Code injection

The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

Code injection

The nd-travel plugin before 1.7 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

CVE-2019-15774

ND Booking (WordPress plugin)

CVE-2019-15774

The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

CVE-2019-15775

The nd-learning plugin before 4.8 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

CVE-2019-15775

CVE-2019-15775 affects the WordPress nd-learning plugin (prior to version 4.8). It exposes a nopriv_ AJAX action that can modify the siteurl setting, enabling unauthenticated modification of site configuration. Impact as documented: potential compromise of site URL, with CVSS v3 base score 6.1 (M...

CVE-2019-15773

The nd-travel plugin before 1.7 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

CVE-2019-15772

The CVE-2019-15772 issue affects the WordPress nd-donations plugin prior to version 1.4. It exposes a nopriv_ AJAX action that allows modification of the siteurl setting. This unauthenticated capability can enable an attacker to alter the site’s URL configuration, depending on the vulnerable envi...

CVE-2019-15647

The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulkactionlistener remote code execution...

WordPress advanced-ajax-page-loader plugin permissions permission and access control issues vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. advanced-ajax-page-loader is an AJAX page loading plugin used in it. The WordPress advanced-ajax-page-loader plugin is...

CVE-2016-10929

The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in...

CVE-2016-10929

The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in...

CVE-2016-10929

The CVE-2016-10929 entry concerns the WordPress plugin “advanced-ajax-page-loader” prior to version 2.7.7. The vulnerability is that there is no protection against reading uploaded files when the user is not logged in, enabling unauthenticated access to uploaded content. The available connected d...

CVE-2015-9337

The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX...

CVE-2016-10926

The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php...

Server side request forgery (ssrf)

The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php...

Server side request forgery (ssrf)

The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php...

CVE-2015-9337

The CVE concerns the WordPress plugin Profile Builder. Before version 2.1.4, it has no access control for activating or deactivating addons via AJAX, enabling unauthorized addon management and potentially partial integrity impact. Affected software: WordPress Profile Builder plugin (pre-2.1.4). R...

CVE-2015-9337

The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX...

CVE-2016-10927

CVE-2016-10927 affects the WordPress plugin nelio-ab-testing (pre-4.5.11). The vulnerability is an SSRF in ajax/iesupport.php, with CVSSv3 base score 10.0 (CRITICAL) and CVSSv2 base score 6.4 (MEDIUM). Impact indicators shown: high confidentiality and integrity impact, no availability impact; exp...