This host is installed with WordPress Universal Post Manager Plugin and is prone to multiple cross-site scripting vulnerabilities.

Successful exploitation will allow attackers to execute arbitrary web script or HTML in a user's browser session in the context of an affected site. Impact Level: Application

Upgrade to version 1.1.1 or later, For updates refer to http://wordpress.org/extend/plugins/universal-post-manager

The flaws are due to input validation error in 'num' parameter in '/wp-content/plugins/universal-post-manager/template/email_screen_1.php' and '/wp-content/plugins/universal-post-manager/template/email_screen_2.php' and 'number' parameter in '/wp-content/plugins/universal-post-manager/templ ate/bookmarks_slider_h.php', which is not properly sanitized before being returned to the user.

WordPress Universal Post Manager Plugin Version 1.0.9

• http://packetstormsecurity.org/files/view/100592/
• http://seclists.org/bugtraq/2011/Apr/190
• http://secunia.com/advisories/44247
• http://www.htbridge.ch/advisory/multiple_xss_in_universal_post_manager_wordpress_plugin.html

---

Updated on 2015-03-25