217 matches found
CVE-2018-5292: Improper Neutralization of Input During Web Page Generation
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page...
CVE-2018-5290: Improper Limitation of a Pathname to a Restricted Directory
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page...
CVE-2018-5287: Improper Limitation of a Pathname to a Restricted Directory
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-about page...
CVE-2018-5286: Improper Neutralization of Input During Web Page Generation
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page...
CVE-2017-17780: Improper Neutralization of Input During Web Page Generation
The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication -...
CVE-2017-15810: Improper Neutralization of Input During Web Page Generation
The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php...
Cross site scripting
Cross-site scripting XSS vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrary web script or HTML via the orderid parameter in the galleryalbumsorting page to wp-admin/admin.php...
CVE-2014-8758: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrary web script or HTML via the orderid parameter in the galleryalbumsorting page to wp-admin/admin.php...
Sql injection
SQL Injection exists in /includes/event-management/index.php in the event-espresso-free aka Event Espresso Lite plugin v3.1.37.12.L for WordPress via the recurrenceid parameter to /wp-admin/admin.php...
CVE-2017-14125: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "id" parameter in an addedittheme task in the wpdevartgallerythemes page to wp-admin/admin.php...
CVE-2015-8353: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the objectname parameter in a rs-objectroleedit page to wp-admin/admin.php...
CVE-2017-12948: Improper Neutralization of Input During Web Page Generation
Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATHINFO to wp-admin/admin.php, related to PHPSELF...
CVE-2017-12068: Improper Neutralization of Input During Web Page Generation
The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an eladmincategories deletebulk action...
CVE-2017-9429: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php...
CVE-2017-9418: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php...
PT-2015-7576
Name of the Vulnerable Software and Affected Versions Pie Register plugin versions prior to 2.0.19 Description The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved via the select invitaion code bulk option or invi del id parameter in the...
PT-2015-7129
Name of the Vulnerable Software and Affected Versions Google Analyticator plugin versions prior to 6.4.9.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via vulnerable parameters in the google-analyticator page to wp-admin/admin.php. The vulnerable parameter...
PT-2015-7425
Name of the Vulnerable Software and Affected Versions Contact Form Generator plugin versions 2.0.1 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including creating, updating, or deleting fields, forms, or templates, ...
CVE-2015-6965: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 create a field, 2 update a field, 3 delete a field, 4 create a form, 5 update a...
