ | Umit Aksu | OVE-20160722-0002 | Status: fixed
Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows deleting of galleries (CSRF against Admin)
July 2016 | Installs: 30k+ | Umit Aksu | OVE-20160722-0003 | Status: fixed
Cross-Site Request Forgery vulnerability in Add From Server WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 80k+ | Edwin Molenaar | OVE-20160718-0004 | Status: fixed
Cross-Site Scripting in Store Locator Plus for WordPress (CSRF against Admin)
July 2016 | Installs: 10k+ | Yorick Koster | OVE-20160724-0025 | Status: fixed
Ecwid Ecommerce Shopping Cart WordPress Plugin unauthenticated PHP Object injection vulnerability
July 2016 | Installs: 20K+ | Yorick Koster | OVE-20160803-0002 | Status: fixed
Cross-Site Scripting vulnerability in Events Made Easy WordPress plugin (CSRF against Admin)
July 2016 | Installs: 10k+ | Job Diesveld | OVE-20160729-0001 | Status: fixed
Cross-Site Scripting in Count per Day WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 90k+ | Yorick Koster | OVE-20160724-0024 | Status: fixed
Stored Cross-Site Scripting vulnerability in Count per Day WordPress Plugin (Pre auth)
July 2016 | Installs: 90k+ | Julien Rentrop | OVE-20160717-0001 | Status: fixed
Cross-Site Scripting in FormBuilder WordPress Plugin
July 2016 | Installs: 10k+ | Peter Ganzevles | OVE-20160722-0007 | Status: fixed
Cross-Site Scripting in WordPress Landing Pages Plugin (CSRF against Admin)
July 2016 | Installs: 20k+ | Blangus | OVE-20160721-0001 | Status: fixed
Cross-Site Scripting in Activity Log WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 30k+ | Yorick Koster | OVE-20160724-0022 | Status: fixed
Cross-Site Scripting vulnerability in search function Activity Log WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 30k+ | Edwin Molenaar | OVE-20160718-0002 | Status: fixed
Cross-Site Scripting in Uji Countdown WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 10k+ | Yorick Koster | OVE-20160724-0029 | Status: fixed
Cross-Site Scripting in WangGuard WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 20k+ | Yorick Koster | OVE-20160724-0030 | Status: fixed
Cross-Site Request Forgery in ALO EasyMail Newsletter WordPress Plugin
July 2016 | Installs: 10k+ | Yorick Koster | OVE-20160724-0021 | Status: fixed
Stored Cross-Site Scripting vulnerability in WP Live Chat Support WordPress Plugin (Pre-auth)
July 2016 | Installs: 20k+ | Dennis Kerdijk & Erwin Kievith | OVE-20160724-0010 | Status: fixed
Cross-Site Scripting in Contact Bank WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 30k+ | Yorick Koster | OVE-20160724-0023 | Status: fixed
SQL injection vulnerability in Booking Calendar WordPress Plugin (As Editor)
July 2016 | Installs: 30k+ | Edwin Molenaar | OVE-20160714-0002 | Status: fixed
Cross-Site Scripting vulnerability in Booking Calendar WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 30k+ | Edwin Molenaar | OVE-20160714-0003 | Status: fixed
Multiple vulnerabilities in All In One WP Security & Firewall plugin login CAPTCHA (Pre-auth)
July 2016 | Installs: 400k+ | Sipke Mellema | OVE-20160719-0001 | Status: fixed (2/4)
Insert PHP WordPress Plugin allows authenticated user to execute arbitrary PHP (Contributor+)
July 2016 | Installs: 100k+ | Marcel Vermeulen & Ed van der Vlies | OVE-20160712-0001 | Status: won't fix
Stored Cross-Site Scripting vulnerability in Easy Testimonials WordPress Plugin (Contributor+)
July 2016 | Installs: 30K+ | Bente Schopman | OVE-20160712-0010 | Status: fixed
Cross-Site Scripting vulnerability in ColorWay WordPress Theme (Pre-auth)
July 2016 | Installs: 10K+ | Yorick Koster | OVE-20160712-0024 | Status: fixed
Cross-Site Scripting in Code Snippets WordPress Plugin
July 2016 | Installs: 20k+ | Blangus | OVE-20160722-0006 | Status: fixed
Cross-Site Scripting in Contact Form to Email WordPress Plugin (CSRF against Admin)
July 2016 | Installs: 40k+ | Blangus | OVE-20160721-0003 | Status: fixed
Persistent Cross-Site Scripting in WooCommerce via image metadata (Trick Admin)
July 2016 | Installs: 1+ million | Han Sahin | OVE-20160720-0006 | Status: fixed
Cross-Site Scripting vulnerability in Paid Memberships Pro WordPress Plugin. CSRF against Admin.
July 2016 | Installs: 50k+ | Blangus | OVE-20160714-0015 | Status: fixed
Multiple SQL injection vulnerabilities in WordPress Video Player (Exploitable by >= Contributor)
July 2016 | Installs: 10K+ | Yorick Koster / David Vaartjes | OVE-20160712-0004 | Status: fixed
Cross-Site Request Forgery in Icegram WordPress Plugin (CSRF against admin)
July 2016 | Installs: 10K+ | Yorick Koster | OVE-20160712-0032 | Status: fixed
Multiple Cross-Site Scripting vulnerabilities in Ninja Forms WordPress Plugin
July 2016 | Installs: 600k+ | Han Sahin | OVE-20160714-0018 | Status: fixed
Cross-Site Scripting vulnerability in Google Forms WordPress Plugin (CSRF against admin)
July 2016 | Installs: 20K+ | Yorick Koster | OVE-20160712-0021 | Status: fixed
Cross-Site Scripting vulnerability in WP No External Links WordPress Plugin (CSRF against admin)
July 2016 | Installs: 20K+ | Yorick Koster | OVE-20160712-0020 | Status: fixed
Cross-Site Scripting vulnerability in Top 10 - Popular posts plugin for WordPress (CSRF against admin)
July 2016 | Installs: 30K+ | Yorick Koster | OVE-20160712-0017 | Status: fixed
Cross-Site Scripting vulnerability in Simple Membership WordPress Plugin (CSRF against admin)
July 2016 | Installs: 10K+ | Yorick Koster | OVE-20160712-0016 | Status: fixed
Easy Forms for MailChimp Local File Inclusion vulnerability (CSRF against admin)
July 2016 | Installs: 40K+ | Yorick Koster | OVE-20160712-0023 | Status: fixed
WP Fastest Cache Member Local File Inclusion vulnerability (CSRF against admin)
July 2016 | Installs: 100K+ | Yorick Koster | OVE-20160712-0022 | Status: fixed
Cross-Site Scripting vulnerability in Email Users WordPress Plugin (CSRF against admin)
July 2016 | Installs: 10K+ | Yorick Koster | OVE-20160712-0012 | Status: fixed
Cross-Site Scripting vulnerability in Master Slider WordPress Plugin (CSRF against admin)
July 2016 | Installs: 80K+ | Yorick Koster | OVE-20160712-0013 | Status: fixed
Cross-Site Scripting vulnerability in Profile Builder WordPress Plugin (CSRF against admin)
July 2016 | Installs: 40K+ | Yorick Koster | OVE-20160712-0014 | Status: fixed
Persistent Cross-Site Scripting in WordPress Activity Log plugin (Pre-auth)
July 2016 | Installs: 30K+ | Han Sahin | OVE-20160712-0037 | Status: fixed
Persistent Cross-Site Scripting in WP Live Chat Support plugin (Pre-auth)
July 2016 | Installs: 20K+ | Han Sahin | OVE-20160712-0008 | Status: fixed
Hijack WP-dashboard via persistent XSS in SEO plugin (anonymous/ payload delivery)
July 2016 | Installs: 1M+ | David Vaartjes | OVE-20160712-0027 | Status: fixed
Ultimate Member Local File Inclusion vulnerability (CSRF against admin)
July 2016 | Installs: 30K+ | Burak Kelebek | OVE-20160712-0011 | Status: fixed