CVE-2020-8658: Cross-Site Request Forgery (CSRF)

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

PT-2020-19263

Name of the Vulnerable Software and Affected Versions marketo-forms-and-tracking plugin versions prior to 1.0.3 Description The issue allows for Cross-Site Request Forgery CSRF with resultant Cross-Site Scripting XSS in the "wp-admin/admin.php?page=marketo fat" API endpoint. Recommendations For...

CVE-2020-6849: Cross-Site Request Forgery (CSRF)

The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketofat CSRF with resultant XSS...

PT-2020-19355

Name of the Vulnerable Software and Affected Versions WP Database Reset versions 3.1 and earlier Description The issue allows any authenticated user with minimal permissions to escalate their privileges to administrator by sending a request to the "wp-admin/admin.php?db-reset-tables=users" API...

CVE-2020-7047: Improper Privilege Management

The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability with a simple wp-admin/admin.php?db-reset-tables=users request to escalate their privileges to administrator while dropping all other users from the table...

CVE-2013-5978

Multiple cross-site scripting XSS vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 Product name or 2 Price description fields via a request to wp-admin/admin.php. NOTE: This issue may on...

PT-2019-6990

Name of the Vulnerable Software and Affected Versions Cart66 Lite plugin versions prior to 1.5.1.15 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific fields, including...

CVE-2015-9454

The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin currentsliderid parameter...

CVE-2015-9452

The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nexformsId parameter...

CVE-2015-9454: Improper Neutralization of Special Elements used in an SQL Command

The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin currentsliderid parameter...

PT-2019-7413

Name of the Vulnerable Software and Affected Versions smooth-slider plugin versions prior to 2.7 Description The issue concerns SQL Injection via the current slider id parameter in the /wp-admin/admin.php?page=smooth-slider-admin API endpoint. This allows for potential exploitation. No informatio...

CVE-2015-9452: Improper Neutralization of Special Elements used in an SQL Command

The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nexformsId parameter...

PT-2019-7387

Name of the Vulnerable Software and Affected Versions wplegalpages plugin versions prior to 1.1 Description The issue concerns a CSRF with resultant XSS. It is exploitable via the wp-admin/admin.php?page=legal-pages endpoint with parameters such as lp-domain-name, lp-business-name, lp-phone,...

PT-2019-7399

Name of the Vulnerable Software and Affected Versions monetize plugin versions through 1.03 Description The issue concerns a CSRF vulnerability that leads to XSS. It can be exploited via the "wp-admin/admin.php?page=monetize-zones-new" endpoint. Recommendations For monetize plugin versions throug...

PT-2019-7406

Name of the Vulnerable Software and Affected Versions unite-gallery-lite plugin versions prior to 1.5 Description The issue concerns CSRF and SQL injection flaws. Specifically, the galleryid or id parameters in wp-admin/admin.php are vulnerable. Recommendations For unite-gallery-lite plugin...

PT-2019-7407

Name of the Vulnerable Software and Affected Versions sendpress plugin versions prior to 1.2 Description The issue allows for SQL Injection via the "listid" parameter in the wp-admin/admin.php?page=sp-queue endpoint. Recommendations For versions prior to 1.2, update to version 1.2 or later to...

PT-2019-7401

Name of the Vulnerable Software and Affected Versions avenirsoft-directdownload plugin version 1.0 Description The issue concerns a CSRF vulnerability that leads to XSS. It is exploitable via the "wp-admin/admin.php?page=avenir plugin" endpoint. Recommendations For avenirsoft-directdownload plugi...

CVE-2015-9447: Cross-Site Request Forgery (CSRF)

The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters...

CVE-2015-9442: Cross-Site Request Forgery (CSRF)

The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenirplugin...

CVE-2015-9428: Cross-Site Request Forgery (CSRF)

The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters...