2017 (IoT)

• Seagate Media Server path traversal vulnerability

  Yorick Koster | Status: fixed

• Seagate Media Server stored Cross-Site Scripting vulnerability

  Yorick Koster | Status: fixed

• Seagate Personal Cloud allows moving of arbitrary files

  Yorick Koster | Status: fixed

• Seagate Media Server allows deleting of arbitrary files and folders

  Yorick Koster | Status: fixed

• Seagate Media Server multiple command injection vulnerabilities

  Yorick Koster | Status: fixed

• Multiple vulnerabilities in VTech DigiGo allow browser overlay attack

  Sipke Mellema | Status: fixed

• Broken TLS certificate validation in VTech DigiGo browser

  Sipke Mellema | Status: fixed

• Broken TLS certificate pinning in VTech DigiGo Kid Connect app

  Sipke Mellema | Status: fixed

2016 (WordPress)

• Cross-Site Request Forgery in WordPress Connection Information

  Installs: Gazillion (WP Core) | Yorick Koster | OVE-20160717-0004 | Status: fixed

• Cross-Site Request Forgery & Cross-Site Scripting in Contact Form Manager WordPress Plugin

  Installs: 80k+ | Edwin Molenaar | OVE-20160718-0003 | Status: not fixed

• Stored Cross-Site Scripting vulnerability in User Login Log WordPress Plugin (Exploitable as Subscriber)

  Installs: 8k+ | Axel Koolhaas | OVE-20160724-0011 | Status: not fixed

• WordPress Adminer plugin allows public (local) database login

  Installs: 20K+ | David Vaartjes | OVE-20160728-0001 | Status: not fixed

• VaultPress - Remote Code Execution via Man in The Middle attack

  Installs: 20K+ | David Vaartjes | OVE-20160728-0002 | Status: resolved

• Cross-Site Scripting in Alpine PhotoTile for Instagram WordPress Plugin (CSRF against Admin)

  Installs: 40k+ | C. Rex | OVE-20160725-0010 | Status: not fixed

• Cross-Site Scripting in Charitas Lite WordPress Theme (Pre auth)

  Installs: 2k+ | C. Rex | OVE-20160725-0001 | Status: not fixed

• Cross-Site Scripting in Google Analytics Dashboard WordPress Plugin (CSRF against Admin)

  Installs: 50k+ | Yorick Koster | OVE-20160724-0026 | Status: not fixed

• Popup by Supsystic WordPress plugin vulnerable to Cross-Site Request Forgery

  Installs: 20k+ | Awesomo | OVE-20160724-0013 | Status: not fixed

• Reflected Cross-Site Scripting in FormBuilder WordPress Plugin (CSRF against Admin)

  Installs: 10k+ | Blangus | OVE-20160724-0006 | Status: not fixed

• Cross-Site Scripting in Atahualpa WordPress Theme (CSRF against Admin)

  Installs: 40k+ | Zorbas Nachos | OVE-20160724-0004 | Status: not fixed

• Cross-Site Request Forgery in Atahualpa WordPress Theme

  Installs: 40k+ | Zorbas Nachos | OVE-20160724-0003 | Status: not fixed

• Cross-Site Request Forgery in WordPress Download Manager Plugin (CSRF against Admin)

  Installs: 80k+ | Blangus | OVE-20160722-0005 | Status: not fixed

• Cross-Site Scripting vulnerability in WP-SpamFree Anti-Spam WordPress Plugin (CSRF against Admin)

  Installs: 40K+ | Awesomo | OVE-20160712-0026 | Status: not fixed

• Cross-Site Scripting vulnerability in WP-Filebase Download Manager WordPress Plugin (CSRF against admin)

  Installs: 40K+ | Yorick Koster | OVE-20160712-0019 | Status: not fixed

• Cross-Site Scripting vulnerability in Trust Form WordPress Plugin (CSRF against admin)

  Installs: 10K+ | Yorick Koster | OVE-20160712-0018 | Status: not fixed

• Admin Custom Login WordPress plugin custom login page affected by persistent Cross-Site Scripting (CSRF against Admin)

  Installs: 20K+ | Burak Kelebek | OVE-20160712-0003 | Status: not fixed

• Admin Custom Login WordPress plugin affected by persistent Cross-Site Scripting via Logo URL field (CSRF against Admin)

  Installs: 20K+ | Burak Kelebek | OVE-20160712-0002 | Status: not fixed

• Analytics Stats Counter Statistics WordPress Plugin unauthenticated PHP Object injection vulnerability (Pre Auth)

