PT-2017-14245

Name of the Vulnerable Software and Affected Versions wp-noexternallinks plugin versions prior to 3.5.19 Description A Cross Site Scripting XSS issue exists, allowing exploitation via the date1 or date2 parameter to the "wp-admin/options-general.php" API endpoint. Recommendations For versions pri...

Sql injection

SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the cpdkeepmonth parameter to wp-admin/options-general.php. NOTE: this can be leveraged using CSRF to allow...

CVE-2015-5533

SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the cpdkeepmonth parameter to wp-admin/options-general.php. NOTE: this can be leveraged using CSRF to allow...

Code injection

The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php...

PT-2017-14240

Name of the Vulnerable Software and Affected Versions PopCash.Net Code Integration Tool plugin version prior to 1.1 Description The issue allows for XSS via the tab parameter to "wp-admin/admin.php". Recommendations For versions prior to 1.1, update to version 1.1 or later to resolve the issue...

CVE-2017-15811: Improper Neutralization of Input During Web Page Generation

The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assetsurl parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php...

CVE-2017-15810: Improper Neutralization of Input During Web Page Generation

The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php...

PT-2017-6864

Name of the Vulnerable Software and Affected Versions Count Per Day plugin versions prior to 3.4.1 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands via the cpd keep month parameter to "wp-admin/options-general.php". This can be leveraged using CSR...

Cross site scripting

Cross-site scripting XSS vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrary web script or HTML via the orderid parameter in the galleryalbumsorting page to wp-admin/admin.php...

CVE-2014-8758: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrary web script or HTML via the orderid parameter in the galleryalbumsorting page to wp-admin/admin.php...

CVE-2014-7240: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a masterresponse action to wp-admin/admin-ajax.php...

PT-2017-6269

Name of the Vulnerable Software and Affected Versions Best Gallery Albums Plugin versions prior to 3.0.70 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the order id parameter in the "gallery album sorting" page to...

PT-2017-6001

Name of the Vulnerable Software and Affected Versions: Easy Contact Form Solution plugin versions prior to 1.7 Description: The issue allows remote attackers to inject arbitrary web script or HTML. This is achieved by exploiting the value parameter in a master response action to the...

Sql injection

SQL Injection exists in /includes/event-management/index.php in the event-espresso-free aka Event Espresso Lite plugin v3.1.37.12.L for WordPress via the recurrenceid parameter to /wp-admin/admin.php...

PT-2017-13674

Name of the Vulnerable Software and Affected Versions event-espresso-free plugin version 3.1.37.12.L Description A SQL Injection issue exists in the event-espresso-free plugin for WordPress. The issue is related to the recurrence id parameter in the /includes/event-management/index.php file, whic...

PT-2017-13268

Name of the Vulnerable Software and Affected Versions Responsive Image Gallery plugin versions prior to 1.2.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the id parameter in an add edit theme task in the "wpdevart gallery themes"...

CVE-2017-14125: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "id" parameter in an addedittheme task in the wpdevartgallerythemes page to wp-admin/admin.php...

CVE-2017-14725

Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php...

CVE-2017-14725

Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php...

CVE-2017-14725

Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php...