9883 matches found
CVE-2016-10926
The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php...
CVE-2019-15045
AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality...
PT-2019-7053 · WordPress · Cforms2
Name of the Vulnerable Software and Affected Versions: cforms2 plugin versions prior to 13.2 Description: The issue concerns a cross-site scripting XSS problem in the lib ajax.php file of the cforms2 plugin for WordPress. Recommendations: For versions prior to 13.2, update to version 13.2 or late...
CVE-2016-10895
The option-tree plugin before 2.6.0 for WordPress has XSS via an addlistitem or addsociallinks AJAX request...
CVE-2016-10895
The option-tree plugin before 2.6.0 for WordPress has XSS via an addlistitem or addsociallinks AJAX request...
Cross site request forgery (csrf)
The option-tree plugin before 2.6.0 for WordPress has XSS via an addlistitem or addsociallinks AJAX request...
CVE-2016-10895
The option-tree plugin before 2.6.0 for WordPress has XSS via an addlistitem or addsociallinks AJAX request...
CVE-2016-10893
The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests...
Cross site scripting
The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests...
CVE-2016-10893
The CVE-2016-10893 entry concerns the WordPress Crayon Syntax Highlighter plugin. Affected software: crayon-syntax-highlighter plugin for WordPress, prior to version 2.8.4. Root cause: multiple XSS (cross-site scripting) flaws exploitable via AJAX requests. Impact: client-side code execution risk...
CVE-2016-10893
The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests...
WordPress Tribulant Newsletters Plugin Path Traversal Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Tribulant Newsletters plugin is a full-featured newsletter plugin used in it. A path traversal vulnerability exists in the WordPress...
CVE-2019-14795
The toggle-the-title aka Toggle The Title plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=updatetitleoptions isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter...
CVE-2019-14790
The limb-gallery aka Limb Gallery plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,...
CVE-2019-14795
The toggle-the-title aka Toggle The Title plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=updatetitleoptions isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter...
PT-2019-13833 · Tribulant · Tribulant Newsletters
Name of the Vulnerable Software and Affected Versions: Tribulant Newsletters plugin versions prior to 4.6.19 Description: The issue allows directory traversal with resultant remote PHP code execution. This is achieved via the subscribers11 parameter in conjunction with an exportfile=../ value in...
WordPress Plugin Download Manager 2.5 - Cross-Site Request Forgery
Exploit Title: CSRF vulnerabilities in WordPress Download Manager Plugin 2.5 Google Dork: inurl:"/wp-content/plugins/download-manager Date: 24 may, 2019 Exploit Author: Princy Edward Exploit Author Blog : https://prinyedward.blogspot.com/ Vendor Homepage: https://www.wpdownloadmanager.com/ Softwa...
WP Social Feed Gallery < 2.4.8 - CSRF & Missing Authorisation Checks
The lack of CSRF and Authorisations checks in some AJAX methods, such as qliggdismissnotice and qliggformitemdelete could allow attacker to perform unauthorised actions via actions when logged in as a low privilege user, or via CSRF attacks...