CVE-2016-10982: Cross-Site Request Forgery (CSRF)

The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvcsettings CSRF...

PT-2019-7782

Name of the Vulnerable Software and Affected Versions leenkme plugin versions prior to 2.6.0 Description The issue concerns a CSRF problem in the leenkme plugin for WordPress. The affected endpoint is "wp-admin/admin.php?page=leenkme facebook". Recommendations For versions prior to 2.6.0, update ...

PT-2019-7785

Name of the Vulnerable Software and Affected Versions music-store plugin versions prior to 1.0.43 Description The issue allows for XSS via the "from year" parameter in the "/wp-admin/admin.php?page=music-store-menu-reports" API endpoint. Recommendations For music-store plugin versions prior to...

Design/Logic Flaw

The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter...

CVE-2019-13363

admin.php?page=notificationbymail in Piwigo 2.9.5 has XSS via the nbmsendhtmlmail, nbmsendmailas, nbmsenddetailedcontent, nbmcomplementarymailcontent, nbmsendrecentpostdates, or paramsubmit parameter. This is exploitable via CSRF...

Design/Logic Flaw

The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter...

CVE-2017-18613: Improper Neutralization of Input During Web Page Generation

The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter...

PT-2019-7745

Name of the Vulnerable Software and Affected Versions quotes-collection plugin versions prior to 2.0.6 Description The issue concerns a Cross-Site Scripting XSS vulnerability. It affects the quotes-collection plugin for WordPress, specifically via the wp-admin/admin.php?page=quotes-collection pag...

CVE-2019-15829

The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS...

PT-2019-14418

Name of the Vulnerable Software and Affected Versions photoblocks-grid-gallery plugin versions prior to 1.1.33 Description The issue concerns a Cross-Site Scripting XSS flaw. The "wp-admin/admin.php?page=photoblocks-edit&id=" endpoint is vulnerable to XSS attacks. The id parameter is implicated i...

CVE-2019-14789

The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter...

CVE-2019-14789: Improper Neutralization of Input During Web Page Generation

The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter...

PT-2019-4687

Name of the Vulnerable Software and Affected Versions svg-vector-icon-plugin aka WP SVG Icons versions through 3.2.1 Description The issue concerns the mishandling of Custom Icon uploads in the svg-vector-icon-plugin, allowing for the upload of a ZIP archive containing a .php file due to...

CVE-2016-10865: Cross-Site Request Forgery (CSRF)

The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery CSRF via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS...

PT-2019-7661

Name of the Vulnerable Software and Affected Versions Lightbox Plus Colorbox plugin versions prior to 2.8 Description The issue concerns cross-site request forgery CSRF that can lead to resultant width XSS. This occurs via the "wp-admin/admin.php?page=lightboxplus" API endpoint. Recommendations F...

PT-2019-13830

Name of the Vulnerable Software and Affected Versions CP Contact Form with PayPal plugin versions prior to 1.2.99 Description The issue concerns a Cross-Site Scripting XSS flaw in the publishing wizard of the plugin. This is accessible via the "wp-admin/admin.php?page=cp contact form...

CVE-2019-14679: Cross-Site Request Forgery (CSRF)

core/views/arpriceimportexport.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arpliteimportexport CSRF...

PT-2019-5819

Name of the Vulnerable Software and Affected Versions ARPrice Lite plugin version 2.2 for WordPress Description The issue is related to insufficient protection against CSRF requests in the ARPrice Lite plugin for WordPress. This can allow a remote attacker to perform a CSRF attack. The specific...

CVE-2019-14774: Improper Neutralization of Input During Web Page Generation

The woo-variation-swatches aka Variation Swatches for WooCommerce plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter...

PT-2019-13279

Name of the Vulnerable Software and Affected Versions CRUDLab WP Like Button plugin versions prior to 1.6.1 Description The issue allows unauthenticated attackers to change settings due to an authentication bypass. The contains function in wp like button.php did not check if the current request i...