PT-2015-5262

Name of the Vulnerable Software and Affected Versions Photo Gallery plugin versions prior to 1.2.11 for WordPress Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the asc or desc parameter in a create gallery request in the "galleries...

CVE-2015-1204

Cross-site scripting XSS vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fsresource parameter in the wp-slim-view-2 page to wp-admin/admin.php...

PT-2015-5162

Name of the Vulnerable Software and Affected Versions WP Slimstat plugin versions prior to 3.9.2 Description A cross-site scripting XSS issue exists in the Save Filters functionality of the WP Slimstat plugin. This allows remote attackers to inject arbitrary web script or HTML via the fsresource...

CVE-2015-1204: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fsresource parameter in the wp-slim-view-2 page to wp-admin/admin.php...

PT-2015-3981

Name of the Vulnerable Software and Affected Versions WordPress Pods plugin versions prior to 2.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods page to "wp-admin/admin.php"...

PT-2015-3982

Name of the Vulnerable Software and Affected Versions Pods plugin versions prior to 2.5 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including conducting cross-site scripting XSS attacks, deleting pods, resetting...

CVE-2014-7957: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 conduct cross-site scripting XSS attacks via the toggled parameter in a toggle action in the pods-componen...

CVE-2014-7956: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods page to wp-admin/admin.php...

CVE-2014-10017: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 changeSort or 2 switch parameter in the uscesitemedit page to wp-admin/admin.php...

PT-2015-3712

Name of the Vulnerable Software and Affected Versions GD Star Rating plugin version 19.22 Description The issue allows remote attackers to hijack the authentication of administrators for requests, potentially leading to SQL injection attacks via the s parameter in the "gd-star-rating-stats" page ...

PT-2015-3713

Name of the Vulnerable Software and Affected Versions GD Star Rating plugin version 19.22 Description The issue allows remote administrators to execute arbitrary SQL commands. This is achieved by exploiting the s parameter in the "gd-star-rating-stats" page to "wp-admin/admin.php". Recommendation...

CVE-2014-9524: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Facebook Like Box cardoza-facebook-like-box plugin before 2.8.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct...

PT-2015-3710

Name of the Vulnerable Software and Affected Versions Quick Page/Post Redirect plugin versions prior to 5.0.5 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This...

CVE-2014-9437

Multiple cross-site request forgery CSRF vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site scripting XSS attacks via...

Sql injection

Multiple SQL injection vulnerabilities in Absolut Engine 1.73 allow remote authenticated users to execute arbitrary SQL commands via the 1 sectionID parameter to admin/managersection.php, 2 userID parameter to admin/edituser.php, 3 username parameter to admin/admin.php, or 4 title parameter to...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site scripting XSS attacks via...

CVE-2014-9414

The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgery CSRF attacks and hijack the authentication of administrators for requests that change the mobile site redirect URI via the...

CVE-2014-9097: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery contus-video-gallery plugin 2.5, possibly as distributed before 2014-07-23, for WordPress allow 1 remote attackers to execute arbitrary SQL commands via the vid parameter in a myextract action to wp-admin/admin-ajax.php ...

PT-2014-6049

Name of the Vulnerable Software and Affected Versions Wordfence Security plugin versions prior to 5.1.4 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to inject arbitrary web script or HTML via the polyid parameter in an 1 editpoly, 2 editpolyline, or 3 editmarker action in the wp-google-maps-menu page to...