CVE-2025-1559

The CC-IMG-Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'img' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

EUVD-2010-2961

Malware in sbrugna...

EUVD-2007-0542

Malware in sbrugna...

EUVD-2016-3999

Malware in sbrugna...

EUVD-2007-1502

Malware in sbrugna...

CVE-2025-9883: Cross-Site Request Forgery (CSRF)

The Browser Sniff plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web script...

CVE-2011-1129

Cross-site scripting XSS vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum SMF before 1.1.13, and 2.x before 2.0 RC5, might allow remote authenticated users to inject arbitrary web script or HTML via a saveitems action...

CVE-2006-7190

Cross-site scripting XSS vulnerability in cgi-bin/user-lib/topics.pl in web-app.net WebAPP before 20060515 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the viewnews function, related to use of doubbctopic instead of doubbc...

CVE-2025-4198: Cross-Site Request Forgery (CSRF)

The Alink Tap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the 'alink-tap' page. This makes it possible for unauthenticated attackers to update settings and inject malicious we...

CVE-2024-13522: Cross-Site Request Forgery (CSRF)

The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. This is due to missing or incorrect nonce validation on the 'magayo-lottery-results' page. This makes it possible for unauthenticated attackers to update...

CVE-2024-13749: Improper Neutralization of Input During Web Page Generation

The StaffList plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing or incorrect nonce validation on the 'stafflist' page. This makes it possible for unauthenticated attackers to update settings and inject malicious we...

CVE-2024-13510: Cross-Site Request Forgery (CSRF)

The ShopSite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.10. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts...

PT-2024-17660

Name of the Vulnerable Software and Affected Versions Hello In All Languages plugin for WordPress versions up to, and including, 1.0.6 Description The issue is due to missing or incorrect nonce validation on a function, allowing unauthenticated attackers to update settings and inject malicious we...

PT-2024-16920

Name of the Vulnerable Software and Affected Versions Clickbank WordPress Plugin Storefront versions up to, and including, 1.7 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation via the cs menu page. This allows unauthenticated attackers to...

SUSE CVE-2016-4856

Cross-site scripting vulnerability in Splunk Enterprise 6.3.x prior to 6.3.5 and Splunk Light 6.3.x prior to 6.3.5 allows attacker with administrator rights to inject arbitrary web script or HTML via unspecified vectors...