2947 matches found
PT-2019-7407
Name of the Vulnerable Software and Affected Versions sendpress plugin versions prior to 1.2 Description The issue allows for SQL Injection via the "listid" parameter in the wp-admin/admin.php?page=sp-queue endpoint. Recommendations For versions prior to 1.2, update to version 1.2 or later to...
CVE-2015-9442: Cross-Site Request Forgery (CSRF)
The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenirplugin...
CVE-2015-9447: Cross-Site Request Forgery (CSRF)
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters...
CVE-2015-9440: Cross-Site Request Forgery (CSRF)
The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new...
CVE-2015-9428: Cross-Site Request Forgery (CSRF)
The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters...
PT-2019-7401
Name of the Vulnerable Software and Affected Versions avenirsoft-directdownload plugin version 1.0 Description The issue concerns a CSRF vulnerability that leads to XSS. It is exploitable via the "wp-admin/admin.php?page=avenir plugin" endpoint. Recommendations For avenirsoft-directdownload plugi...
CVE-2015-9413
The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter...
PT-2019-7372
Name of the Vulnerable Software and Affected Versions eshop plugin for WordPress versions through 6.3.13 Description The issue concerns a CSRF with resultant XSS in the eshop plugin for WordPress. This occurs via the "title" parameter in the "/wp-admin/admin.php?page=eshop-downloads.php" API...
CVE-2015-9413: Cross-Site Request Forgery (CSRF)
The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter...
CVE-2016-10989
The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkmefacebook CSRF...
PT-2019-7782
Name of the Vulnerable Software and Affected Versions leenkme plugin versions prior to 2.6.0 Description The issue concerns a CSRF problem in the leenkme plugin for WordPress. The affected endpoint is "wp-admin/admin.php?page=leenkme facebook". Recommendations For versions prior to 2.6.0, update ...
PT-2019-7775
Name of the Vulnerable Software and Affected Versions kento-post-view-counter plugin versions prior to 2.8 Description The issue concerns a CSRF problem in the kento-post-view-counter plugin for WordPress, specifically affecting the wp-admin/admin.php?page=kentopvc settings page. Recommendations...
PT-2019-7785
Name of the Vulnerable Software and Affected Versions music-store plugin versions prior to 1.0.43 Description The issue allows for XSS via the "from year" parameter in the "/wp-admin/admin.php?page=music-store-menu-reports" API endpoint. Recommendations For music-store plugin versions prior to...
CVE-2016-10992: Improper Neutralization of Input During Web Page Generation
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports fromyear parameter...
CVE-2016-10989: Cross-Site Request Forgery (CSRF)
The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkmefacebook CSRF...
CVE-2016-10982: Cross-Site Request Forgery (CSRF)
The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvcsettings CSRF...
CVE-2016-10973
The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php...
CVE-2016-10973: Improper Neutralization of Input During Web Page Generation
The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php...
CVE-2019-13363
admin.php?page=notificationbymail in Piwigo 2.9.5 has XSS via the nbmsendhtmlmail, nbmsendmailas, nbmsenddetailedcontent, nbmcomplementarymailcontent, nbmsendrecentpostdates, or paramsubmit parameter. This is exploitable via CSRF...
