2319 matches found
CVE-2019-14793
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmbdeletefile attachmentid parameter...
PT-2019-13838
Name of the Vulnerable Software and Affected Versions Meta Box plugin versions prior to 4.16.3 Description The issue allows file deletion via an ajax request. Specifically, it involves the "wp-admin/admin-ajax.php" endpoint with the attachment id parameter. Recommendations For versions prior to...
CVE-2019-14796: Improper Neutralization of Input During Web Page Generation
The mq-woocommerce-products-price-bulk-edit aka Woocommerce Products Price Bulk Edit plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=updateoptions showproductspagelimit parameter...
CVE-2019-14798: Improper Limitation of a Pathname to a Restricted Directory
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcodebwg tagtext parameter...
CVE-2019-14787: Improper Neutralization of Input During Web Page Generation
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newslettersloadneweditor contentarea parameter...
CVE-2019-14793: Missing Authorization
The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmbdeletefile attachmentid parameter...
PT-2019-13843
Name of the Vulnerable Software and Affected Versions 10Web Photo Gallery plugin versions prior to 1.5.25 Description The issue concerns an Authenticated Local File Inclusion vulnerability via directory traversal. This is specifically related to the tagtext parameter in the...
Cross site request forgery (csrf)
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acuideleteattachment CSRF...
CVE-2019-14683
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acuideleteattachment CSRF...
PT-2019-7251
Name of the Vulnerable Software and Affected Versions 6kbbs versions 7.1 through 8.0 Description The issue allows for CSRF attacks via specific API endpoints, including "portalchannel ajax.php" with id or code parameters, and "admin.php" with a fileids parameter. Recommendations For versions 7.1...
CVE-2019-14683: Cross-Site Request Forgery (CSRF)
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acuideleteattachment CSRF...
Cross site scripting
An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpxname wp-admin/admin-ajax.php POST parameter...
CVE-2019-14364: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpxname wp-admin/admin-ajax.php POST parameter...
Block WP Login <= 1.3.0 - CSRF and Unauthorised Settings Update
Lack of CSRF and authorisation checks in the bwplconfigureslug function registered as an admininit action could allow attacker via CSRF, or unauthenticated using the admin-ajax.php to change the plugin settings located at /wp-admin/options-permalink.php and disable the protection offered. v1.3.1...
FV Flowplayer Video Player <= 7.3.13.727 - Unauthenticated Stored XSS
The vulnerable function is exposed to unauthenticated users over wpajaxnoprivfvwpflowplayeremailsignup ajax hook. It saves anything that user provides in email POST parameter. PoC Send POST request to wp-admin/admin-ajax.php with body content: "[email protected]" The...
Cross site scripting
include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS...
CVE-2018-20837
include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS...
CVE-2018-20837
include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS...
CVE-2018-20837
Typesetter 5.1 contains a cross-site scripting (XSS) flaw in include/admin/Menu/Ajax.php. The description cites an input path: index.php/Admin/Menu/Ajax?cmd=AddHidden, with title XSS. Details on affected versions, impact, exploit method, and fixes are drawn from multiple sources; remediation spec...