PT-2018-17059

Name of the Vulnerable Software and Affected Versions responsive-coming-soon-page plugin version 1.1.18 Description A security issue exists in the plugin, where cross-site scripting XSS is possible. This occurs via the coming-soon sub title parameter in the "wp-admin/admin.php" endpoint...

PT-2018-17057

Name of the Vulnerable Software and Affected Versions responsive-coming-soon-page plugin version 1.1.18 Description A Cross-Site Request Forgery CSRF issue was discovered in the responsive-coming-soon-page plugin for WordPress. The issue exists via the wp-admin/admin.php endpoint. Recommendations...

PT-2018-17063

Name of the Vulnerable Software and Affected Versions responsive-coming-soon-page plugin version 1.1.18 Description A security issue exists in the plugin, where cross-site scripting XSS is possible. This occurs via the social icon 1 parameter in the wp-admin/admin.php page. Recommendations For...

PT-2018-17072

Name of the Vulnerable Software and Affected Versions: booking-calendar plugin version 2.1.7 Description: A security issue was found in the booking-calendar plugin for WordPress, where a CSRF exists via the "wp-admin/admin.php" API endpoint. Recommendations: For version 2.1.7, update to a newer...

PT-2018-17058

Name of the Vulnerable Software and Affected Versions responsive-coming-soon-page plugin version 1.1.18 Description A security issue was found in the responsive-coming-soon-page plugin for WordPress. Cross-site scripting XSS exists through the coming-soon title parameter in the "wp-admin/admin.ph...

PT-2018-17065

Name of the Vulnerable Software and Affected Versions: responsive-coming-soon-page plugin version 1.1.18 Description: A security issue was found in the responsive-coming-soon-page plugin for WordPress. This issue allows for cross-site scripting XSS attacks through the bg color parameter in the...

PT-2018-17070

Name of the Vulnerable Software and Affected Versions: booking-calendar plugin version 2.1.7 Description: A security issue was found in the booking-calendar plugin for WordPress. This issue allows for cross-site scripting XSS attacks through the wp-admin/admin.php endpoint, specifically via the...

PT-2018-17071

Name of the Vulnerable Software and Affected Versions: booking-calendar plugin version 2.1.7 Description: A security issue was found in the booking-calendar plugin for WordPress. This issue allows for cross-site scripting XSS attacks through the form field5label parameter in the wp-admin/admin.ph...

PT-2018-17069

Name of the Vulnerable Software and Affected Versions: booking-calendar plugin version 2.1.7 Description: A security issue was found in the booking-calendar plugin for WordPress. This issue allows for cross-site scripting XSS attacks through the sale conditionscount parameter in the...

CVE-2018-5311

The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjooecaeoptionscustomcss parameter to the wp-admin/admin.php?page=tonjooexcerpt URI...

CVE-2018-5310: Improper Limitation of a Pathname to a Restricted Directory

In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-search-register URI...

CVE-2018-5311: Improper Neutralization of Input During Web Page Generation

The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjooecaeoptionscustomcss parameter to the wp-admin/admin.php?page=tonjooexcerpt URI...

WordPress GD Rating System plugin 2.3 - Directory Traversal vulnerability (3)

A third Directory Traversal vulnerability found by d4wner in WordPress GD Rating System plugin version 2.3. Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page. Solution 1/9/2018 - we were unable to find a patched version of this plugin...

PT-2018-16887

Name of the Vulnerable Software and Affected Versions Media from FTP plugin versions prior to 9.85 Description The issue exists in the Media from FTP plugin, where Directory Traversal is possible. This can be achieved via the searchdir parameter to the...

Directory traversal

The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tools page...

CVE-2018-5286

The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page...

CVE-2018-5293

The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-tools page...

PT-2018-16873

Name of the Vulnerable Software and Affected Versions GD Rating System plugin version 2.3 Description The issue allows for XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page. Recommendations For GD Rating System plugin version 2.3, consider disabling access t...

CVE-2018-5288: Improper Neutralization of Input During Web Page Generation

The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page...

CVE-2018-5289: Improper Limitation of a Pathname to a Restricted Directory

The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page...