CVE-2019-15829

The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS...

PT-2019-14418

Name of the Vulnerable Software and Affected Versions photoblocks-grid-gallery plugin versions prior to 1.1.33 Description The issue concerns a Cross-Site Scripting XSS flaw. The "wp-admin/admin.php?page=photoblocks-edit&id=" endpoint is vulnerable to XSS attacks. The id parameter is implicated i...

CVE-2019-15829: Improper Neutralization of Input During Web Page Generation

The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS...

CVE-2019-14789

The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter...

CVE-2019-14789: Improper Neutralization of Input During Web Page Generation

The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter...

PT-2019-4687

Name of the Vulnerable Software and Affected Versions svg-vector-icon-plugin aka WP SVG Icons versions through 3.2.1 Description The issue concerns the mishandling of Custom Icon uploads in the svg-vector-icon-plugin, allowing for the upload of a ZIP archive containing a .php file due to...

CVE-2019-14216: Cross-Site Request Forgery (CSRF)

An issue was discovered in the svg-vector-icon-plugin aka WP SVG Icons plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mishandles Custom Icon uploads. CSRF leads to upload of a ZIP archive containing a .php file...

PT-2019-7661

Name of the Vulnerable Software and Affected Versions Lightbox Plus Colorbox plugin versions prior to 2.8 Description The issue concerns cross-site request forgery CSRF that can lead to resultant width XSS. This occurs via the "wp-admin/admin.php?page=lightboxplus" API endpoint. Recommendations F...

PT-2019-13830

Name of the Vulnerable Software and Affected Versions CP Contact Form with PayPal plugin versions prior to 1.2.99 Description The issue concerns a Cross-Site Scripting XSS flaw in the publishing wizard of the plugin. This is accessible via the "wp-admin/admin.php?page=cp contact form...

CVE-2016-10865: Cross-Site Request Forgery (CSRF)

The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery CSRF via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS...

PT-2019-5819

Name of the Vulnerable Software and Affected Versions ARPrice Lite plugin version 2.2 for WordPress Description The issue is related to insufficient protection against CSRF requests in the ARPrice Lite plugin for WordPress. This can allow a remote attacker to perform a CSRF attack. The specific...

CVE-2019-14679: Cross-Site Request Forgery (CSRF)

core/views/arpriceimportexport.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arpliteimportexport CSRF...

CVE-2019-14774: Improper Neutralization of Input During Web Page Generation

The woo-variation-swatches aka Variation Swatches for WooCommerce plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter...

PT-2019-13279

Name of the Vulnerable Software and Affected Versions CRUDLab WP Like Button plugin versions prior to 1.6.1 Description The issue allows unauthenticated attackers to change settings due to an authentication bypass. The contains function in wp like button.php did not check if the current request i...

PT-2019-9823

Name of the Vulnerable Software and Affected Versions EmpireCMS versions through 7.5 Description The issue allows for XSS via crafted SQL syntax to the admin/admin.php endpoint. This is achieved by exploiting the admindbDoSql.php file in EmpireCMS. Recommendations For EmpireCMS versions through...

PT-2019-9824

Name of the Vulnerable Software and Affected Versions EmpireCMS versions through 7.5 Description The issue allows remote attackers to execute arbitrary PHP code via SQL injection. This is achieved by using a .php filename in a SELECT INTO OUTFILE statement to admin/admin.php. Recommendations For...

CVE-2018-19461: Improper Neutralization of Input During Web Page Generation

admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php...

CVE-2018-18872: Improper Neutralization of Input During Web Page Generation

The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the eventtitle parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI...

PT-2019-9546

Name of the Vulnerable Software and Affected Versions Tribulant Slideshow Gallery plugin version 1.6.8 Description The issue exists due to SQL Injection in the Tribulant Slideshow Gallery plugin for WordPress. This can be exploited via the "wp-admin/admin.php?page=slideshow-galleries&method=save"...

PT-2019-9547

Name of the Vulnerable Software and Affected Versions Tribulant Slideshow Gallery plugin version 1.6.8 Description A security issue exists in the Tribulant Slideshow Gallery plugin for WordPress, allowing for XSS attacks. This is possible through the...