403 matches found
CVE-2016-10736: Improper Neutralization of Input During Web Page Generation
The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpspmessageclass parameter...
PT-2019-7535
Name of the Vulnerable Software and Affected Versions Social Pug - Easy Social Share Buttons plugin versions prior to 1.2.6 Description The issue allows for XSS via the dpsp message class parameter in the "wp-admin/admin.php?page=dpsp-toolkit" API endpoint. Recommendations For Social Pug - Easy...
Design/Logic Flaw
XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page request...
CVE-2018-18069: Improper Neutralization of Input During Web Page Generation
processforms in the WPML aka sitepress-multilingual-cms plugin through 3.6.3 for WordPress has XSS via any localefilename parameter such as localefilenameen in an authenticated theme-localization.php request to wp-admin/admin.php...
CVE-2018-17140: Improper Neutralization of Input During Web Page Generation
The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a qlinsert action to wp-admin/admin.php...
PT-2018-13920
Name of the Vulnerable Software and Affected Versions Quizlord plugin versions prior to 2.1 Description The issue allows for Stored XSS attacks through the title parameter in a ql insert action to "wp-admin/admin.php". Recommendations For Quizlord plugin versions prior to 2.1, update to version 2...
CVE-2018-15877: Improper Neutralization of Special Elements used in an OS Command
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainviewactivitymonitor&tab=activitytools request...
CVE-2018-10234: Improper Neutralization of Input During Web Page Generation
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=umoptions§ion=account page...
PT-2018-9774
Name of the Vulnerable Software and Affected Versions: User Profile & Membership plugin versions prior to 2.0.11 Description: An issue exists in the User Profile & Membership plugin for WordPress, where authenticated cross-site scripting is possible. This is due to a vulnerability in the Account...
PT-2018-9796
Name of the Vulnerable Software and Affected Versions: BEESCMS version 4.0 Description: The issue allows for the addition of an administrator account without proper validation, potentially leading to unauthorized access. This is achieved through the "admin/admin admin.php?nav=list admin user&admi...
PT-2018-4193
Name of the Vulnerable Software and Affected Versions Subscribe To Comments Reloaded plugin versions prior to 140219 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attack...
CVE-2018-5687
NewsBee (CMS) vulnerability CVE-2018-5687: a stored/reflected XSS is possible via the Company Name field in Settings (admin/admin.php). The description across sources consistently states an XSS vulnerability in NewsBee’s Settings interface. Root cause: improper sanitization/escaping of input in t...
CVE-2018-5687: Improper Neutralization of Input During Web Page Generation
NewsBee allows XSS via the Company Name field in the Settings under admin/admin.php...
PT-2018-17084
Name of the Vulnerable Software and Affected Versions: NewsBee affected versions not specified Description: The issue allows for XSS via the Company Name field in the Settings under the admin/admin.php endpoint. Recommendations: At the moment, there is no information about a newer version that...
PT-2018-17056
Name of the Vulnerable Software and Affected Versions responsive-coming-soon-page plugin version 1.1.18 Description A security issue was found in the responsive-coming-soon-page plugin for WordPress. This issue allows for cross-site scripting XSS attacks through the counter title icon parameter i...
CVE-2018-5658
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. CSRF exists via wp-admin/admin.php...
CVE-2018-5665
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logoheight parameter...
CVE-2018-5660
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soonsubtitle parameter...