217 matches found
CVE-2019-9912
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...
CVE-2019-9910: Improper Neutralization of Input During Web Page Generation
The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS...
CVE-2019-9914: Improper Neutralization of Input During Web Page Generation
The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes pollid XSS...
CVE-2019-9912: Improper Neutralization of Input During Web Page Generation
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...
CVE-2019-9911: Improper Neutralization of Input During Web Page Generation
The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS...
CVE-2019-9913: Improper Neutralization of Input During Web Page Generation
The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS...
CVE-2019-9646: Improper Neutralization of Input During Web Page Generation
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cpadminintedition.inc.php in the "custom edition area."...
CVE-2019-9575: Improper Neutralization of Input During Web Page Generation
The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlwquizresults quizid XSS...
CVE-2019-9576: Improper Neutralization of Input During Web Page Generation
The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS...
CVE-2019-9568: Improper Neutralization of Special Elements used in an SQL Command
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry parameter if the attacker has the delete permission...
CVE-2016-10736: Improper Neutralization of Input During Web Page Generation
The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpspmessageclass parameter...
Design/Logic Flaw
XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page request...
CVE-2018-18069: Improper Neutralization of Input During Web Page Generation
processforms in the WPML aka sitepress-multilingual-cms plugin through 3.6.3 for WordPress has XSS via any localefilename parameter such as localefilenameen in an authenticated theme-localization.php request to wp-admin/admin.php...
CVE-2018-17140: Improper Neutralization of Input During Web Page Generation
The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a qlinsert action to wp-admin/admin.php...
CVE-2018-15877: Improper Neutralization of Special Elements used in an OS Command
The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainviewactivitymonitor&tab=activitytools request...
CVE-2018-10234: Improper Neutralization of Input During Web Page Generation
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=umoptions§ion=account page...
CVE-2018-5687
NewsBee (CMS) vulnerability CVE-2018-5687: a stored/reflected XSS is possible via the Company Name field in Settings (admin/admin.php). The description across sources consistently states an XSS vulnerability in NewsBee’s Settings interface. Root cause: improper sanitization/escaping of input in t...
CVE-2018-5687: Improper Neutralization of Input During Web Page Generation
NewsBee allows XSS via the Company Name field in the Settings under admin/admin.php...
CVE-2018-5673: Cross-Site Request Forgery (CSRF)
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php...
CVE-2018-5659: Improper Neutralization of Input During Web Page Generation
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soontitle parameter...