CVE-2017-20091

A vulnerability was found in File Manager Plugin 3.0.1. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely...

CVE-2019-15868

The affiliates-manager plugin before 2.6.6 for WordPress has CSRF...

CVE-2013-7477

The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form...

CVE-2015-9298

The events-manager plugin before 5.6 for WordPress has code injection...

CVE-2012-6713

The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues...

CVE-2013-7478

The events-manager plugin before 5.5 for WordPress has XSS via EMTicket::getpost...

CVE-2019-15889

The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or searchpublishdate parameter...

CVE-2017-20095

A vulnerability classified as critical was found in Simple Ads Manager Plugin. This vulnerability affects unknown code. The manipulation leads to code injection. The attack can be initiated remotely...

CVE-2012-6627

Cross-site scripting XSS vulnerability in admin/testmail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2015-9300

The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues...

CVE-2015-9467

The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter...

CVE-2017-20093

A vulnerability, which was classified as problematic, was found in Download Manager Plugin 2.8.99. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely...

CVE-2012-6716

The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links...

CVE-2015-9299

The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS...

Cross-site Scripting (XSS)

Overview couleurcitron/tarteaucitron-wp is a Cookie manager WordPress plugin Affected versions of this package are vulnerable to Cross-site Scripting XSS via the addition of HTML into a post/page. An attacker can manipulate web content or hijack user sessions by injecting malicious scripts into t...

CVE-2024-8284

The Download Manager WordPress plugin (versions prior to 3.2.99 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape certain plugin settings, which allows high-privilege users—such as editors—to execute malicious scripts. Thi...

PT-2025-21264 · WordPress · Advanced-File-Manager-Pro-Premium +1

Name of the Vulnerable Software and Affected Versions: File Manager Advanced Shortcode WordPress plugin versions up to, and including, 2.5.4 advanced-file-manager-pro-premium versions up to, and including, 2.5.6 Description: The issue allows authenticated attackers with Administrator-level access...

CVE-2025-3419

The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxyimage function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on...

PT-2025-17370 · WordPress · Download Manager

Name of the Vulnerable Software and Affected Versions: Download Manager plugin for WordPress versions up to, and including, 3.3.12 Description: The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the savePackage function...

WordPress Plugin Login Manager Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...