CVE-2019-14791: Improper Neutralization of Input During Web Page Generation

The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter...

CVE-2019-14773

admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion...

CVE-2019-14773: Undefined Security Weakness

admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion...

CVE-2019-9978: Improper Neutralization of Input During Web Page Generation

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swpdebug=loadoptions swpurl parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro...

CVE-2019-9603: Cross-Site Request Forgery (CSRF)

MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891...

WordPress_4.9.8_RCE_POC

Summary A simple PoC for WordPress RCE author priviledge, re...

CVE-2018-19564: Improper Neutralization of Input During Web Page Generation

Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters ikcfclient and ikcfposition and ikcfother have Cross-Site Scripting...

PT-2018-15008

Name of the Vulnerable Software and Affected Versions Easy Testimonials plugin version 3.2 for WordPress Description A Stored XSS issue was found, allowing for Cross-Site Scripting through the ikcf client, ikcf position, and ikcf other parameters in the wp-admin/post.php endpoint. Recommendations...

CVE-2018-18890: Improper Limitation of a Pathname to a Restricted Directory

MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename...

CVE-2018-18891: Improper Authentication

MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late...

CVE-2018-16298: Improper Neutralization of Input During Web Page Generation

An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request...

CVE-2018-12895: Improper Limitation of a Pathname to a Restricted Directory

WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the...

PT-2018-11457

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.9.7 Description The issue allows Author users to execute arbitrary code by leveraging directory traversal in the "wp-admin/post.php" endpoint, specifically the thumb parameter, which is passed to the PHP unlink...

CVE-2018-11632

The CVE-2018-11632 issue affects the WordPress plugin Add Social Share Messenger Buttons Whatsapp and Viber (version 1.0.8) by lack of nonce/capability checks in whatsapp_share_setting_add_update(), enabling CSRF to change settings when an admin visits a crafted URL via spear phishing/social engi...

CVE-2018-11632: Cross-Site Request Forgery (CSRF)

An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings via...

CVE-2018-10423: Exposure of Sensitive Information to an Unauthorized Actor

mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes available after posting an article...

MiniCMS Information Disclosure Vulnerability (CNVD-2018-08993)

MiniCMS is a mini content management system CMS designed for personal websites. An information disclosure vulnerability exists in the mc-admin/post.php file in MiniCMS version 1.10. A remote attacker can exploit this vulnerability to view all files located in the web root path...

CVE-2018-5312: Improper Neutralization of Input During Web Page Generation

The tabs-responsive plugin 1.8.0 for WordPress has XSS via the posttitle parameter to wp-admin/post.php...

CVE-2018-5212: Improper Neutralization of Input During Web Page Generation

The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdmuploadthumbnail aka File Thumbnail parameter in an edit action to wp-admin/post.php...

CVE-2018-5213: Improper Neutralization of Input During Web Page Generation

The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdmupload aka Downloadable File parameter in an edit action to wp-admin/post.php...