16337 matches found
CVE-2017-18548
The note-press plugin before 0.1.2 for WordPress has SQL injection...
CVE-2019-1003080
A cross-site request forgery vulnerability in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptordoCheckLogin form validation method allows attackers to initiate a connection to an attacker-specified server...
CVE-2015-9447
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters...
CVE-2018-21011
The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details...
CVE-2018-20972
The companion-auto-update plugin before 3.2.1 for WordPress has CSRF...
CVE-2018-20988
The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation...
CVE-2018-1999025
A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java that allows attackers to impersonate any service that Jenkins connects to...
CVE-2016-10922
The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation...
CVE-2016-10948
The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function...
CVE-2016-10890
The aryo-activity-log plugin before 2.3.2 for WordPress has XSS...
CVE-2016-10914
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file...
CVE-2015-9297
The events-manager plugin before 5.6 for WordPress has XSS...
CVE-2015-9436
The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=termtree prefix or widgetid parameter...
CVE-2015-9343
The wp-rollback plugin before 1.2.3 for WordPress has CSRF...
CVE-2019-15838
The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789...
CVE-2011-5254
Unspecified vulnerability in the Connections plugin before 0.7.1.6 for WordPress has unknown impact and attack vectors...
CVE-2019-10456
A cross-site request forgery vulnerability in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials...
CVE-2012-6714
The count-per-day plugin before 3.2.3 for WordPress has XSS via search words...
CVE-2019-25144
The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.2.10 due to insufficient input sanitization. This makes it possible for unauthenticated attackers to inject arbitrary HTML in pages that execute if they can successfully trick a administrator...