CVE-2015-9407

CVE-2015-9407 affects the xpinner-lite WordPress plugin (up to version 2.2). The flaw is an XSS in xpinner-lite.php. The connected sources confirm the vulnerability vector as XSS but provide no exploit details or remediation in the cited docs.

CVE-2015-9405

CVE-2015-9405 affects the WordPress plugin WP-Piwik (WP-Matomo Integration) prior to version 1.0.5, with a Cross-Site Scripting (XSS) vulnerability reported. The vulnerability is documented across multiple feeds (NVD/NIST, RH Red Hat advisory, OpenVAS/NASL listing, WPVulndb, CVE list) and is desc...

CVE-2015-9404

The CVE-2015-9404 issue concerns the neuvoo-jobroll WordPress plugin (v2.0). The connected sources describe a cross-site scripting (XSS) vulnerability triggered by neuvoo_keywords within the plugin, with activity described as unauthenticated reflected XSS in at least one source (WPVulndb). The or...

CVE-2015-9390

The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wpajax functions are mishandled...

CVE-2015-9385

The quotes-and-tips plugin before 1.20 for WordPress has XSS...

CVE-2015-9387

The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF...

CVE-2015-9384

The relevant plugin before 1.0.8 for WordPress has XSS...

CVE-2015-9402

The CVE-2015-9402 entry concerns the WordPress plugin Users Ultra (and related variants) prior to version 1.5.59, where the uultra-form-cvs-form-conf component allows arbitrary file upload. This is documented across multiple connected records (NVD, RH/Red Hat, CVE lists, and WPVulndb), consistent...

CVE-2015-9402

The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload...

CVE-2015-9401

The CVE-2015-9401 entry concerns the WordPress websimon-tables plugin up to version 1.3.4, which is vulnerable to an XSS flaw in wp-admin/tools.php edit_style id. Connected sources describe it as an Authenticated Reflected Cross-Site Scripting (XSS) vulnerability affecting Websimon Tables

CVE-2015-9400

CVE-2015-9400 affects the WordPress plugin wordpress-meta-robots (<= 2.1). The vulnerability is an authenticated SQL injection in wp-admin/post-new.php, described as an Authenticated Blind SQL Injection (WPVulDB). Affected component is the plugin itself for WordPress sites, with exploitation r...

CVE-2015-9400

The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection...

CVE-2015-9399

The vulnerability CVE-2015-9399 affects the WordPress plugin wp-stats-dashboard (versions up to 2.9.4). It is an admin/graph_trend.php SQL injection, described as an authenticated vulnerability (authenticated blind SQL injection in WP‑Stats‑Dashboard

CVE-2015-9398

The GoCodes WordPress plugin (<= 1.3.5) is affected by a SQL injection in wp-admin/tools.php gcid, per CVE-2015-9398. Connected sources also describe an Authenticated XSS and Blind SQL Injection in the same plugin (GoCodes

CVE-2015-9397

CVE-2015-9397 affects the GoCodes WordPress plugin (up to version 1.3.5). The vulnerability is an XSS via wp-admin/tools.php?deletegc in the GoCodes plugin, with authenticated-execution implications (Authenticated XSS per cited WPVulndb entry). Impact described as cross-site scripting; CVSS data ...

CVE-2015-9396

The CVE-2015-9396 entry documents a reflected XSS in the WordPress plugin Auto ThickBox Plus (

CVE-2015-9396

The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS...

CVE-2015-9395

The CVE-2015-9395 entry concerns the WordPress Users Ultra plugin (before version 1.5.64). The vulnerability is an SQL Injection via an AJAX action in this plugin. Public sources (NVD) report high impact with CVSS v3.1 metrics: Network attack vector, no user interaction, privileges required Low, ...

CVE-2015-9394

The CVE concerns the WordPress plugin Users Ultra Membership (plugin) before 1.5.63. A CSRF vulnerability exists via action=package_add_new to wp-admin/admin-ajax.php, enabling an attacker to perform actions on behalf of authenticated users. Exploitation details are not provided beyond the CSRF d...

CVE-2015-9393

CVE-2015-9393 affects the WordPress Users Ultra plugin prior to 1.5.63, where the p_desc parameter is vulnerable to cross-site scripting (XSS). The vulnerability is confirmed across multiple sources (NVD entry and Red Hat, with WPVulndb/PRION and CVE lists reiterating the same issue). Impact rang...