PT-2015-6416

Name of the Vulnerable Software and Affected Versions Users Ultra plugin versions prior to 1.5.16 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the data target or data vote parameter in a rating vote wp ajax nopriv rating vote action to...

CVE-2015-4109: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 datatarget or 2 datavote parameter in a ratingvote wpajaxnoprivratingvote action to wp-admin/admin-ajax.php...

PT-2015-6395

Name of the Vulnerable Software and Affected Versions WP Membership plugin version 1.2.3 Description The issue allows remote authenticated users to gain administrator privileges. This can be achieved via an iv membership update user settings action to the "wp-admin/admin-ajax.php" endpoint...

CVE-2015-4038: Undefined Security Weakness

The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an ivmembershipupdateusersettings action to wp-admin/admin-ajax.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a checkstat action to wp-admin/admin-ajax.php...

CVE-2015-4084

Cross-site scripting XSS vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a checkstat action to wp-admin/admin-ajax.php...

PT-2015-6412

Name of the Vulnerable Software and Affected Versions Free Counter plugin version 1.1 for WordPress Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the value parameter in a check stat action to "wp-admin/admin-ajax.php" API endpoint...

CVE-2015-4084: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a checkstat action to wp-admin/admin-ajax.php...

Wordpress Theme Nevada Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Theme Nevada Arbitrary File Download Vulnerability Date: 01/05/2015 Exploit Author: X-Line Vendor Homepage: http://themeforest.unitedthemes.com/wpversions/nevada/ Contact : http://www.root-me.org/X-Line-24646 Tested on...

WordPress Rockhoist Ratings Plugin <= 1.2.2 - SQL Injection

This plugin is prone to an SQL injection vulnerability in wp-admin/admin-ajax.php postID parameter. Solution Update the plugin...

WordPress Better WP Security Plugin <= 3.6.3 - Stored XSS

This plugin is prone to /wp-admin/admin-ajax.php license parameter stored XSS weakness. Solution Upgrade the plugin...

CVE-2014-9311

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

Cross site scripting

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

CVE-2014-9311

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

CVE-2014-9311

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

PT-2015-4182

Name of the Vulnerable Software and Affected Versions Shareaholic plugin versions prior to 7.6.1.0 for WordPress Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter i...

WordPress Plugin Video Gallery 2.8 - SQL Injection

WordPress Plugin Video Gallery 2.8 - SQL Injection Exploit Title : Wordpress Video Gallery 2.8 SQL Injection Vulnerabilitiey Exploit Author : Claudio Viviani Vendor Homepage : http://www.apptha.com/category/extension/Wordpress/Video-Gallery Software Link :...

CVE-2014-9311: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

PT-2015-5672

Name of the Vulnerable Software and Affected Versions Ninja Forms plugin versions prior to 2.8.9 Description The issue allows remote attackers to inject arbitrary web script or HTML, and it also affects remote administrators. This can be achieved through the "ninja forms field 1" parameter in a...

CVE-2015-2218: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the wpajaxsaveitem function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 itemname or 2 itemcustomcss parameter in a...