CVE-2017-18634: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The newspaper theme before 6.7.2 for WordPress has script injection via tdadsheader to admin-ajax.php...

CVE-2019-12517: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The savequizscore functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later shown in the WordPress...

WordPress SlickQuiz 1.3.7.1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications 1. ADVISORY INFORMATION ======================= Product: SlickQuiz Vendor URL: https://wordpress.org/plugins/slickquiz/ Type: Cross-Site Scripting CWE-79 Date found: 2019-05-30 Date published: 2019-09-10 CVSSv3 Score: 6.1...

PT-2019-12838

Name of the Vulnerable Software and Affected Versions SlickQuiz plugin for WordPress versions through 1.3.7.1 Description A stored XSS issue was discovered, allowing unauthenticated users to submit malicious data via the /wp-admin/admin-ajax.php endpoint, specifically through the save quiz score...

CVE-2018-21013

The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php...

CVE-2018-21013: Improper Privilege Management

The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php...

PT-2019-10438

Name of the Vulnerable Software and Affected Versions Swape theme for WordPress versions prior to 1.2.1 Description The issue concerns incorrect access control in the Swape theme for WordPress. This allows unauthorized creation of new administrator accounts through specific vectors involving the...

CVE-2019-15873

The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pmtemplatepreview&html=?php substring followed by PHP code...

CVE-2019-15873

The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pmtemplatepreview&html=?php substring followed by PHP code...

PT-2019-14453

Name of the Vulnerable Software and Affected Versions profilegrid-user-profiles-groups-and-communities plugin versions prior to 2.8.6 Description The issue allows for remote code execution. This can be achieved through a request to the wp-admin/admin-ajax.php endpoint with specific parameters,...

CVE-2019-15873: Improper Control of Generation of Code

The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pmtemplatepreview&html=...

CVE-2019-15777

The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&adminemail= XSS...

Cross site scripting

The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&adminemail= XSS...

CVE-2019-15777

The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&adminemail= XSS...

CVE-2019-15777

The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&adminemail= XSS...

PT-2019-14386

Name of the Vulnerable Software and Affected Versions shapepress-dsgvo plugin versions prior to 2.2.19 Description The issue concerns a Cross-Site Scripting XSS vulnerability. It is related to the "action" parameter in the /wp-admin/admin-ajax.php API endpoint, specifically when the action is set...

CVE-2019-15777: Improper Neutralization of Input During Web Page Generation

The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&adminemail= XSS...

WordPress Download Manager Plugin Cross-Site Request Forgery

A cross-site request forgery vulnerability has been reported in WordPress Download Manager Plugin. The vulnerability is due to insufficient CSRF protections. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user with administrator privileges to visit a page which...

PT-2019-14319

Name of the Vulnerable Software and Affected Versions Groundhogg plugin versions prior to 1.3.5 Description The issue allows for remote code execution via the "action=bulk action listener" parameter in the wp-admin/admin-ajax.php API endpoint. Recommendations For versions prior to 1.3.5, update t...

CVE-2019-15647: Improper Control of Generation of Code

The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulkactionlistener remote code execution...