CVE-2015-4153: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a loadtemplate action to wp-admin/admin-ajax.php...

CVE-2014-8606: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. dot dot in the file parameter in a jsonreturn action in the xclonershow page to wp-admin/admin-ajax.php...

CVE-2015-4109: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 datatarget or 2 datavote parameter in a ratingvote wpajaxnoprivratingvote action to wp-admin/admin-ajax.php...

CVE-2015-4038: Undefined Security Weakness

The WP Membership plugin 1.2.3 for WordPress allows remote authenticated users to gain administrator privileges via an ivmembershipupdateusersettings action to wp-admin/admin-ajax.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a checkstat action to wp-admin/admin-ajax.php...

CVE-2015-4084: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a checkstat action to wp-admin/admin-ajax.php...

Wordpress Theme Nevada Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Theme Nevada Arbitrary File Download Vulnerability Date: 01/05/2015 Exploit Author: X-Line Vendor Homepage: http://themeforest.unitedthemes.com/wpversions/nevada/ Contact : http://www.root-me.org/X-Line-24646 Tested on...

WordPress Rockhoist Ratings Plugin <= 1.2.2 - SQL Injection

This plugin is prone to an SQL injection vulnerability in wp-admin/admin-ajax.php postID parameter. Solution Update the plugin...

WordPress Better WP Security Plugin <= 3.6.3 - Stored XSS

This plugin is prone to /wp-admin/admin-ajax.php license parameter stored XSS weakness. Solution Upgrade the plugin...

CVE-2014-9311

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

Cross site scripting

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

CVE-2014-9311

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

CVE-2014-9311: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

WordPress Plugin Video Gallery 2.8 - SQL Injection

WordPress Plugin Video Gallery 2.8 - SQL Injection Exploit Title : Wordpress Video Gallery 2.8 SQL Injection Vulnerabilitiey Exploit Author : Claudio Viviani Vendor Homepage : http://www.apptha.com/category/extension/Wordpress/Video-Gallery Software Link :...

CVE-2015-2220: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the ninjaformsfield1 parameter in a ninjaformsajaxsubmit action to wp-admin/admin-ajax.php or 2 remote administrators to injec...

CVE-2015-2218: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the wpajaxsaveitem function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 itemname or 2 itemcustomcss parameter in a...

Sql injection

SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the catid parameter in a spiderbigcalendarmonth action to wp-admin/admin-ajax.php...

CVE-2015-2196: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the catid parameter in a spiderbigcalendarmonth action to wp-admin/admin-ajax.php...

CVE-2015-2199: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow 1 remote authenticated users to execute arbitrary SQL commands via the itemid parameter in a wonderpluginaudiosaveitem action to wp-admin/admin-ajax.php or remote administrators to execut...

Sql injection

SQL injection vulnerability in the ajaxsurvey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the surveyid parameter in an ajaxsurvey action to wp-admin/admin-ajax.php...