2319 matches found
CVE-2015-9455
The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfbphotos parameter in a bpfbremovetempimages action...
CVE-2015-9451
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfbmailchimp pmfbtid parameter...
PT-2019-7414
Name of the Vulnerable Software and Affected Versions buddypress-activity-plus plugin version 1.6.1 and earlier Description The issue concerns a CSRF vulnerability with resultant directory traversal. This occurs via the "wp-admin/admin-ajax.php" API endpoint, specifically through the bpfb photos...
PT-2019-7410
Name of the Vulnerable Software and Affected Versions plugmatter-optin-feature-box-lite plugin version 2.0.13 and earlier Description The issue concerns a SQL injection vulnerability. It affects the wp-admin/admin-ajax.php endpoint, specifically the action=pmfb mailchimp and the pmfb tid paramete...
PT-2019-7415
Name of the Vulnerable Software and Affected Versions orbisius-child-theme-creator plugin versions prior to 1.2.8 Description The issue concerns incorrect access control for file modification. It can be exploited via the wp-admin/admin-ajax.php?action=orbisius ctc theme editor ajax&sub cmd=save...
PT-2019-7409
Name of the Vulnerable Software and Affected Versions plugmatter-optin-feature-box-lite plugin versions prior to 2.0.14 Description The issue concerns SQL injection via the "wp-admin/admin-ajax.php?action=pmfb cc" API endpoint, specifically through the pmfb tid parameter. This allows for potentia...
CVE-2015-9455: Cross-Site Request Forgery (CSRF)
The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfbphotos parameter in a bpfbremovetempimages action...
CVE-2015-9451: Improper Neutralization of Special Elements used in an SQL Command
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfbmailchimp pmfbtid parameter...
CVE-2015-9450: Improper Neutralization of Special Elements used in an SQL Command
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfbcc pmfbtid parameter...
CVE-2015-9456: Incorrect Permission Assignment for Critical Resource
The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisiusctcthemeeditorajax&subcmd=savefile theme1, theme1file, or theme1filecontents parameter...
CVE-2015-9446
The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via datagalleryID to wp-admin/admin-ajax.php...
CVE-2015-9445
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegalleryajaxaction operation...
Sql injection
The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via datagalleryID to wp-admin/admin-ajax.php...
CVE-2015-9438
The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dwshowwidget idbase, widgetnumber, or instance parameter...
Design/Logic Flaw
The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dwshowwidget idbase, widgetnumber, or instance parameter...
CVE-2015-9438
The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dwshowwidget idbase, widgetnumber, or instance parameter...
CVE-2015-9436
The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=termtree prefix or widgetid parameter...
CVE-2015-9422
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simplefieldsfieldtypepostdialogload plugneditwidth, pnemedcount, PlugneditBGColor, PlugneditEditorMargin, or plugneditcontent parameters...
CVE-2015-9423
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simplefieldsfieldtypepostdialogload PlugneditBGColor, PlugneditEditorMargin, plugneditwidth, pnemedcount, or plugneditcontent parameters...