CVE-2017-14725

Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php...

PT-2017-13654

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.8.2 Description The issue allows for an open redirect attack. This is related to the files wp-admin/edit-tag-form.php and wp-admin/user-edit.php. Recommendations For versions prior to 4.8.2, update to version 4.8....

CVE-2017-14725: URL Redirection to Untrusted Site

Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php...

CVE-2015-8354

Cross-site scripting XSS vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the refer parameter to wp-admin/users.php...

CVE-2015-8354: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the refer parameter to wp-admin/users.php...

PT-2017-7403

Name of the Vulnerable Software and Affected Versions Ultimate Member WordPress plugin versions prior to 1.3.29 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the refer parameter to...

PT-2017-7402

Name of the Vulnerable Software and Affected Versions Role Scoper plugin for WordPress versions prior to 1.3.67 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the object name parameter in a "rs-object role edit" page to...

CVE-2015-8353: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the objectname parameter in a rs-objectroleedit page to wp-admin/admin.php...

Sql injection

SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watuproquestions parameter in a watuprosubmit action to wp-admin/admin-ajax.php...

CVE-2017-9834: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watuproquestions parameter in a watuprosubmit action to wp-admin/admin-ajax.php...

PT-2017-12791

Name of the Vulnerable Software and Affected Versions PressForward plugin versions 4.3.0 and earlier Description The issue concerns a problem with the PATH INFO to wp-admin/admin.php, related to PHP SELF, allowing for XSS in the CoreAdminPFTemplater.php file. Recommendations For PressForward plug...

CVE-2017-12948: Improper Neutralization of Input During Web Page Generation

Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATHINFO to wp-admin/admin.php, related to PHPSELF...

PT-2017-12789

Name of the Vulnerable Software and Affected Versions Easy Modal plugin versions prior to 2.1.0 Description The issue concerns SQL injection in the delete action of the Easy Modal plugin, specifically affecting the id, ids, or modal parameter to wp-admin/admin.php. This can be exploited by...

PT-2017-12790

Name of the Vulnerable Software and Affected Versions Easy Modal plugin versions prior to 2.1.0 Description The issue concerns SQL injection in the Easy Modal plugin for WordPress. It affects the untrash action and involves the id, ids, or modal parameter to "wp-admin/admin.php". This exploit is...

CVE-2017-12199: Improper Neutralization of Special Elements used in an SQL Command

The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogueupdateorder list-item, videoupdateorder video-item, imageupdateorder list-item, taggroupupdateorder listitem, categoryproductsupdateorder...

PT-2017-12397

Name of the Vulnerable Software and Affected Versions Etoile Ultimate Product Catalog plugin version 4.2.11 Description The issue concerns SQL injection in the Etoile Ultimate Product Catalog plugin for WordPress. Specifically, the vulnerability is triggered by various POST actions in the...

PT-2017-12333

Name of the Vulnerable Software and Affected Versions Event List plugin version 0.7.9 Description The issue concerns a problem with the slug array parameter in the wp-admin/admin.php endpoint, specifically in the el admin categories delete bulk action, allowing for XSS. Recommendations For Event...

CVE-2017-12068: Improper Neutralization of Input During Web Page Generation

The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an eladmincategories deletebulk action...

Cross-Site Request Forgery(CSRF)

Wordpress is vulnerable to cross-site request forgery CSRF attacks. The attacks can be launched because wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php have flaws, allowing the widget-access action requests to be hijacked by the attackers...

WordPress WP Jobs Plugin SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.WP Jobs plugin is one of the post management plugin. A SQL injection vulnerability exists in WordPress WP Jobs plug...