CVE-2020-8498

XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users e.g., ones who have t...

CVE-2020-8498: Improper Neutralization of Input During Web Page Generation

XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users e.g., ones who have t...

CVE-2020-6859: Authorization Bypass Through User-Controlled Key

Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified userid parameter. This is related to ajaximageupload and...

CVE-2014-5140

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : colon characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book...

CVE-2014-5140: Improper Neutralization of Special Elements used in an SQL Command

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly handle : colon characters, which allows remote authenticated users to conduct SQL injection attacks via the First name and Last name fields in the address book...

CVE-2014-8337: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified...

CVE-2019-20041

wpksesbadprotocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring...

CVE-2019-20041: Improper Input Validation

wpksesbadprotocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript substring...

CVE-2019-20042: Improper Neutralization of Input During Web Page Generation

In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wptargetedlinkrel can be used in a particular way to result in a stored cross-site scripting XSS vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a mino...

CVE-2019-20043: Improper Privilege Management

In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this...

CVE-2012-1001

Multiple cross-site scripting XSS vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the 1 content parameter to includes/ajax.php or 2 body parameter to includes/error.php...

CVE-2012-1001: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Chyrp before 2.1.2 and before 2.5 Beta 2 allow remote attackers to inject arbitrary web script or HTML via the 1 content parameter to includes/ajax.php or 2 body parameter to includes/error.php...

PT-2019-6731

Name of the Vulnerable Software and Affected Versions Chyrp versions prior to 2.1.2 Chyrp versions prior to 2.5 Beta 2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the content parameter to "includes/ajax.php" or the body parameter ...

visagehall.ru Cross Site Scripting vulnerability

Security Researcher g0bl1nsec Helped patch 3650 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting visagehall.ru website and its users. Following coordinate...

CVE-2019-17235

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure...

CVE-2019-17237

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF...

CVE-2019-17236

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS...

CVE-2019-17235

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure...

CVE-2019-17234

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion...

CVE-2019-17236: Improper Neutralization of Input During Web Page Generation

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS...