1359 matches found
PT-2019-7407
Name of the Vulnerable Software and Affected Versions sendpress plugin versions prior to 1.2 Description The issue allows for SQL Injection via the "listid" parameter in the wp-admin/admin.php?page=sp-queue endpoint. Recommendations For versions prior to 1.2, update to version 1.2 or later to...
PT-2019-7380
Name of the Vulnerable Software and Affected Versions olevmedia-shortcodes plugin versions prior to 1.1.9 Description The issue concerns a CSRF with resultant XSS in the olevmedia-shortcodes plugin for WordPress. This occurs via the "wp-admin/admin-ajax.php?action=omsc popup" API endpoint,...
PT-2019-7401
Name of the Vulnerable Software and Affected Versions avenirsoft-directdownload plugin version 1.0 Description The issue concerns a CSRF vulnerability that leads to XSS. It is exploitable via the "wp-admin/admin.php?page=avenir plugin" endpoint. Recommendations For avenirsoft-directdownload plugi...
CVE-2015-9447: Cross-Site Request Forgery (CSRF)
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters...
CVE-2015-9423: Improper Neutralization of Input During Web Page Generation
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simplefieldsfieldtypepostdialogload PlugneditBGColor, PlugneditEditorMargin, plugneditwidth, pnemedcount, or plugneditcontent parameters...
CVE-2015-9420: Improper Neutralization of Input During Web Page Generation
The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=getsoundcloudplayer id parameter...
CVE-2015-9422: Cross-Site Request Forgery (CSRF)
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simplefieldsfieldtypepostdialogload plugneditwidth, pnemedcount, PlugneditBGColor, PlugneditEditorMargin, or plugneditcontent parameters...
CVE-2015-9426: Improper Neutralization of Input During Web Page Generation
The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=miceditorwindow postId parameter...
CVE-2015-9443: Cross-Site Request Forgery (CSRF)
The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=AccuDataWP...
CVE-2015-9442: Cross-Site Request Forgery (CSRF)
The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenirplugin...
CVE-2015-9445: Cross-Site Request Forgery (CSRF)
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegalleryajaxaction operation...
CVE-2015-9436: Improper Neutralization of Input During Web Page Generation
The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=termtree prefix or widgetid parameter...
CVE-2015-9433: Cross-Site Request Forgery (CSRF)
The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc. in wp-admin/options-general.php?page=wp-social-bookmarking-light%2Fmodules%2Fadmin.php...
CVE-2015-9434: Cross-Site Request Forgery (CSRF)
The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?posttype=kwlogos&page=kwlogossettings tab or tabflagsorder parameter...
CVE-2015-9428: Cross-Site Request Forgery (CSRF)
The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters...
CVE-2015-9446: Improper Neutralization of Special Elements used in an SQL Command
The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via datagalleryID to wp-admin/admin-ajax.php...
CVE-2015-9449: Improper Neutralization of Special Elements used in an SQL Command
The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php accountid parameter...
CVE-2015-9438: Improper Neutralization of Input During Web Page Generation
The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dwshowwidget idbase, widgetnumber, or instance parameter...
CVE-2015-9440: Cross-Site Request Forgery (CSRF)
The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new...
CVE-2015-9448: Improper Neutralization of Special Elements used in an SQL Command
The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter...