CVE-2015-9379

iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2015-9372

Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2015-9370

Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2015-9355

The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area...

CVE-2015-9356

The wp-vipergb plugin before 1.3.16 for WordPress has XSS via addqueryarg and removequeryarg, a different issue than CVE-2014-9460...

Sql injection

The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066...

CVE-2015-9379

iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2015-9378

The CVE-2015-9378 entry concerns iThemes Builder Theme Market for WordPress, where a cross-site scripting (XSS) vulnerability exists in the add_query_arg() and remove_query_arg() paths. Affected product/version: iThemes Builder Theme Market prior to 5.1.27. Root cause: insufficient input handling...

CVE-2015-9377

Vulnerability: iThemes Builder Theme Depot for WordPress is affected by an XSS flaw in add_query_arg() and remove_query_arg(). Version range affected is prior to 5.0.30. Root cause details are not elaborated beyond the XSS via query argument handling. Impact is described as cross-site scripting, ...

CVE-2015-9376

iThemes Mobile before 1.2.8 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2015-9376

The CVE-2015-9376 entry concerns iThemes Mobile for WordPress (before 1.2.8). The underlying issue is an XSS in add_query_arg() and remove_query_arg() that can be triggered through the affected plugin. Impact is XSS (as stated in multiple sources); exploitation details are not provided in the doc...

CVE-2015-9375

Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2015-9375

CVE-2015-9375 affects the Table Rate Shipping Add-on for WordPress/iThemes Exchange (before 1.1.0). The vulnerability is an XSS via add_query_arg() and remove_query_arg(), with partial integrity impact (NVD CVSS2: I:P; CVSS3: I:L/C:L). Mitigations/patch: upgrade to version 1.1.0 or later (per sou...

CVE-2015-9374

The CVE-2015-9374 entry concerns the Stripe Add-on for iThemes Exchange (WordPress) with an XSS vulnerability reported as occurring before version 1.2.0. The underlying issue is an XSS via add_query_arg() and remove_query_arg(), indicating input handling flaws in the plugin’s URL parameter proces...

CVE-2015-9373

CVE-2015-9373 affects the PayPal Pro Add-on for iThemes Exchange on WordPress before version 1.1.0. The vulnerability is a reflected XSS via add_query_arg() and remove_query_arg(), as described in the NVD entry. The document does not provide exploitable details beyond this XSS disclosure, nor exp...

CVE-2015-9372

CVE-2015-9372 describes a Cross-Site Scripting vulnerability in the WordPress plugin Membership Add-on for iThemes Exchange, affecting versions before 1.3.0. The root cause is improper handling of query arguments via add_query_arg() and remove_query_arg(), enabling an attacker to inject client-si...

CVE-2015-9371

CVE-2015-9371 concerns the WordPress ecosystem: the Manual Purchases Add-on for iThemes Exchange (before version 1.1.0) is vulnerable to XSS via add_query_arg() and remove_query_arg(). The connected records confirm the affected product and method but do not provide explicit exploitation details, ...

CVE-2015-9370

CVE-2015-9370 affects WordPress Invoices Add-on for iThemes Exchange (pre-1.4.0). A cross-site scripting (XSS) vulnerability is reported via add_query_arg() and remove_query_arg(), enabling client-side script execution. Multiple sources (NVD, RH) corroborate the XSS issue; exploitation status is ...

CVE-2015-9369

CVE-2015-9369 affects the WordPress plugin Easy US Sales Taxes Add-on for iThemes Exchange (before 1.1.0). The vulnerability is an XSS flaw triggered via the functions add_query_arg() and remove_query_arg(), enabling attacker-controlled client-side code execution in affected contexts. The root ca...

CVE-2015-9368

CVE-2015-9368 affects the Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange on WordPress, prior to version 1.2.0. The vulnerability is an XSS due to improper handling of add_query_arg() and remove_query_arg(), allowing injected scripts via URL parameters. Impact is XSS; exploitation det...