CVE-2011-4955

Multiple cross-site scripting (XSS) vulnerabilities in ui_stats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) s or (2) p parameters to index.php.

• CWE-79

• http://plugins.trac.wordpress.org/changeset?old_path=%2Fbsuite&old=520611&new_path=%2Fbsuite&new=520611Broken Link
• http://secunia.com/advisories/45234Permissions Required
• http://wordpress.org/support/topic/plugin-bsuite-xss-security-vulnerability-in-407Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/04/16/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/04/16/8Mailing List, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68602Third Party Advisory, VDB Entry
• http://plugins.trac.wordpress.org/changeset?old_path=%2Fbsuite&old=520611&new_path=%2Fbsuite&new=520611Broken Link
• http://secunia.com/advisories/45234Permissions Required
• http://wordpress.org/support/topic/plugin-bsuite-xss-security-vulnerability-in-407Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/04/16/3Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/04/16/8Mailing List, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68602Third Party Advisory, VDB Entry

Published

Dec 20, 2017

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-4949SQL injection vulnerability in phpgwapi/js/dhtmlxtree/sample…
• CVE-2011-4950Cross-site scripting (XSS) vulnerability in phpgwapi/js/jsca…
• CVE-2011-4951Open redirect vulnerability in phpgwapi/ntlm/index.php in EG…
• CVE-2011-4952cobbler: Web interface lacks CSRF protection when using Djan…8.8
• CVE-2011-4953The set_mgmt_parameters function in item.py in cobbler befor…
• CVE-2011-4954cobbler has local privilege escalation via the use of insecu…7.8
• CVE-2011-4956Cross-site scripting (XSS) vulnerability in WordPress before…
• CVE-2011-4957The make_clickable function in wp-includes/formatting.php in…
• CVE-2011-4958Cross-site scripting (XSS) vulnerability in the process func…
• CVE-2011-4959SQL injection vulnerability in the addslashes method in Silv…
• CVE-2011-4960SQL injection vulnerability in the Folder::findOrMake method…
• CVE-2011-4961SilverStripe 2.3.x before 2.3.12 and 2.4.x before 2.4.6 allo…