CVE-2020-14962

The CVE-2020-14962 issue affects the WordPress Final Tiles Gallery/FTG Lite plugin (versions before 3.4.19). The underlying vulnerability is Cross-Site Scripting (XSS) in the image handling: attacker-supplied input in the image Title (imageTitle) or Description (caption) fields passed to wp-admin...

CVE-2020-14962

Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title aka imageTitle or Caption aka description field of an image to wp-admin/admin-ajax.php...

CVE-2020-14962: Improper Neutralization of Input During Web Page Generation

Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title aka imageTitle or Caption aka description field of an image to wp-admin/admin-ajax.php...

PT-2020-14091

Name of the Vulnerable Software and Affected Versions Final Tiles Gallery plugin versions prior to 3.4.19 Description The issue allows remote attackers to inject arbitrary web script or HTML via the imageTitle or description field of an image to the "/wp-admin/admin-ajax.php" API endpoint...

CVE-2020-13792

PlayTube 1.8 allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users directory traversal, aka local file inclusion...

Directory traversal

PlayTube 1.8 allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users directory traversal, aka local file inclusion...

CVE-2020-13792

PlayTube 1.8 allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users directory traversal, aka local file inclusion...

CVE-2020-13792

PlayTube 1.8 is affected by a directory traversal/local file inclusion vulnerability that allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users. The issue is triggered by traversing the server file path to reach sensitive user information. The connected rec...

CVE-2020-13792: Improper Limitation of a Pathname to a Restricted Directory

PlayTube 1.8 allows disclosure of user details via ajax.php?type=../admin-panel/autoload&page=manage-users directory traversal, aka local file inclusion...

PT-2020-13678

Name of the Vulnerable Software and Affected Versions PlayTube version 1.8 Description The issue allows disclosure of user details via directory traversal, also known as local file inclusion, using the "ajax.php" endpoint with specific parameters. The "type" and "page" parameters are used to acce...

Blog2Social: Social Media Auto Post & Scheduler < 6.3.1 - Authenticated SQL Injection

SQL Injection in the Blog2Social plugin 6.3.0 for WordPress exists via Re-Share Posts feature. Please refer to the video below for steps to reproduce and demonstration of automatic exploit with sqlmap. - Mega.nz: https://mega.nz/file/mt1gFYTKe3XkA-zY0cCApTYlLZktRZ4Q4vchVhbPsNqQC6CKORo - Drive:...

Ajax Load More < 5.3.2 - Authenticated SQL Injection

The Ajax Load More WordPress plugin was vulnerable to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep5=test. The attacker needs to be authenticated with the editthemeoptions capability, which only administrators have by default. PoC...

CVE-2020-12073

The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests...

CVE-2020-12073: Undefined Security Weakness

The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests...

PT-2020-13025

Name of the Vulnerable Software and Affected Versions responsive-add-ons plugin versions prior to 2.2.7 for WordPress Description The issue concerns incorrect access control for wp-admin/admin-ajax.php?action= requests. This affects the responsive-add-ons plugin for WordPress, allowing unauthoriz...

Accordion < 2.2.9 - Unprotected AJAX Action to Stored/Reflected XSS

This flaw allowed any authenticated user with subscriber-level and above permissions the ability to import a new accordion and inject malicious Javascript as part of the accordion. POST /wp-admin/admin-ajax.php HTTP/1.1 Host: URL Accept: / X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0...

CVE-2020-11673

An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. It allows an unauthenticated user to manipulate polls, e.g., delete, clone, or view a hidden poll. This is due to the usage of the callback wpajaxnopriv function in Includes/Total-Soft-Poll-Ajax.php for sensitive operatio...

PT-2020-12762

Name of the Vulnerable Software and Affected Versions Responsive Poll versions 1.3.4 and earlier Description An issue allows an unauthenticated user to manipulate polls, including deletion, cloning, or viewing hidden polls. This is due to the usage of the wp ajax nopriv function in...

CVE-2020-11673: Missing Authentication for Critical Function

An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. It allows an unauthenticated user to manipulate polls, e.g., delete, clone, or view a hidden poll. This is due to the usage of the callback wpajaxnopriv function in Includes/Total-Soft-Poll-Ajax.php for sensitive operatio...

CVE-2020-7916

beteacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpressbeteacher URI without any additional permission checks. Therefore, any user can change its...