CVE-2020-24314

Affected software: Fahad Mahmood RSS Feed Widget Plugin for WordPress, v2.7.9 and earlier. Vulnerability: Reflected XSS via the GET parameter "t" that is echoed into an input tag without sanitization. Impact: Attackers can craft a URL to trigger XSS (no exploitation details beyond this). Exploita...

CVE-2016-10991

The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion...

CVE-2016-10991

The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion...

Mail.ru: RCE on shared.mail.ru due to "widget" plugin

Confluence widget connector vulnerable to CVE-2019-3396 was available on shared.mail.ru...

WordPress Polls Widget Plugin 1.0.7 - SQL注入 漏洞

No description provided by source...

WordPress Altos Connect Widget Plugin <= 1.3.0 - Cross Site Scripting (XSS)

This plugin is prone to a cross site scripting vulnerability, because "PHPSELF" is printed without sanitization in a captcha demo page. Solution Update the plugin...

WordPress Wise Search Widget Plugin <= 1.1 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability via "s" parameter. Solution Upgrade this plugin...

WordPress Quick Post Widget Plugin <= 1.9.1 - Multiple CSRF

This plugin is prone to a cross site request forgery vulnerability. Solution Update plugin...

Server side request forgery (ssrf)

Server-side request forgery SSRF vulnerability in proxy.php in the jRSS Widget plugin 1.2 and earlier for WordPress allows remote attackers to trigger outbound requests and enumerate open ports via the url parameter...

CVE-2014-9292

Server-side request forgery SSRF vulnerability in proxy.php in the jRSS Widget plugin 1.2 and earlier for WordPress allows remote attackers to trigger outbound requests and enumerate open ports via the url parameter...

WordPress jRSS Widget Plugin <= 1.2 - SSRF

This vulnerability is in the proxy.php. It allows the attackers to trigger outbound requests and enumerate open ports via the "URL" parameter. Solution Update the plugin...

WordPress Flash Player Widget Plugin - Content Spoofing

This plugin is prone to a content spoofing vulnerability in dewplayer.swf. Solution Update the plugin...

CVE-2014-4516

The CVE-2014-4516 entry affects the WordPress BIC Media Widget plugin (

CVE-2014-4516

Cross-site scripting XSS vulnerability in bicm-carousel-preview.php in the BIC Media Widget plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the param parameter...

CVE-2013-2704

The CVE-2013-2704 entry concerns the WordPress plugin Dropdown Menu Widget (version 1.9.1). The vulnerability is described as a Cross-Site Request Forgery (CSRF) that allows remote attackers to hijack the authentication of arbitrary users for requests that insert Cross-Site Scripting (XSS) sequen...

WordPress FCChat Widget Plugin 2.2.x - Arbitrary File Upload

FCChat Widget plugin's "Upload.php" is prone to an arbitrary file upload vulnerability. Restricted access to this script is not properly realized. In that way an attacker can to upload files containing malicious PHP code and run it in the context of the web server process. Other attacks are also...

WordPress Rating Widget Plugin 1.3.1 - Multiple Cross-Site Scripting Vulnerabilities

Rating Widget plugin is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based authentication...