9891 matches found
CVE-2019-15841
The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajaxwooinfobannerpostclick, ajaxwooinfobannerpostxout, or ajaxfbtogglevisibility...
CVE-2019-15841
The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajaxwooinfobannerpostclick, ajaxwooinfobannerpostxout, or ajaxfbtogglevisibility...
CVE-2019-15771
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
Code injection
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15774
The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15773
The nd-travel plugin before 1.7 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
Code injection
The nd-learning plugin before 4.8 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
Code injection
The nd-donations plugin before 1.4 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
Code injection
The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
Code injection
The nd-travel plugin before 1.7 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15774
ND Booking (WordPress plugin)
CVE-2019-15774
The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15775
The nd-learning plugin before 4.8 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15775
CVE-2019-15775 affects the WordPress nd-learning plugin (prior to version 4.8). It exposes a nopriv_ AJAX action that can modify the siteurl setting, enabling unauthenticated modification of site configuration. Impact as documented: potential compromise of site URL, with CVSS v3 base score 6.1 (M...
CVE-2019-15773
The nd-travel plugin before 1.7 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15772
The CVE-2019-15772 issue affects the WordPress nd-donations plugin prior to version 1.4. It exposes a nopriv_ AJAX action that allows modification of the siteurl setting. This unauthenticated capability can enable an attacker to alter the site’s URL configuration, depending on the vulnerable envi...
CVE-2019-15647
The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulkactionlistener remote code execution...
WordPress advanced-ajax-page-loader plugin permissions permission and access control issues vulnerability
WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. advanced-ajax-page-loader is an AJAX page loading plugin used in it. The WordPress advanced-ajax-page-loader plugin is...