PT-2017-13674

Name of the Vulnerable Software and Affected Versions event-espresso-free plugin version 3.1.37.12.L Description A SQL Injection issue exists in the event-espresso-free plugin for WordPress. The issue is related to the recurrence id parameter in the /includes/event-management/index.php file, whic...

PT-2017-13268

Name of the Vulnerable Software and Affected Versions Responsive Image Gallery plugin versions prior to 1.2.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the id parameter in an add edit theme task in the "wpdevart gallery themes"...

CVE-2017-14125: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "id" parameter in an addedittheme task in the wpdevartgallerythemes page to wp-admin/admin.php...

PT-2017-7402

Name of the Vulnerable Software and Affected Versions Role Scoper plugin for WordPress versions prior to 1.3.67 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the object name parameter in a "rs-object role edit" page to...

CVE-2015-8353: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the objectname parameter in a rs-objectroleedit page to wp-admin/admin.php...

PT-2017-12791

Name of the Vulnerable Software and Affected Versions PressForward plugin versions 4.3.0 and earlier Description The issue concerns a problem with the PATH INFO to wp-admin/admin.php, related to PHP SELF, allowing for XSS in the CoreAdminPFTemplater.php file. Recommendations For PressForward plug...

CVE-2017-12948: Improper Neutralization of Input During Web Page Generation

Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATHINFO to wp-admin/admin.php, related to PHPSELF...

PT-2017-12789

Name of the Vulnerable Software and Affected Versions Easy Modal plugin versions prior to 2.1.0 Description The issue concerns SQL injection in the delete action of the Easy Modal plugin, specifically affecting the id, ids, or modal parameter to wp-admin/admin.php. This can be exploited by...

PT-2017-12790

Name of the Vulnerable Software and Affected Versions Easy Modal plugin versions prior to 2.1.0 Description The issue concerns SQL injection in the Easy Modal plugin for WordPress. It affects the untrash action and involves the id, ids, or modal parameter to "wp-admin/admin.php". This exploit is...

PT-2017-12333

Name of the Vulnerable Software and Affected Versions Event List plugin version 0.7.9 Description The issue concerns a problem with the slug array parameter in the wp-admin/admin.php endpoint, specifically in the el admin categories delete bulk action, allowing for XSS. Recommendations For Event...

CVE-2017-12068: Improper Neutralization of Input During Web Page Generation

The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an eladmincategories deletebulk action...

PT-2017-18914

Name of the Vulnerable Software and Affected Versions Event List plugin version 0.7.8 Description The issue allows an authenticated user to execute arbitrary SQL commands. This is achieved via the id parameter to the "wp-admin/admin.php" endpoint. Recommendations For Event List plugin version...

CVE-2017-9429: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php...

CVE-2017-9418: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php...

PT-2017-18907

Name of the Vulnerable Software and Affected Versions WP-Testimonials plugin version 3.4.1 Description The issue allows an authenticated user to execute arbitrary SQL commands. This is achieved via the testid parameter to the "wp-admin/admin.php" endpoint. Recommendations For WP-Testimonials plug...

PT-2015-7576

Name of the Vulnerable Software and Affected Versions Pie Register plugin versions prior to 2.0.19 Description The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved via the select invitaion code bulk option or invi del id parameter in the...

PT-2015-7129

Name of the Vulnerable Software and Affected Versions Google Analyticator plugin versions prior to 6.4.9.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via vulnerable parameters in the google-analyticator page to wp-admin/admin.php. The vulnerable parameter...

PT-2015-7425

Name of the Vulnerable Software and Affected Versions Contact Form Generator plugin versions 2.0.1 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including creating, updating, or deleting fields, forms, or templates, ...

CVE-2015-6965: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 create a field, 2 update a field, 3 delete a field, 4 create a form, 5 update a...

PT-2015-6403

Name of the Vulnerable Software and Affected Versions NewStatPress plugin versions prior to 0.9.9 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by exploiting the where1 parameter in the nsp search page to wp-admin/admin.php...