PT-2017-7770

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.6 Description The issue allows remote authenticated users to bypass intended read-access restrictions. This is related to the wp ajax update plugin function in wp-admin/includes/ajax-actions.php, which makes a get...

CVE-2014-7151: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the formfields parameter in a 1 doedit or 2 doinsert action to wp-admin/admin-ajax.php...

CVE-2015-5528: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the saveorder function in class-floating-social-bar.php in the Floating Social Bar plugin before 1.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the items parameter in an fsbsaveorder action to wp-admin/admin-ajax.ph...

CVE-2014-9734: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Slider Revolution revslider plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php...

CVE-2015-5151: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Slider Revolution revslider plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the clientaction parameter in a revsliderajaxaction action to wp-admin/admin-ajax.php...

PT-2015-6786

Name of the Vulnerable Software and Affected Versions Slider Revolution plugin version 4.2.2 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the client action parameter in a revslider ajax action action to "wp-admin/admin-ajax.php"...

CVE-2015-4153

Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a loadtemplate action to wp-admin/admin-ajax.php...

PT-2015-4052

Name of the Vulnerable Software and Affected Versions XCloner plugin version 3.1.1 for WordPress XCloner plugin version 3.5.1 for Joomla! Description A directory traversal issue exists, allowing remote administrators to read arbitrary files. This is achieved by using a .. dot dot in the file...

CVE-2015-4153: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a loadtemplate action to wp-admin/admin-ajax.php...

PT-2015-6434

Name of the Vulnerable Software and Affected Versions zM Ajax Login & Register plugin versions prior to 1.1.0 Description The issue allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a "load template" action to...

CVE-2014-8606: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. dot dot in the file parameter in a jsonreturn action in the xclonershow page to wp-admin/admin-ajax.php...

PT-2015-6416

Name of the Vulnerable Software and Affected Versions Users Ultra plugin versions prior to 1.5.16 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the data target or data vote parameter in a rating vote wp ajax nopriv rating vote action to...

CVE-2015-4109: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 datatarget or 2 datavote parameter in a ratingvote wpajaxnoprivratingvote action to wp-admin/admin-ajax.php...

PT-2015-6395

Name of the Vulnerable Software and Affected Versions WP Membership plugin version 1.2.3 Description The issue allows remote authenticated users to gain administrator privileges. This can be achieved via an iv membership update user settings action to the "wp-admin/admin-ajax.php" endpoint...

CVE-2015-4084

Cross-site scripting XSS vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a checkstat action to wp-admin/admin-ajax.php...

PT-2015-6412

Name of the Vulnerable Software and Affected Versions Free Counter plugin version 1.1 for WordPress Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the value parameter in a check stat action to "wp-admin/admin-ajax.php" API endpoint...

CVE-2015-4084: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a checkstat action to wp-admin/admin-ajax.php...

CVE-2014-9311

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

PT-2015-4182

Name of the Vulnerable Software and Affected Versions Shareaholic plugin versions prior to 7.6.1.0 for WordPress Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter i...

CVE-2014-9311: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...