PT-2018-14420

Name of the Vulnerable Software and Affected Versions Schiocco Support Board - Chat And Help Desk plugin version 1.2.3 Description A Stored XSS issue has been found in the file upload areas of the Chat and Help Desk sections. This is achieved via the msg parameter in the "/wp-admin/admin-ajax.php...

WordPress Plugin Support Board 1.2.3 - Cross-Site Scripting

WordPress Plugin Support Board 1.2.3 - Cross-Site Scripting Exploit Title: Wordpress Plugin Support Board 1.2.3 - Cross-Site Scripting Date: 2018-10-16 Exploit Author: Ismail Tasdelen Vendor Homepage: https://schiocco.com/ Software Link : https://board.support/ Software : Support Board - Chat And...

Design/Logic Flaw

The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userproshortcodetemplate action to wp-admin/admin-ajax.php...

CVE-2018-16285

The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userproshortcodetemplate action to wp-admin/admin-ajax.php...

CVE-2018-16285: Improper Neutralization of Input During Web Page Generation

The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userproshortcodetemplate action to wp-admin/admin-ajax.php...

PT-2018-13463

Name of the Vulnerable Software and Affected Versions UserPro plugin versions prior to 4.9.24 Description The issue allows for XSS via the shortcode parameter in a userpro shortcode template action to the "/wp-admin/admin-ajax.php" API endpoint. Recommendations For versions prior to 4.9.24, updat...

CVE-2018-16159

The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the templateid parameter in a wp-admin/admin-ajax.php wpgvdoajaxfronttemplate request...

PT-2018-13432

Name of the Vulnerable Software and Affected Versions The Gift Vouchers plugin versions prior to 2.0.2 Description The issue allows SQL Injection via the template id parameter in a "wp-admin/admin-ajax.php" wpgv doajax front template request. This could potentially lead to unauthorized access to...

CVE-2018-16159: Improper Neutralization of Special Elements used in an SQL Command

The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the templateid parameter in a wp-admin/admin-ajax.php wpgvdoajaxfronttemplate request...

themesdad.com XSS vulnerability

Open Bug Bounty ID: OBB-669086 Description| Value ---|--- Affected Website:| themesdad.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

downloadnulled.pw XSS vulnerability

Open Bug Bounty ID: OBB-669047 Description| Value ---|--- Affected Website:| downloadnulled.pw Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

freethemes.space XSS vulnerability

Open Bug Bounty ID: OBB-669025 Description| Value ---|--- Affected Website:| freethemes.space Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

hirezstudios.com XSS vulnerability

Open Bug Bounty ID: OBB-665747 Description| Value ---|--- Affected Website:| hirezstudios.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

satoriz.fr XSS vulnerability

Open Bug Bounty ID: OBB-663779 Description| Value ---|--- Affected Website:| satoriz.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ageliesergasias.gr XSS vulnerability

Open Bug Bounty ID: OBB-654798 Description| Value ---|--- Affected Website:| ageliesergasias.gr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| newspaper theme by tagdiv 8.1.1 Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

Design/Logic Flaw

The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fwdata id1, fwdata id2, fwdata id3, fwdata id4, or email field of the contact form, exploitable with an fwsendemail action to wp-admin/admin-ajax.php...

CVE-2018-14430

The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fwdata id1, fwdata id2, fwdata id3, fwdata id4, or email field of the contact form, exploitable with an fwsendemail action to wp-admin/admin-ajax.php...

PT-2018-12508

Name of the Vulnerable Software and Affected Versions Mondula Multi Step Form plugin versions prior to 1.2.6 Description The issue allows for XSS exploitation via specific fields in the contact form, including fw data id1, fw data id2, fw data id3, fw data id4, or the email field. This can be...

CVE-2018-14430: Improper Neutralization of Input During Web Page Generation

The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fwdata id1, fwdata id2, fwdata id3, fwdata id4, or email field of the contact form, exploitable with an fwsendemail action to wp-admin/admin-ajax.php...

enggwave.com XSS vulnerability

Open Bug Bounty ID: OBB-652984 Description| Value ---|--- Affected Website:| enggwave.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| newspaper theme by tagdiv 8.1.1 Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6....