PT-2019-9546

Name of the Vulnerable Software and Affected Versions Tribulant Slideshow Gallery plugin version 1.6.8 Description The issue exists due to SQL Injection in the Tribulant Slideshow Gallery plugin for WordPress. This can be exploited via the "wp-admin/admin.php?page=slideshow-galleries&method=save"...

PT-2019-9547

Name of the Vulnerable Software and Affected Versions Tribulant Slideshow Gallery plugin version 1.6.8 Description A security issue exists in the Tribulant Slideshow Gallery plugin for WordPress, allowing for XSS attacks. This is possible through the...

PT-2019-9545

Name of the Vulnerable Software and Affected Versions Tribulant Slideshow Gallery plugin version 1.6.8 Description A security issue exists in the Tribulant Slideshow Gallery plugin for WordPress, allowing for XSS attacks. This is possible via the...

PT-2019-19932

Name of the Vulnerable Software and Affected Versions yop-poll plugin versions prior to 6.0.3 Description The issue affects the yop-poll plugin, allowing for XSS through the poll id parameter in the "view-votes" action, accessible via the /wp-admin/admin.php?page=yop-polls&action=view-votes...

CVE-2019-9913: Improper Neutralization of Input During Web Page Generation

The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS...

PT-2019-19721

Name of the Vulnerable Software and Affected Versions Blog2Social plugin versions prior to 5.0.3 Description The issue allows for XSS in the wp-admin/admin.php?page=blog2social-ship API endpoint. No information is provided about the estimated number of potentially affected devices or real-world...

CVE-2019-9576: Improper Neutralization of Input During Web Page Generation

The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS...

CVE-2019-9568: Improper Neutralization of Special Elements used in an SQL Command

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry parameter if the attacker has the delete permission...

PT-2019-7535

Name of the Vulnerable Software and Affected Versions Social Pug - Easy Social Share Buttons plugin versions prior to 1.2.6 Description The issue allows for XSS via the dpsp message class parameter in the "wp-admin/admin.php?page=dpsp-toolkit" API endpoint. Recommendations For Social Pug - Easy...

PT-2018-9774

Name of the Vulnerable Software and Affected Versions: User Profile & Membership plugin versions prior to 2.0.11 Description: An issue exists in the User Profile & Membership plugin for WordPress, where authenticated cross-site scripting is possible. This is due to a vulnerability in the Account...

Design/Logic Flaw

The management panel in Piwigo 2.9.3 has stored XSS via the virtualname parameter in a /admin.php?page=catlist request, a different issue than CVE-2017-9836. CSRF exploitation, related to CVE-2017-10681, may be possible...

CVE-2018-7723

CVE-2018-7723 affects Piwigo 2.9.3: a stored XSS in the admin panel via the virtual_name parameter in /admin.php?page=cat_list (distinct from CVE-2017-9836). The description notes CSRF exploitation may be possible, related to CVE-2017-10681. CVSS vectors are provided (3.5/LOW for CVSS2, 5.4/MEDIU...

PT-2018-18237

The management panel in Piwigo 2.9.3 has stored XSS via the virtual name parameter in a /admin.php?page=cat list request, a different issue than CVE-2017-9836. CSRF exploitation, related to CVE-2017-10681, may be possible...

CVE-2018-7723: Improper Neutralization of Input During Web Page Generation

The management panel in Piwigo 2.9.3 has stored XSS via the virtualname parameter in a /admin.php?page=catlist request, a different issue than CVE-2017-9836. CSRF exploitation, related to CVE-2017-10681, may be possible...

Sql injection

Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator...

CVE-2018-5311

The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjooecaeoptionscustomcss parameter to the wp-admin/admin.php?page=tonjooexcerpt URI...

CVE-2018-5311: Improper Neutralization of Input During Web Page Generation

The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjooecaeoptionscustomcss parameter to the wp-admin/admin.php?page=tonjooexcerpt URI...

PT-2018-16887

Name of the Vulnerable Software and Affected Versions Media from FTP plugin versions prior to 9.85 Description The issue exists in the Media from FTP plugin, where Directory Traversal is possible. This can be achieved via the searchdir parameter to the...

CVE-2018-5310: Improper Limitation of a Pathname to a Restricted Directory

In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-search-register URI...

CVE-2017-17827

Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration&section=main or /admin.php?page=batchmanager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions...