PT-2019-7401

Name of the Vulnerable Software and Affected Versions avenirsoft-directdownload plugin version 1.0 Description The issue concerns a CSRF vulnerability that leads to XSS. It is exploitable via the "wp-admin/admin.php?page=avenir plugin" endpoint. Recommendations For avenirsoft-directdownload plugi...

PT-2019-7407

Name of the Vulnerable Software and Affected Versions sendpress plugin versions prior to 1.2 Description The issue allows for SQL Injection via the "listid" parameter in the wp-admin/admin.php?page=sp-queue endpoint. Recommendations For versions prior to 1.2, update to version 1.2 or later to...

CVE-2015-9440: Cross-Site Request Forgery (CSRF)

The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new...

PT-2019-7399

Name of the Vulnerable Software and Affected Versions monetize plugin versions through 1.03 Description The issue concerns a CSRF vulnerability that leads to XSS. It can be exploited via the "wp-admin/admin.php?page=monetize-zones-new" endpoint. Recommendations For monetize plugin versions throug...

CVE-2015-9447: Cross-Site Request Forgery (CSRF)

The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters...

CVE-2015-9413

The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter...

PT-2019-7372

Name of the Vulnerable Software and Affected Versions eshop plugin for WordPress versions through 6.3.13 Description The issue concerns a CSRF with resultant XSS in the eshop plugin for WordPress. This occurs via the "title" parameter in the "/wp-admin/admin.php?page=eshop-downloads.php" API...

CVE-2015-9413: Cross-Site Request Forgery (CSRF)

The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter...

CVE-2016-10989

The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkmefacebook CSRF...

PT-2019-7782

Name of the Vulnerable Software and Affected Versions leenkme plugin versions prior to 2.6.0 Description The issue concerns a CSRF problem in the leenkme plugin for WordPress. The affected endpoint is "wp-admin/admin.php?page=leenkme facebook". Recommendations For versions prior to 2.6.0, update ...

PT-2019-7775

Name of the Vulnerable Software and Affected Versions kento-post-view-counter plugin versions prior to 2.8 Description The issue concerns a CSRF problem in the kento-post-view-counter plugin for WordPress, specifically affecting the wp-admin/admin.php?page=kentopvc settings page. Recommendations...

PT-2019-7785

Name of the Vulnerable Software and Affected Versions music-store plugin versions prior to 1.0.43 Description The issue allows for XSS via the "from year" parameter in the "/wp-admin/admin.php?page=music-store-menu-reports" API endpoint. Recommendations For music-store plugin versions prior to...

CVE-2016-10989: Cross-Site Request Forgery (CSRF)

The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkmefacebook CSRF...

CVE-2016-10982: Cross-Site Request Forgery (CSRF)

The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvcsettings CSRF...

CVE-2016-10992: Improper Neutralization of Input During Web Page Generation

The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports fromyear parameter...

CVE-2016-10973: Improper Neutralization of Input During Web Page Generation

The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php...

Design/Logic Flaw

The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter...

PT-2019-8544

Name of the Vulnerable Software and Affected Versions trust-form plugin version 2.0 Description The issue concerns a problem with the trust-form plugin for WordPress, where there is a potential for XSS via the "page" parameter in the wp-admin/admin.php page, specifically when editing trust forms...

CVE-2017-18613: Improper Neutralization of Input During Web Page Generation

The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter...

CVE-2016-10952: Improper Neutralization of Input During Web Page Generation

The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter...