CVE-2018-6357: Improper Neutralization of Input During Web Page Generation

The acxasmwsaveordercallback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant socialwidgeticonarrayorder XSS...

PT-2018-17500

Name of the Vulnerable Software and Affected Versions acurax-social-media-widget plugin versions prior to 3.2.6 Description The issue concerns a CSRF vulnerability via the recordsArray parameter to the "/wp-admin/admin-ajax.php" API endpoint, potentially leading to social widget icon array order...

CVE-2017-18032

The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdmgeneratepassword action to wp-admin/admin-ajax.php...

PT-2018-6624

Name of the Vulnerable Software and Affected Versions: WordPress download-manager plugin versions prior to 2.9.52 Description: The issue concerns a security problem where an attacker can exploit the id parameter in a wpdm generate password action to wp-admin/admin-ajax.php API endpoint, leading t...

CVE-2017-18032: Improper Neutralization of Input During Web Page Generation

The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdmgeneratepassword action to wp-admin/admin-ajax.php...

Design/Logic Flaw

An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php weblizarpffreesettingssaveget-users parameter...

Cross site request forgery (csrf)

An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php...

Design/Logic Flaw

An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php security parameter...

Design/Logic Flaw

An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php PFFREEAccessToken parameter...

CVE-2018-5653

An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php weblizarpffreesettingssaveget-users parameter...

CVE-2018-5654

An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php PFFREEAccessToken parameter...

CVE-2018-5653

An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php weblizarpffreesettingssaveget-users parameter...

CVE-2018-5653

An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php weblizarpffreesettingssaveget-users parameter...

CVE-2018-5656

An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php...

PT-2018-17054

Name of the Vulnerable Software and Affected Versions weblizar-pinterest-feeds plugin version 1.1.1 Description A security issue was found in the plugin, where a cross-site scripting XSS attack is possible. This occurs through the "security" parameter in the "/wp-admin/admin-ajax.php" API endpoin...

PT-2018-17055

Name of the Vulnerable Software and Affected Versions weblizar-pinterest-feeds plugin version 1.1.1 Description A security issue was found in the weblizar-pinterest-feeds plugin for WordPress, where a CSRF vulnerability exists. This can be exploited via the "wp-admin/admin-ajax.php" API endpoint...

CVE-2018-5653

The CVE-2018-5653 entry refers to a vulnerability in the WordPress plugin weblizar-pinterest-feeds version 1.1.1. The issue is an XSS vulnerability exploitable via the wp-admin/admin-ajax.php parameter weblizar_pffree_settings_save_get-users. Several connected sources (CNVD-2018-01274 and WPVulnD...

CVE-2018-5654

An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php PFFREEAccessToken parameter...

CVE-2018-5655

An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php security parameter...

CVE-2018-5654: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php PFFREEAccessToken parameter...