  Installs: 20K+ | Yorick Koster | OVE-20160803-0005 | Status: not fixed

• nBill Lite WordPress Plugin unauthenticated PHP Object injection vulnerability (Pre auth)

  Installs: 40+ | Han Sahin | OVE-20160712-0009 | Status: not fixed

• Cross-Site Scripting vulnerability in Tribulant Slideshow Galleries WordPress Plugin (CSRF against Admin)

  Installs: 50k+ | Zorbas Nachos | OVE-20160714-0016 | Status: not fixed

• Cross-Site Scripting in Doctors WordPress Theme (Pre auth)

  Installs: 600+ | C. Rex | OVE-20160725-0002 | Status: not fixed

• Simple Ads Manager WordPress plugin unauthenticated PHP Object injection vulnerability (Pre auth)

  Installs: 10k+ | Yorick Koster | OVE-20160712-0041 | Status: not fixed

• Cross-Site Request Forgery in Global Content Blocks WordPress Plugin

  Installs: 20K+ | Yorick Koster | OVE-20160712-0031 | Status: not fixed

• Cross-Site Request Forgery in File Manager WordPress plugin

  Installs: 20K+ | El Duderino | OVE-20160712-0029 | Status: resolved

• WordPress audio playlist functionality is affected by Cross-Site Scripting

  Installs: Gazillion (WP Core) | Yorick Koster | OVE-20160717-0003 | Status: fixed

• Cross-Site Request Forgery in WordPress Press This function allows DoS

  Installs: Gazillion (WP Core) | Sipke Mellema | OVE-20160718-0005 | Status: fixed

• Stored Cross-Site Scripting vulnerability in Contact Form WordPress Plugin (Pre auth)

  Installs: 200k+ | Julien Rentrop | OVE-20160712-0042 | Status: partially fixed

• Cross-Site Scripting vulnerability in Quotes Collection WordPress Plugin (CSRF against admin)

  Installs: 20K+ | Yorick Koster | OVE-20160712-0015 | Status: fixed

• Persistent Cross-Site Scripting in the WordPress NewStatPress plugin (Pre auth)

  Installs: 70K+ | Falcon | OVE-20160712-0030 | Status: fixed

• Gwolle Guestbook mass action vulnerable for Cross-Site Request Forgery

  Installs: 20k+ | Awesomo | OVE-20160724-0001 | Status: fixed

• Cross-Site Scripting vulnerability in Gwolle Guestbook WordPress Plugin

  Installs: 20K+ | Awesomo | OVE-20160712-0033 | Status: fixed

• Cross-Site Scripting in Magic Fields 1 WordPress Plugin (CSRF against Admin)

  Installs: ? | Blangus | OVE-20160724-0019 | Status: fixed

• Multiple blind SQL injection vulnerabilities in FormBuilder WordPress Plugin (Exploitable as Author)

  Installs: 10k+ | Blangus | OVE-20160724-0008 | Status: fixed

• Cross-Site Request Forgery vulnerability in FormBuilder WordPress Plugin allows plugin permissions modification (CSRF against Admin)

  Installs: 10k+ | Blangus | OVE-20160724-0005 | Status: fixed

• Persistent Cross-Site Scripting vulnerability in User Access Manager WordPress Plugin (CSRF against admin)

  Installs: 40K+ | Blangus | OVE-20160712-0025 | Status: fixed

• InfiniteWP Client WordPress Plugin unauthenticated PHP Object injection vulnerability (Pre auth)

  Installs: 400K+ | Yorick Koster | OVE-20160803-0004 | Status: fixed

• CMS Commander Client WordPress Plugin unauthenticated PHP Object injection vulnerability (Pre auth)

  Installs: 20K+ | Yorick Koster | OVE-20160803-0003 | Status: fixed

• Google Forms WordPress Plugin unauthenticated PHP Object injection vulnerability (Pre auth)

  Installs: 20K+ | Yorick Koster | OVE-20160803-0001 | Status: fixed

• Google Analytics Counter Tracker WordPress Plugin unauthenticed PHP Object injection vulnerability (Pre auth)

  Installs: 20K+ | Remco Vermeulen | OVE-20160712-0035 | Status: fixed

• Cross-Site Request Forgery in Insert Html Snippet WordPress Plugin

  Installs: 30k+ | Yorick Koster | OVE-20160724-0027 | Status: fixed

• Stored Cross-Site Scripting in Gallery - Image Gallery WordPress Plugin (CSRF against Admin)

  Installs: 70k+ | Sipke Mellema | OVE-20160724-0015 | Status: fixed

• Stored Cross-Site Scripting in WP Canvas - Shortcodes WordPress Plugin (Exploitable as Contributor)

  Installs: 30k+ | Yorick Koster | OVE-20160724-0031 | Status: fixed

• Persistent Cross-Site Scripting in Instagram Feed plugin via CSRF (CSRF against Admin)

  Installs: 200k+ | Sipke Mellema | OVE-20160724-0014 | Status: fixed

• Cross-Site Scripting in Huge IT Portfolio Gallery WordPress Plugin (CSRF against Subscriber+)

  Installs: 50k+ | C. Rex | OVE-20160724-0009 | Status: fixed

• Cross-Site Scripting in Check Email WordPress Plugin (CSRF against Admin)

  Installs: 10k+ | C. Rex | OVE-20160725-0009 | Status: fixed

• Cross-Site Scripting in All In One WP Security & Firewall WordPress Plugin (CSRF against Admin)

  Installs: 400k+ | Yorick Koster | OVE-20160731-0003 | Status: fixed

• Weak validation of Amazon SNS push messages in W3 Total Cache WordPress Plugin (CSRF against Admin)

  Installs: 1+ million | Sipke Mellema | OVE-20160724-0012 | Status: fixed

• Information disclosure race condition in W3 Total Cache WordPress Plugin (Pre-auth)

  Installs: 1+ million | Sipke Mellema | OVE-20160724-0002 | Status: fixed

• Reflected Cross-Site Scripting vulnerability in W3 Total Cache plugin (CSRF against Admin)

  Installs: 1+ million | Sipke Mellema | OVE-20160719-0004 | Status: fixed

• Persistent Cross-Site Scripting in WP Google Maps Plugin via CSRF

  Installs: 300k+ | Sipke Mellema | OVE-20160724-0007 | Status: fixed

• Stored Cross-Site Scripting vulnerability in 404 to 301 WordPress Plugin (Pre-auth)

  Installs: 60k+ | Alyssa Milburn | OVE-20160719-0003 | Status: fixed

• YITH WooCommerce Compare WordPress Plugin unauthenticated PHP Object injection vulnerability (Pre auth)

  Installs: 100K+ | Yorick Koster | OVE-20160803-0006 | Status: fixed

• Cross-Site Scripting vulnerability in Caldera Forms WordPress Plugin (CSRF against Admin)

  Installs: 20k+ | Jurgen Kloosterman | OVE-20160720-0007 | Status: fixed

• Cross-Site Scripting in Calendar WordPress Plugin (Pre-auth)

  Installs: 30k+ | Remco Vermeulen | OVE-20160725-0008 | Status: fixed

• Persistent Cross-Site Scripting in WassUp Real Time Analytics WordPress Plugin (Pre-auth)

  Installs: 50k+ | Burak Kelebek | OOVE-20160717-0002 | Status: fixed

• Authorization bypass in InfiniteWP Admin Panel

  Installs: 400K+ | Sipke Mellema | OVE-20160712-0006 | Status: fixed

• Command injection in InfiniteWP Admin Panel (via CSRF)

  Installs: 400K+ | Sipke Mellema | OVE-20160712-0007 | Status: fixed

• Reflected Cross-Site Scripting vulnerability in MailPoet Newsletters plugin (CSRF against Admin)

  Installs: 300k+ | Sipke Mellema | OVE-20160721-0002 | Status: fixed

• Persistent Cross-Site Scripting in Woocommerce WordPress plugin

  Installs: 1+ million | Sipke Mellema | OVE-20160719-0002 | Status: fixed

• Persistent Cross-Site Scripting vulnerability in WordPress due to unsafe processing of file names (Trick Admin)

  Installs: Gazillion (WP Core) | Han Sahin | OVE-20160724-0018 | Status: fixed

• Path traversal vulnerability in WordPress Core Ajax handlers (DoS as Subscriber)

  Installs: Gazillion (WP Core) | Yorick Koster | OVE-20160712-0036 | Status: fixed

• Cross-Site Request Forgery vulnerability in Email Users WordPress Plugin

  Installs: 10k+ | Julien Rentrop | OVE-20160718-0001 | Status: fixed

• Persistent Cross-Site Scripting in Magic Fields 1 WordPress Plugin (CSRF against Admin)

  Installs: ? | Blangus | OVE-20160724-0020 | Status: fixed

• Cross-Site Scripting in Link Library WordPress Plugin (CSRF against Admin)

  Installs: 20k+ | Blangus | OVE-20160724-0016 | Status: fixed

• Persistent Cross-Site Scripting in Magic Fields 2 WordPress Plugin (CSRF against Admin)

  Installs: ? | Blangus | OVE-20160724-0017 | Status: fixed

• Ajax Load More Local File Inclusion vulnerability (Pre auth)

  Installs: 20K+ | Blangus | OVE-20160712-0034 | Status: fixed

• Cross-Site Scripting vulnerability in Google Maps WordPress Plugin (CSRF against Admin)

  Installs: 30k+ | Julien Rentrop | OVE-20160712-0038 | Status: fixed

• Cross-Site Scripting/Cross-Site Request Forgery in Peter's Login Redirect WordPress Plugin (CSRF against Admin)

  Installs: 80k+ | Yorick Koster | OVE-20160724-0028 | Status: fixed

• Stored Cross-Site Scripting vulnerability in Photo Gallery WordPress Plugin (CSRF against Admin)

  Installs: 30k+ | Umit Aksu | OVE-20160722-0004 | Status: fixed

• Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows adding of images (CSRF against Admin)

  Installs: 30k+ | Umit Aksu | OVE-20160722-0001 | Status: fixed

• Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows deleting of images (CSRF against Admin)

  Installs: 30k+ | Umit Aksu | OVE-20160722-0002 | Status: fixed

• Cross-Site Request Forgery in Photo Gallery WordPress Plugin allows deleting of galleries (CSRF against Admin)

  Installs: 30k+ | Umit Aksu | OVE-20160722-0003 | Status: fixed

• Cross-Site Request Forgery vulnerability in Add From Server WordPress Plugin (CSRF against Admin)

  Installs: 80k+ | Edwin Molenaar | OVE-20160718-0004 | Status: fixed

• Cross-Site Scripting in Store Locator Plus for WordPress (CSRF against Admin)

  Installs: 10k+ | Yorick Koster | OVE-20160724-0025 | Status: fixed

• Ecwid Ecommerce Shopping Cart WordPress Plugin unauthenticated PHP Object injection vulnerability

  Installs: 20K+ | Yorick Koster | OVE-20160803-0002 | Status: fixed

• Cross-Site Scripting vulnerability in Events Made Easy WordPress plugin (CSRF against Admin)

  Installs: 10k+ | Job Diesveld | OVE-20160729-0001 | Status: fixed

• Cross-Site Scripting in Count per Day WordPress Plugin (CSRF against Admin)

  Installs: 90k+ | Yorick Koster | OVE-20160724-0024 | Status: fixed

• Stored Cross-Site Scripting vulnerability in Count per Day WordPress Plugin (Pre auth)

  Installs: 90k+ | Julien Rentrop | OVE-20160717-0001 | Status: fixed

• Cross-Site Scripting in FormBuilder WordPress Plugin

  Installs: 10k+ | Peter Ganzevles | OVE-20160722-0007 | Status: fixed

• Cross-Site Scripting in WordPress Landing Pages Plugin (CSRF against Admin)

  Installs: 20k+ | Blangus | OVE-20160721-0001 | Status: fixed

• Cross-Site Scripting in Activity Log WordPress Plugin (CSRF against Admin)

  Installs: 30k+ | Yorick Koster | OVE-20160724-0022 | Status: fixed

• Cross-Site Scripting vulnerability in search function Activity Log WordPress Plugin (CSRF against Admin)

  Installs: 30k+ | Edwin Molenaar | OVE-20160718-0002 | Status: fixed

• Cross-Site Scripting in Uji Countdown WordPress Plugin (CSRF against Admin)

  Installs: 10k+ | Yorick Koster | OVE-20160724-0029 | Status: fixed

• Cross-Site Scripting in WangGuard WordPress Plugin (CSRF against Admin)

  Installs: 20k+ | Yorick Koster | OVE-20160724-0030 | Status: fixed

• Cross-Site Request Forgery in ALO EasyMail Newsletter WordPress Plugin

  Installs: 10k+ | Yorick Koster | OVE-20160724-0021 | Status: fixed

• Stored Cross-Site Scripting vulnerability in WP Live Chat Support WordPress Plugin (Pre-auth)

  Installs: 20k+ | Dennis Kerdijk & Erwin Kievith | OVE-20160724-0010 | Status: fixed

• Cross-Site Scripting in Contact Bank WordPress Plugin (CSRF against Admin)

  Installs: 30k+ | Yorick Koster | OVE-20160724-0023 | Status: fixed

• SQL injection vulnerability in Booking Calendar WordPress Plugin (As Editor)

  Installs: 30k+ | Edwin Molenaar | OVE-20160714-0002 | Status: fixed

• Cross-Site Scripting vulnerability in Booking Calendar WordPress Plugin (CSRF against Admin)

  Installs: 30k+ | Edwin Molenaar | OVE-20160714-0003 | Status: fixed

• Multiple vulnerabilities in All In One WP Security & Firewall plugin login CAPTCHA (Pre-auth)

  Installs: 400k+ | Sipke Mellema | OVE-20160719-0001 | Status: fixed (2/4)

• Insert PHP WordPress Plugin allows authenticated user to execute arbitrary PHP (Contributor+)

  Installs: 100k+ | Marcel Vermeulen & Ed van der Vlies | OVE-20160712-0001 | Status: won't fix

• Stored Cross-Site Scripting vulnerability in Easy Testimonials WordPress Plugin (Contributor+)

  Installs: 30K+ | Bente Schopman | OVE-20160712-0010 | Status: fixed

• Cross-Site Scripting vulnerability in ColorWay WordPress Theme (Pre-auth)

  Installs: 10K+ | Yorick Koster | OVE-20160712-0024 | Status: fixed

• Cross-Site Scripting in Code Snippets WordPress Plugin

  Installs: 20k+ | Blangus | OVE-20160722-0006 | Status: fixed

• Cross-Site Scripting in Contact Form to Email WordPress Plugin (CSRF against Admin)

  Installs: 40k+ | Blangus | OVE-20160721-0003 | Status: fixed

• Persistent Cross-Site Scripting in WooCommerce via image metadata (Trick Admin)

  Installs: 1+ million | Han Sahin | OVE-20160720-0006 | Status: fixed

• Cross-Site Scripting vulnerability in Paid Memberships Pro WordPress Plugin. CSRF against Admin.

  Installs: 50k+ | Blangus | OVE-20160714-0015 | Status: fixed

• Multiple SQL injection vulnerabilities in WordPress Video Player (Exploitable by >= Contributor)

  Installs: 10K+ | Yorick Koster / David Vaartjes | OVE-20160712-0004 | Status: fixed

• Cross-Site Request Forgery in Icegram WordPress Plugin (CSRF against admin)

  Installs: 10K+ | Yorick Koster | OVE-20160712-0032 | Status: fixed

• Multiple Cross-Site Scripting vulnerabilities in Ninja Forms WordPress Plugin

  Installs: 600k+ | Han Sahin | OVE-20160714-0018 | Status: fixed

• Cross-Site Scripting vulnerability in Google Forms WordPress Plugin (CSRF against admin)

  Installs: 20K+ | Yorick Koster | OVE-20160712-0021 | Status: fixed

• Cross-Site Scripting vulnerability in WP No External Links WordPress Plugin (CSRF against admin)

  Installs: 20K+ | Yorick Koster | OVE-20160712-0020 | Status: fixed

• Cross-Site Scripting vulnerability in Top 10 - Popular posts plugin for WordPress (CSRF against admin)

  Installs: 30K+ | Yorick Koster | OVE-20160712-0017 | Status: fixed

• Cross-Site Scripting vulnerability in Simple Membership WordPress Plugin (CSRF against admin)

  Installs: 10K+ | Yorick Koster | OVE-20160712-0016 | Status: fixed

• Easy Forms for MailChimp Local File Inclusion vulnerability (CSRF against admin)

  Installs: 40K+ | Yorick Koster | OVE-20160712-0023 | Status: fixed

• WP Fastest Cache Member Local File Inclusion vulnerability (CSRF against admin)

  Installs: 100K+ | Yorick Koster | OVE-20160712-0022 | Status: fixed

• Cross-Site Scripting vulnerability in Email Users WordPress Plugin (CSRF against admin)

  Installs: 10K+ | Yorick Koster | OVE-20160712-0012 | Status: fixed

• Cross-Site Scripting vulnerability in Master Slider WordPress Plugin (CSRF against admin)

  Installs: 80K+ | Yorick Koster | OVE-20160712-0013 | Status: fixed

• Cross-Site Scripting vulnerability in Profile Builder WordPress Plugin (CSRF against admin)

  Installs: 40K+ | Yorick Koster | OVE-20160712-0014 | Status: fixed

• Persistent Cross-Site Scripting in WordPress Activity Log plugin (Pre-auth)

  Installs: 30K+ | Han Sahin | OVE-20160712-0037 | Status: fixed

• Persistent Cross-Site Scripting in WP Live Chat Support plugin (Pre-auth)

  Installs: 20K+ | Han Sahin | OVE-20160712-0008 | Status: fixed

• Hijack WP-dashboard via persistent XSS in SEO plugin (anonymous/ payload delivery)

  Installs: 1M+ | David Vaartjes | OVE-20160712-0027 | Status: fixed

• Ultimate Member Local File Inclusion vulnerability (CSRF against admin)

  Installs: 30K+ | Burak Kelebek | OVE-20160712-0011 | Status: fixed