CVE-2015-5528: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the saveorder function in class-floating-social-bar.php in the Floating Social Bar plugin before 1.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the items parameter in an fsbsaveorder action to wp-admin/admin-ajax.ph...

CVE-2014-9734: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Slider Revolution revslider plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php...

CVE-2015-5151: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Slider Revolution revslider plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the clientaction parameter in a revsliderajaxaction action to wp-admin/admin-ajax.php...

PT-2015-6786

Name of the Vulnerable Software and Affected Versions Slider Revolution plugin version 4.2.2 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the client action parameter in a revslider ajax action action to "wp-admin/admin-ajax.php"...

CVE-2015-4140

Cross-site request forgery CSRF vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for requests that conduct cross-site scripting XSS attacks via the s4w-more parameter to the smilies4wp.php page to wp-admin/options-general.ph...

CVE-2015-4140

CVE-2015-4140 : In the WP Smiley plugin for WordPress (version 1.4.1), a CSRF vulnerability allows remote attackers to hijack the authentication of editors and carry out cross-site scripting (XSS) via the s4w-more parameter to smilies4wp.php, targeting wp-admin/options-general.php. The issue stem...

CVE-2015-4139: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the s4w-more parameter to wp-admin/options-general.php...

PT-2015-6429

Name of the Vulnerable Software and Affected Versions WP Smiley plugin version 1.4.1 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the s4w-more parameter to the...

PT-2015-3538

Name of the Vulnerable Software and Affected Versions WordPress SEO by Yoast plugin versions prior to 2.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the post title parameter to "wp-admin/post-new.php". This is due to...

CVE-2012-6692: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the posttitle parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview...

CVE-2015-4153

Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a loadtemplate action to wp-admin/admin-ajax.php...

PT-2015-4052

Name of the Vulnerable Software and Affected Versions XCloner plugin version 3.1.1 for WordPress XCloner plugin version 3.5.1 for Joomla! Description A directory traversal issue exists, allowing remote administrators to read arbitrary files. This is achieved by using a .. dot dot in the file...

PT-2015-6434

Name of the Vulnerable Software and Affected Versions zM Ajax Login & Register plugin versions prior to 1.1.0 Description The issue allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a "load template" action to...

CVE-2014-8606: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. dot dot in the file parameter in a jsonreturn action in the xclonershow page to wp-admin/admin-ajax.php...

CVE-2015-4153: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a loadtemplate action to wp-admin/admin-ajax.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the iframeurl parameter in an Update Page action in the...

CVE-2015-4010

CVE-2015-4010 concerns the WordPress plugin “Encrypted Contact Form”. The vulnerability is a CSRF that also enables reflected XSS via unsanitized iframe_url data in the Update Page operation of the conformconf page, affecting admin actions in wp-admin/options-general.php. Affected versions are 1....

PT-2015-6416

Name of the Vulnerable Software and Affected Versions Users Ultra plugin versions prior to 1.5.16 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the data target or data vote parameter in a rating vote wp ajax nopriv rating vote action to...

CVE-2015-4109: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 datatarget or 2 datavote parameter in a ratingvote wpajaxnoprivratingvote action to wp-admin/admin-ajax.php...

PT-2015-6395

Name of the Vulnerable Software and Affected Versions WP Membership plugin version 1.2.3 Description The issue allows remote authenticated users to gain administrator privileges. This can be achieved via an iv membership update user settings action to the "wp-admin/admin-ajax.php" endpoint...