CVE-2014-7152: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the updateoptions action to wp-admin/admin-ajax.php...

CVE-2014-5201: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter in a goviewobject action to wp-admin/admin-ajax.php...

Ajax Pagination 1.1 - wp-admin/admin-ajax.php loop Parameter Local File Inclusion

Plugin is still affected and has been closed...

CVE-2014-4725

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

PT-2014-6077

Name of the Vulnerable Software and Affected Versions MailPoet Newsletters wysija-newsletters plugin versions prior to 2.6.7 Description The issue allows remote attackers to bypass authentication and execute arbitrary PHP code. This is achieved by uploading a crafted theme using the...

CVE-2014-4725: Improper Authentication

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

PT-2014-5996

Name of the Vulnerable Software and Affected Versions WP Consultant plugin version 1.0 and earlier Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the dialog id parameter in the admin/admin show dialogs.php...

CVE-2014-4163

Multiple cross-site request forgery CSRF vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the 1 buried or 2 featured status of a comment via a request to wp-admin/admin-ajax.php...

PT-2014-5714

Name of the Vulnerable Software and Affected Versions Featured Comments plugin version 1.2.1 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for requests that change the buried or featured status of a comment. This is achieved via a reque...

CVE-2014-4163: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the 1 buried or 2 featured status of a comment via a request to wp-admin/admin-ajax.php...

CVE-2014-3210: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in dopbs-backend-forms.php in the Booking System Booking Calendar plugin before 1.3 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the bookingformid parameter to wp-admin/admin-ajax.php...

PT-2014-2610

Cross-site scripting XSS vulnerability in the Brother MFC-9970CDW printer with firmware G 1.03 and L 1.10 allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter name QUERY STRING to admin/admin main.html, a different vulnerability than CVE-2013-2507 and...

PT-2014-2611

Multiple cross-site scripting XSS vulnerabilities in the Brother MFC-9970CDW printer with firmware L 1.10 allow remote attackers to inject arbitrary web script or HTML via the 1 id or 2 val parameter to admin/admin main.html; 3 id, 4 val, or 5 arbitrary parameter name QUERY STRING to admin/profil...

PT-2014-2380

Name of the Vulnerable Software and Affected Versions ImageCMS versions prior to 4.2 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands via the q parameter to the "admin/admin search/" endpoint. This can be leveraged using CSRF to allow remote...

PT-2014-2476

Name of the Vulnerable Software and Affected Versions CommentLuv plugin versions prior to 2.92.4 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the ajax nonce parameter to the "wp-admin/admin-ajax.php" API endpoint...

CVE-2013-1409: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ajaxnonce parameter to wp-admin/admin-ajax.php...

CVE-2012-6624

Cross-site scripting XSS vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter in a soundcloudisgoldplayerpreview action to wp-admin/admin-ajax.php...

CVE-2012-6624: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter in a soundcloudisgoldplayerpreview action to wp-admin/admin-ajax.php...

CVE-2013-5673

SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the customquery parameter in a testimonialadd action to wp-admin/admin-ajax.php...

PT-2013-5719

Name of the Vulnerable Software and Affected Versions IndiaNIC Testimonial plugin version 2.2 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including adding testimonials, listing templates, and widget templates. It...