PT-2015-6403

Name of the Vulnerable Software and Affected Versions NewStatPress plugin versions prior to 0.9.9 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by exploiting the where1 parameter in the nsp search page to wp-admin/admin.php...

PT-2015-6388

Name of the Vulnerable Software and Affected Versions FeedWordPress plugin versions prior to 2015.0514 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the link ids parameter in an Update action in the "syndication.php" page to...

WordPress LeagueManager Plugin <= 3.7 - Cross Site Scripting

This plugin is prone to a wp-admin/admin.php multiple parameter cross site scripting vulnerability. Solution Update the plugin...

CVE-2015-3986: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attack...

CVE-2015-3300: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the 1 billingfirstname, 2 billinglastname, 3...

CVE-2015-2755

Multiple cross-site request forgery CSRF vulnerabilities in the AB Google Map Travel AB-MAP plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 lat Latitude, 2 long Longitude, 3...

CVE-2015-2755: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the AB Google Map Travel AB-MAP plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 lat Latitude, 2 long Longitude, 3...

PT-2015-5698

Name of the Vulnerable Software and Affected Versions WordPress SEO by Yoast plugin versions 1.5.7 and earlier, 1.6.x before 1.6.4, 1.7.x before 1.7.4 Description The issue allows remote authenticated users to execute arbitrary SQL commands via the order by or order parameter in the "wpseo...

PT-2015-5480

Name of the Vulnerable Software and Affected Versions Contact Form DB plugin versions prior to 2.8.32 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the...

CVE-2015-1874: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Contact Form DB aka CFDB and contact-form-7-to-database-extension plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the...

CVE-2015-2199: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow 1 remote authenticated users to execute arbitrary SQL commands via the itemid parameter in a wonderpluginaudiosaveitem action to wp-admin/admin-ajax.php or remote administrators to execut...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the imagefile parameter in an edit action in the...

CVE-2015-2084

Cross-site request forgery CSRF vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the imagefile parameter in an edit action in the...

CVE-2015-2084: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the imagefile parameter in an edit action in the...

PT-2015-5592

Name of the Vulnerable Software and Affected Versions Easy Social Icons plugin versions prior to 1.2.3 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is...

PT-2015-5561

Name of the Vulnerable Software and Affected Versions Contact Form DB plugin version 2.8.26 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the submit time parameter in the "CF7DBPluginSubmissions" page to "wp-admin/admin.php"...

PT-2015-5287

Name of the Vulnerable Software and Affected Versions Easing Slider plugin versions prior to 2.2.0.7 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML. The attack vector involves the edit...

CVE-2015-1436: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the 1 easingslidermanagecustomizations or 2 easingslidereditsliders page to wp-admin/admin.php...

CVE-2015-1582: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...

CVE-2015-1385

Cross-site scripting XSS vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmincategoryfeeds.php page to...