1285 matches found
PT-2019-7382
Name of the Vulnerable Software and Affected Versions PlugNedit Adaptive Editor plugin versions prior to 6.2.0 Description The issue concerns a cross-site scripting XSS problem. It affects the wp-admin/admin-ajax.php endpoint, specifically when the action parameter is set to "simple fields field...
PT-2019-7381
Name of the Vulnerable Software and Affected Versions PlugNedit Adaptive Editor plugin versions prior to 6.2.0 for WordPress Description The issue concerns a CSRF with resultant XSS. It is exploited via the "wp-admin/admin-ajax.php?action=simple fields field type post dialog load" endpoint, using...
PT-2019-7379
Name of the Vulnerable Software and Affected Versions soundcloud-is-gold plugin versions prior to 2.3.2 Description The issue concerns a Cross-Site Scripting XSS flaw. It is exploited via the id parameter in the "wp-admin/admin-ajax.php?action=get soundcloud player" API endpoint. Recommendations...
PT-2019-7397
Name of the Vulnerable Software and Affected Versions display-widgets plugin versions prior to 2.04 Description The issue allows for XSS via the "wp-admin/admin-ajax.php?action=dw show widget" API endpoint, specifically through the id base, widget number, or instance parameters. Recommendations F...
PT-2019-7404
Name of the Vulnerable Software and Affected Versions unite-gallery-lite plugin versions prior to 1.5 Description The issue concerns a unite-gallery-lite plugin for WordPress, where there is a potential for CSRF and SQL injection attacks. This can occur via the wp-admin/admin-ajax.php endpoint in...
PT-2019-7380
Name of the Vulnerable Software and Affected Versions olevmedia-shortcodes plugin versions prior to 1.1.9 Description The issue concerns a CSRF with resultant XSS in the olevmedia-shortcodes plugin for WordPress. This occurs via the "wp-admin/admin-ajax.php?action=omsc popup" API endpoint,...
CVE-2015-9423: Improper Neutralization of Input During Web Page Generation
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simplefieldsfieldtypepostdialogload PlugneditBGColor, PlugneditEditorMargin, plugneditwidth, pnemedcount, or plugneditcontent parameters...
CVE-2015-9420: Improper Neutralization of Input During Web Page Generation
The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=getsoundcloudplayer id parameter...
CVE-2015-9422: Cross-Site Request Forgery (CSRF)
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simplefieldsfieldtypepostdialogload plugneditwidth, pnemedcount, PlugneditBGColor, PlugneditEditorMargin, or plugneditcontent parameters...
CVE-2015-9426: Improper Neutralization of Input During Web Page Generation
The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=miceditorwindow postId parameter...
CVE-2015-9445: Cross-Site Request Forgery (CSRF)
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegalleryajaxaction operation...
CVE-2015-9436: Improper Neutralization of Input During Web Page Generation
The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=termtree prefix or widgetid parameter...
CVE-2015-9446: Improper Neutralization of Special Elements used in an SQL Command
The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via datagalleryID to wp-admin/admin-ajax.php...
CVE-2015-9438: Improper Neutralization of Input During Web Page Generation
The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dwshowwidget idbase, widgetnumber, or instance parameter...
PT-2019-14746
Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue concerns a CSRF vulnerability in the admin ajax.php endpoint, specifically with the action=savexml and tab=vodplay parameters. This allows for potential unauthorized actions. Recommendations For...
CVE-2015-9394
The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=packageaddnew to wp-admin/admin-ajax.php...
CVE-2015-9394
The CVE concerns the WordPress plugin Users Ultra Membership (plugin) before 1.5.63. A CSRF vulnerability exists via action=package_add_new to wp-admin/admin-ajax.php, enabling an attacker to perform actions on behalf of authenticated users. Exploitation details are not provided beyond the CSRF d...
PT-2019-7353
Name of the Vulnerable Software and Affected Versions users-ultra plugin versions prior to 1.5.63 for WordPress Description The issue concerns a CSRF vulnerability. It can be exploited via the action=package add new parameter to the "/wp-admin/admin-ajax.php" API endpoint. Recommendations For...