CVE-2016-10929

The CVE-2016-10929 entry concerns the WordPress plugin “advanced-ajax-page-loader” prior to version 2.7.7. The vulnerability is that there is no protection against reading uploaded files when the user is not logged in, enabling unauthenticated access to uploaded content. The available connected d...

CVE-2016-10926

The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php...

CVE-2015-9337

The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX...

Server side request forgery (ssrf)

The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php...

Server side request forgery (ssrf)

The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php...

CVE-2015-9337

The CVE concerns the WordPress plugin Profile Builder. Before version 2.1.4, it has no access control for activating or deactivating addons via AJAX, enabling unauthorized addon management and potentially partial integrity impact. Affected software: WordPress Profile Builder plugin (pre-2.1.4). R...

CVE-2015-9337

The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX...

CVE-2016-10927

CVE-2016-10927 affects the WordPress plugin nelio-ab-testing (pre-4.5.11). The vulnerability is an SSRF in ajax/iesupport.php, with CVSSv3 base score 10.0 (CRITICAL) and CVSSv2 base score 6.4 (MEDIUM). Impact indicators shown: high confidentiality and integrity impact, no availability impact; exp...

CVE-2016-10926

The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php...

CVE-2019-15045

AjaxDomainServlet in Zoho ManageEngine ServiceDesk Plus 10 allows User Enumeration. NOTE: the vendor's position is that this is intended functionality...

PT-2019-7053 · WordPress · Cforms2

Name of the Vulnerable Software and Affected Versions: cforms2 plugin versions prior to 13.2 Description: The issue concerns a cross-site scripting XSS problem in the lib ajax.php file of the cforms2 plugin for WordPress. Recommendations: For versions prior to 13.2, update to version 13.2 or late...

CVE-2016-10895

The option-tree plugin before 2.6.0 for WordPress has XSS via an addlistitem or addsociallinks AJAX request...

CVE-2016-10895

The option-tree plugin before 2.6.0 for WordPress has XSS via an addlistitem or addsociallinks AJAX request...

Cross site request forgery (csrf)

The option-tree plugin before 2.6.0 for WordPress has XSS via an addlistitem or addsociallinks AJAX request...

CVE-2016-10895

The option-tree plugin before 2.6.0 for WordPress has XSS via an addlistitem or addsociallinks AJAX request...

CVE-2016-10893

The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests...

Cross site scripting

The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests...

CVE-2016-10893

The CVE-2016-10893 entry concerns the WordPress Crayon Syntax Highlighter plugin. Affected software: crayon-syntax-highlighter plugin for WordPress, prior to version 2.8.4. Root cause: multiple XSS (cross-site scripting) flaws exploitable via AJAX requests. Impact: client-side code execution risk...

CVE-2016-10893

The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests...

WordPress Tribulant Newsletters Plugin Path Traversal Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Tribulant Newsletters plugin is a full-featured newsletter plugin used in it. A path traversal vulnerability exists in the WordPress...