CVE-2015-2220: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the ninjaformsfield1 parameter in a ninjaformsajaxsubmit action to wp-admin/admin-ajax.php or 2 remote administrators to injec...

Sql injection

SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the catid parameter in a spiderbigcalendarmonth action to wp-admin/admin-ajax.php...

PT-2015-5657

Name of the Vulnerable Software and Affected Versions Spider Event Calendar version 1.4.9 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the cat id parameter in a spiderbigcalendar month action to the...

CVE-2015-2199: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow 1 remote authenticated users to execute arbitrary SQL commands via the itemid parameter in a wonderpluginaudiosaveitem action to wp-admin/admin-ajax.php or remote administrators to execut...

CVE-2015-2196: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the catid parameter in a spiderbigcalendarmonth action to wp-admin/admin-ajax.php...

PT-2015-5660

Name of the Vulnerable Software and Affected Versions WonderPlugin Audio Player plugin versions prior to 2.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands via the itemid parameter in a wonderplugin audio save item action to /wp-admin/admin-ajax.php or...

Sql injection

SQL injection vulnerability in the ajaxsurvey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the surveyid parameter in an ajaxsurvey action to wp-admin/admin-ajax.php...

CVE-2015-2090

SQL injection vulnerability in the ajaxsurvey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the surveyid parameter in an ajaxsurvey action to wp-admin/admin-ajax.php...

PT-2015-5597

Name of the Vulnerable Software and Affected Versions WordPress Survey and Poll plugin version 1.1.7 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the survey id parameter in an ajax survey action to the "/wp-admin/admin-ajax.php" A...

CVE-2015-2090: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the ajaxsurvey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the surveyid parameter in an ajaxsurvey action to wp-admin/admin-ajax.php...

Sql injection

SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery contus-video-gallery plugin before 2.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the vid parameter in a rss action to wp-admin/admin-ajax.php...

CVE-2015-2065

SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery contus-video-gallery plugin before 2.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the vid parameter in a rss action to wp-admin/admin-ajax.php...

CVE-2015-2065: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery contus-video-gallery plugin before 2.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the vid parameter in a rss action to wp-admin/admin-ajax.php...

Quasar Theme Rock Form Builder plugin - Privilege Escalation

The Rock Form Builder plugin 1.0 is used within the Quasar WooCommerce theme 1.9.1. Authenticated users can modify WordPress settings which can lead to full site compromise. It's unclear which exact version of the rock-form-builder fixed the issue, but it was something in between 1.0 and 2.5, so...

WonderPlugin Audio Player 2.0 Blind SQL Injection and XSS Vulnerabilities

Exploit for php platform in category web applications Exploit Title: WonderPlugin Audio Player 2.0 Blind SQL Injection and XSS Date: 20-01-2015 Software Link: http://www.wonderplugin.com/wordpress-audio-player/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website:...

WordPress Plugin Webdorado Spider Event Calendar 1.4.9 - SQL Injection

. Exploit Title: WordPress: Webdorado Spider Event Calendar = 1.4.9 SQL Injection Date: 2015-02-12 Exploit Author: Mateusz Lach Vendor Homepage: https://www.facebook.com/WebDorado or http://www.webdorado.com Software Link: https://downloads.wordpress.org/plugin/spider-event-calendar.1.4.9.zip...

PT-2015-5578

Name of the Vulnerable Software and Affected Versions Apptha WordPress Video Gallery contus-video-gallery plugin versions prior to 2.8 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the vid parameter in a 'rss' action to the...

CVE-2015-1582

Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...

CVE-2015-1579

A directory traversal vulnerability exists in the Elegant Themes Divi theme for WordPress. The flaw stems from a failure to adequately filter the img parameter within the revslider_show_image action in the wp-admin/admin-ajax.php script. A remote attacker can use .. (dot dot) sequences to read ar...