Description
WordPress Plugin Sniplets is prone to multiple input validation vulnerabilities because the application fails to sanitize user-supplied input. These issues include multiple cross-site scripting vulnerabilities, a remote file include vulnerability, and a remote command execution vulnerability. A successful exploit may allow an attacker to compromise the application, steal cookie-based authentication credentials, and execute arbitrary code and commands within the context of the webserver process. WordPress Plugin Sniplets version 1.2.2 is vulnerable; other versions may also be affected.
Remediation
Update to plugin version 1.2.3 or latest
References
http://www.exploit-db.com/exploits/5194/
http://www.securityfocus.com/bid/27985/exploit
http://www.securityfocus.com/archive/1/488734
http://packetstormsecurity.com/files/view/64011/wordpresssniplet-rfixssexec.txt
Related Vulnerabilities
WordPress Plugin Timetable and Event Schedule by MotoPress Cross-Site Request Forgery (2.4.1)
WordPress Plugin iThemes Security (formerly Better WP Security) SQL Injection (7.0.2)
WordPress Plugin Facebook Button by BestWebSoft Cross-Site Scripting (2.53)
WordPress Plugin SP Project & Document Manager Arbitrary File Upload (4.22)
WordPress Plugin Easy Pixels eCommerce extension Unspecified Vulnerability (1.4)