CVE-2015-9464

The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter...

CVE-2015-9473

CVE-2015-9473 concerns the WordPress estrutura-basica theme (up to 2015-09-13) with a directory traversal flaw in the scripts/download.php arquivo parameter. The root cause is improper handling of file paths, enabling retrieval of local files via this parameter. Public references in the provided ...

CVE-2015-9472

CVE-2015-9472 affects the WordPress incoming-links plugin prior to 0.9.10b, where referrers.php XSS is triggered via the Referer HTTP header. Multiple connected sources (NVD, RH, CNVD, CVE listings) confirm a cross-site scripting vulnerability in this plugin. Public details describe the flaw and ...

CVE-2015-9471

CVE-2015-9471 affects the WordPress plugin dzs-zoomsounds (2.0), where an admin/upload.php arbitrary file upload vulnerability exists. The issue is tied to the dzs-zoomsounds WordPress plugin and results in potential unauthorized file uploads via its admin interface. The initial description state...

CVE-2015-9471

The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload...

CVE-2015-9463

The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter...

CVE-2015-9470

CVE-2015-9470 concerns the WordPress history-collection plugin (

CVE-2015-9469

CVE-2015-9469 — WordPress Content Grabber 1.0 XSS . The WordPress plugin content-grabber (version 1.0) is vulnerable to cross-site scripting via the fields obj_field_name or obj_field_id. Multiple sources (NVD, Red Hat, CNVD, CVE lists, and WPVulnDB) corroborate an XSS vulnerability affecting thi...

CVE-2015-9469

The content-grabber plugin 1.0 for WordPress has XSS via objfieldname or objfieldid...

CVE-2015-9468

The CVE-2015-9468 entry concerns the WordPress Broken Link Manager plugin v0.4.5, which is vulnerable to cross-site scripting (XSS) via the page parameter in a delURL action. This vulnerability is documented across multiple sources (NVD/NVD-derived entries and related advisories) and is tied to t...

CVE-2015-9467

The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter...

CVE-2015-9467

The CVE-2015-9467 vulnerability affects the WordPress Broken Link Manager plugin (before 0.5.0). The root cause is an SQL injection via the url parameter using the wpslDelURL or wpslEditURL vectors, enabling an attacker to execute arbitrary SQL commands. References (NVD/Red Hat/CNVD) corroborate ...

CVE-2015-9465

CVE-2015-9465 affects the WordPress plugin Yet Another Stars Rating (yasr) prior to version 0.9.1. The vulnerability is a SQL injection in yasr_get_multi_set_values_and_field via the set_id parameter. Several sources corroborate an SQL injection issue, including records describing an Authenticate...

CVE-2015-9462

CVE-2015-9462 concerns the WordPress plugin awesome-filterable-portfolio (before 1.9). The vulnerability is an SQL injection in the function afp_get_new_category_page, exploitable via the cat_id parameter. The issue is documented across multiple sources (NVD entry referencing the same function an...

CVE-2015-9462

The awesome-filterable-portfolio plugin before 1.9 for WordPress has afpgetnewcategorypage SQL injection via the catid parameter...

CVE-2015-9461

The awesome-filterable-portfolio plugin before 1.9 for WordPress has afpgetnewportfolioitempage SQL injection via the itemid parameter...

CVE-2015-9461

The CVE-2015-9461 vulnerability concerns the WordPress plugin awesome-filterable-portfolio (before version 1.9). The issue is an SQL injection in the function afp_get_new_portfolio_item_page exploitable via the item_id parameter. Reported impact in the sources includes unsafe data handling leadin...

CVE-2015-9460

The CVE refers to CVE-2015-9460 in the WordPress Pinpoint/booking-system plugin. A SQL injection exists in the booking-system plugin before 2.1 via DOPBSPBackEndTranslation::display and the language parameter. Several connected records confirm the vulnerability, its association with the WordPress...

CVE-2015-9458

The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pkstt2dbgetpopularterms count parameter exploitable via CSRF...

CVE-2015-9458

The CVE-2015-9458 entry concerns the WordPress plugin SearchTerms Tagging 2 (up to v1.535). A SQL injection is possible via the pk_stt2_db_get_popular_terms count parameter and is exploitable through CSRF, as described in multiple sources (NVD, RH/Red Hat, CNVD, PRION, CVE List, WPVulnDB). The vu...