CVE-2019-15777

The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&adminemail= XSS...

CVE-2019-15777: Improper Neutralization of Input During Web Page Generation

The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&adminemail= XSS...

PT-2019-14386

Name of the Vulnerable Software and Affected Versions shapepress-dsgvo plugin versions prior to 2.2.19 Description The issue concerns a Cross-Site Scripting XSS vulnerability. It is related to the "action" parameter in the /wp-admin/admin-ajax.php API endpoint, specifically when the action is set...

WordPress Download Manager Plugin Cross-Site Request Forgery

A cross-site request forgery vulnerability has been reported in WordPress Download Manager Plugin. The vulnerability is due to insufficient CSRF protections. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user with administrator privileges to visit a page which...

CVE-2019-15647: Improper Control of Generation of Code

The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulkactionlistener remote code execution...

PT-2019-14319

Name of the Vulnerable Software and Affected Versions Groundhogg plugin versions prior to 1.3.5 Description The issue allows for remote code execution via the "action=bulk action listener" parameter in the wp-admin/admin-ajax.php API endpoint. Recommendations For versions prior to 1.3.5, update t...

CVE-2015-9332

The CVE-2015-9332 issue affects the WordPress uninstall plugin (before v1.2). The vulnerability is a Cross-Site Request Forgery (CSRF) that can trigger uninstall to delete all database tables via wp-admin/admin-ajax.php?action=uninstall, as described in multiple sources (WordPress uninstall plugi...

PT-2019-7291

Name of the Vulnerable Software and Affected Versions WordPress uninstall plugin versions prior to 1.2 Description The issue allows for CSRF, enabling the deletion of all tables via the "wp-admin/admin-ajax.php?action=uninstall" API endpoint. Recommendations For versions prior to 1.2, update to...

CVE-2015-9332: Cross-Site Request Forgery (CSRF)

The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI...

PT-2019-13879

Name of the Vulnerable Software and Affected Versions REDCap versions prior to 9.3.0 Description The issue allows for time-based SQL injection in the edit calendar event via the cal id parameter. An attacker can exploit this to obtain a user's login sessionid from the database and then re-login...

CVE-2019-14790

The limb-gallery aka Limb Gallery plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,...

Code injection

The toggle-the-title aka Toggle The Title plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=updatetitleoptions isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter...

CVE-2019-14790

The CVE-2019-14790 entry concerns the WordPress plugin limb-gallery (aka Limb Gallery) up to version 1.4.0. The vulnerability is a Cross-Site Scripting (XSS) flaw exposed via the parameter wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode in the GrsGalleryAjax shortcode task. Publ...

CVE-2019-14790

The limb-gallery aka Limb Gallery plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,...

CVE-2019-14790

The limb-gallery aka Limb Gallery plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,...

CVE-2019-14788: Improper Limitation of a Pathname to a Restricted Directory

wp-admin/admin-ajax.php?action=newslettersexportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers11 parameter in conjunction with an exportfile=../ value...

CVE-2019-14795: Improper Neutralization of Input During Web Page Generation

The toggle-the-title aka Toggle The Title plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=updatetitleoptions isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter...

CVE-2019-14790: Improper Neutralization of Input During Web Page Generation

The limb-gallery aka Limb Gallery plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,...

PT-2019-13835

Name of the Vulnerable Software and Affected Versions Limb Gallery plugin version 1.4.0 Description The issue concerns a cross-site scripting XSS problem. It is exploited through the "wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode" API endpoint, specifically via the task...

PT-2019-13840

Name of the Vulnerable Software and Affected Versions Toggle The Title plugin version 1.4 Description The issue concerns a problem with the Toggle The Title plugin for WordPress. It is possible to exploit this issue via the wp-admin/admin-ajax.php endpoint, specifically through the action=update...