32 matches found
Better Anchor Links <= 1.7.5 - Cross-Site Request Forgery via admin/options.php
Description The Better Anchor Links plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.5. This is due to missing or incorrect nonce validation on the admin/options.php file. This makes it possible for unauthenticated attackers to update the...
GHSA-GPQ5-VQVX-CH9J WPGlobus plugin Stored XSS & CSRF security vulnerability
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoptionenabledlanguagesen or wpglobusoptionenabledlanguagesfr or any other language parameter to wp-admin/options.php...
GHSA-35MH-F6P8-PJ2C WPGlobus plugin Stored XSS & CSRF security vulnerability
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoptionmorelanguages parameter to wp-admin/options.php...
GHSA-V9H6-53FX-GH4J WPGlobus plugin Stored XSS & CSRF security vulnerability
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoptionbrowserredirectredirectbylanguage parameter to wp-admin/options.php...
Advance Search < 1.1.3 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the wpasid parameter found in the /inc/admin/views/html-advance-search-admin-options.php file which allows attackers to inject arbitrary web scripts...
CVE-2015-9409: Cross-Site Request Forgery (CSRF)
The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php...
CVE-2018-5363
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoptionenabledlanguagesen or wpglobusoptionenabledlanguagesfr or any other language parameter to wp-admin/options.php...
CVE-2018-5364
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoptionbrowserredirectredirectbylanguage parameter to wp-admin/options.php...
CVE-2018-5366
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoptionmorelanguages parameter to wp-admin/options.php...
CVE-2018-5365
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoptionselectorwplistpagesshowselector parameter to wp-admin/options.php...
CVE-2018-5364
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoptionbrowserredirectredirectbylanguage parameter to wp-admin/options.php...
CVE-2018-5364: Improper Neutralization of Input During Web Page Generation
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoptionbrowserredirectredirectbylanguage parameter to wp-admin/options.php...
CVE-2018-5362: Improper Neutralization of Input During Web Page Generation
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoptionposttypepage parameter to wp-admin/options.php...
CVE-2018-5366: Improper Neutralization of Input During Web Page Generation
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoptionmorelanguages parameter to wp-admin/options.php...
CVE-2018-5367: Improper Neutralization of Input During Web Page Generation
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoptionposttypepost parameter to wp-admin/options.php...
CVE-2018-5361: Cross-Site Request Forgery (CSRF)
The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php...
CVE-2018-5365: Improper Neutralization of Input During Web Page Generation
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoptionselectorwplistpagesshowselector parameter to wp-admin/options.php...
CVE-2018-5363: Improper Neutralization of Input During Web Page Generation
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobusoptionenabledlanguagesen or wpglobusoptionenabledlanguagesfr or any other language parameter to wp-admin/options.php...
CVE-2015-1614: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 imagemetadatacruncheralt or 2...
CVE-2014-4847
Cross-site scripting XSS vulnerability in the Random Banner plugin 1.1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the buffercodeRBannerurlbanner1 parameter in an update action to wp-admin/options.php...