149 matches found
CVE-2022-4426
The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack...
CVE-2014-5092
Status2k allows Remote Command Execution in admin/options/editpl.php...
CVE-2015-9433
The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc. in wp-admin/options-general.php?page=wp-social-bookmarking-light%2Fmodules%2Fadmin.php...
CVE-2015-9431
The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x jsonconfigfiles or jsoncustomi18nconfig parameter...
CVE-2025-23905
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Johannes van Poelgeest Admin Options Pages admin-options-pages allows Reflected XSS.This issue affects Admin Options Pages: from n/a through = 0.9.7...
CVE-2025-23905 WordPress Admin Options Pages plugin <= 0.9.7 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Johannes van Poelgeest Admin Options Pages admin-options-pages allows Reflected XSS.This issue affects Admin Options Pages: from n/a through = 0.9.7...
CVE-2025-23905
CVE-2025-23905 is a reflected Cross-Site Scripting vulnerability in the WordPress plugin Admin Options Pages (affected: 0.9.7 and earlier). The underlying issue is improper neutralization of input during web page generation. Several connected sources (Red Hat RH:CVE-2025-23905, NVD entry) confirm...
CVE-2025-23905 WordPress Admin Options Pages plugin <= 0.9.7 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Johannes van Poelgeest Admin Options Pages admin-options-pages allows Reflected XSS.This issue affects Admin Options Pages: from n/a through = 0.9.7...
CVE-2025-23905: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Johannes van Poelgeest Admin Options Pages admin-options-pages allows Reflected XSS.This issue affects Admin Options Pages: from n/a through = 0.9.7...
WordPress plugin Admin Options Pages 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...
PT-2025-7017 · Unknown · Johannes Van Poelgeest Admin Options Pages
Name of the Vulnerable Software and Affected Versions: Johannes van Poelgeest Admin Options Pages versions 0.9.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means...
WordPress Admin Options Pages plugin <= 0.9.7 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana in WordPress Plugin Admin Options Pages versions = 0.9.7...
ZOHO ManageEngine SharePoint Manager Plus 安全漏洞
ZOHO ManageEngine SharePoint Manager Plus is a complete management and auditing solution from ZOHO, Inc. It helps you manage, audit, and report on your local and Office 365 SharePoint environments. It also allows you to monitor, track and analyze all activities in your SharePoint infrastructure t...
CVE-2021-25117
The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratingsimage parameter from its options page wp-admin/admin.php?page=wp-postratings/postratings-options.php. Even though the page is only accessible to administrators, and protected against CSRF attacks, the issue is stil...
CVE-2021-25117: Cross-Site Request Forgery (CSRF)
The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratingsimage parameter from its options page wp-admin/admin.php?page=wp-postratings/postratings-options.php. Even though the page is only accessible to administrators, and protected against CSRF attacks, the issue is stil...
PT-2023-32715 · Typecho · Typecho
Name of the Vulnerable Software and Affected Versions: Typecho version 1.2.1 Description: A vulnerability has been found in the Logo Handler component of Typecho, affecting an unknown function of the file /admin/options-theme.php. This issue leads to cross site scripting and can be exploited...
CVE-2023-6613: Improper Neutralization of Input During Web Page Generation
A vulnerability classified as problematic has been found in Typecho 1.2.1. Affected is an unknown function of the file /admin/options-theme.php of the component Logo Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclos...
CVE-2022-2144
The Jquery Validation For Contact Form 7 WordPress plugin before 5.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change Blog options like defaultrole, userscanregister via a CSRF attack...
Sourcecodester Baby Care System SQL注入漏洞
Sourcecodester Baby Care System is an application of the Sourcecodester community in the United States. Sourcecodester Baby Care System v1.0 contains a SQL injection vulnerability, which originates from /admin.php?id=siteoptions&social=edit&sid=insid parameter missing validation of external input...