PT-2020-7816

Name of the Vulnerable Software and Affected Versions: Huge-IT Slider slider-image plugin versions prior to 2.7.0 Description: The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved via the removeslide parameter in a popup posts or edit cat action in the...

CVE-2015-2062: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Huge-IT Slider slider-image plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL commands via the removeslide parameter in a popupposts or editcat action in the slidershugeitslider page to wp-admin/admin.php...

CVE-2020-8658: Cross-Site Request Forgery (CSRF)

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

PT-2020-20254

Name of the Vulnerable Software and Affected Versions BestWebSoft Htaccess plugin versions prior to 1.8.2 Description The issue allows for Cross-Site Request Forgery CSRF attacks due to incorrect validation of the htccss nonce name flag, which is supposed to pass a nonce to WordPress for anti-CSR...

CVE-2020-6849: Cross-Site Request Forgery (CSRF)

The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketofat CSRF with resultant XSS...

PT-2020-19263

Name of the Vulnerable Software and Affected Versions marketo-forms-and-tracking plugin versions prior to 1.0.3 Description The issue allows for Cross-Site Request Forgery CSRF with resultant Cross-Site Scripting XSS in the "wp-admin/admin.php?page=marketo fat" API endpoint. Recommendations For...

CVE-2020-7047: Improper Privilege Management

The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability with a simple wp-admin/admin.php?db-reset-tables=users request to escalate their privileges to administrator while dropping all other users from the table...

PT-2020-19355

Name of the Vulnerable Software and Affected Versions WP Database Reset versions 3.1 and earlier Description The issue allows any authenticated user with minimal permissions to escalate their privileges to administrator by sending a request to the "wp-admin/admin.php?db-reset-tables=users" API...

CVE-2013-5978

Multiple cross-site scripting XSS vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 Product name or 2 Price description fields via a request to wp-admin/admin.php. NOTE: This issue may on...

PT-2019-6990

Name of the Vulnerable Software and Affected Versions Cart66 Lite plugin versions prior to 1.5.1.15 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific fields, including...

CVE-2015-9454

The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin currentsliderid parameter...

CVE-2015-9452

The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nexformsId parameter...

CVE-2015-9452: Improper Neutralization of Special Elements used in an SQL Command

The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nexformsId parameter...

PT-2019-7413

Name of the Vulnerable Software and Affected Versions smooth-slider plugin versions prior to 2.7 Description The issue concerns SQL Injection via the current slider id parameter in the /wp-admin/admin.php?page=smooth-slider-admin API endpoint. This allows for potential exploitation. No informatio...

CVE-2015-9454: Improper Neutralization of Special Elements used in an SQL Command

The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin currentsliderid parameter...

PT-2019-7406

Name of the Vulnerable Software and Affected Versions unite-gallery-lite plugin versions prior to 1.5 Description The issue concerns CSRF and SQL injection flaws. Specifically, the galleryid or id parameters in wp-admin/admin.php are vulnerable. Recommendations For unite-gallery-lite plugin...

PT-2019-7387

Name of the Vulnerable Software and Affected Versions wplegalpages plugin versions prior to 1.1 Description The issue concerns a CSRF with resultant XSS. It is exploitable via the wp-admin/admin.php?page=legal-pages endpoint with parameters such as lp-domain-name, lp-business-name, lp-phone,...

CVE-2015-9442: Cross-Site Request Forgery (CSRF)

The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenirplugin...

CVE-2015-9448: Improper Neutralization of Special Elements used in an SQL Command

The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter...

CVE-2015-9428: Cross-Site Request Forgery (CSRF)

The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters...