CVE-2014-8758: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrary web script or HTML via the orderid parameter in the galleryalbumsorting page to wp-admin/admin.php...

PT-2017-6269

Name of the Vulnerable Software and Affected Versions Best Gallery Albums Plugin versions prior to 3.0.70 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the order id parameter in the "gallery album sorting" page to...

CVE-2017-14622

Multiple cross-site scripting XSS vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter or 2 kbAction parameter in the kbAmz page to wp-admin/admin.php...

Sql injection

SQL Injection exists in /includes/event-management/index.php in the event-espresso-free aka Event Espresso Lite plugin v3.1.37.12.L for WordPress via the recurrenceid parameter to /wp-admin/admin.php...

PT-2017-13674

Name of the Vulnerable Software and Affected Versions event-espresso-free plugin version 3.1.37.12.L Description A SQL Injection issue exists in the event-espresso-free plugin for WordPress. The issue is related to the recurrence id parameter in the /includes/event-management/index.php file, whic...

PT-2017-13268

Name of the Vulnerable Software and Affected Versions Responsive Image Gallery plugin versions prior to 1.2.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the id parameter in an add edit theme task in the "wpdevart gallery themes"...

CVE-2017-14125: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "id" parameter in an addedittheme task in the wpdevartgallerythemes page to wp-admin/admin.php...

CVE-2015-4089

Multiple cross-site request forgery CSRF vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the 1 saveOption, 2 deleteCache, 3...

CVE-2015-4089

The CVE-2015-4089 entries describe multiple CSRF vulnerabilities in the WordPress WP Fastest Cache plugin, specifically in the optionsPageRequest function of admin.php prior to version 0.8.3.5. An attacker can exploit the wpFastestCachePage parameter to invoke (1) saveOption, (2) deleteCache, (3)...

CVE-2015-4089: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the 1 saveOption, 2 deleteCache, 3...

PT-2017-6737

Name of the Vulnerable Software and Affected Versions WP Fastest Cache plugin versions prior to 0.8.3.5 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities in the optionsPageRequest function within the admin.php file of the WP Fastest Cache plugin. These...

CVE-2015-8353

Cross-site scripting XSS vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the objectname parameter in a rs-objectroleedit page to wp-admin/admin.php...

PT-2017-7402

Name of the Vulnerable Software and Affected Versions Role Scoper plugin for WordPress versions prior to 1.3.67 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the object name parameter in a "rs-object role edit" page to...

CVE-2015-8353: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the objectname parameter in a rs-objectroleedit page to wp-admin/admin.php...

PT-2017-12791

Name of the Vulnerable Software and Affected Versions PressForward plugin versions 4.3.0 and earlier Description The issue concerns a problem with the PATH INFO to wp-admin/admin.php, related to PHP SELF, allowing for XSS in the CoreAdminPFTemplater.php file. Recommendations For PressForward plug...

CVE-2017-12948: Improper Neutralization of Input During Web Page Generation

Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATHINFO to wp-admin/admin.php, related to PHPSELF...

CVE-2017-12946: Improper Neutralization of Special Elements used in an SQL Command

classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators...

PT-2017-12789

Name of the Vulnerable Software and Affected Versions Easy Modal plugin versions prior to 2.1.0 Description The issue concerns SQL injection in the delete action of the Easy Modal plugin, specifically affecting the id, ids, or modal parameter to wp-admin/admin.php. This can be exploited by...

PT-2017-12790

Name of the Vulnerable Software and Affected Versions Easy Modal plugin versions prior to 2.1.0 Description The issue concerns SQL injection in the Easy Modal plugin for WordPress. It affects the untrash action and involves the id, ids, or modal parameter to "wp-admin/admin.php". This exploit is...

Theo CMS 2.0 SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================= MGC ALERT 2017-004 - Original release date: July 11, 2017 - Last revised: August 12, 2017 - Discovered by: Manuel GarcAa CA!rdenas - Severity: 7,1/10 CVSS Base Score...