CVE-2015-7806

Eval injection vulnerability in the fmsaveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-7806

Eval injection vulnerability in the fmsaveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers to execute arbitrary code via unspecified vectors...

CVE-2015-7806

The CVE-2015-7806 issue affects the WordPress Form Manager plugin (prior to 1.7.3). The vulnerability is in the fm_saveHelperGatherItems function of ajax.php, enabling remote code execution via unspecified vectors. Multiple sources confirm RCE potential, including CNVD and WPVulndB entries noting...

CVE-2017-11611

Wolf CMS 0.8.3.1 allows Cross-Site Scripting XSS attacks. The vulnerability exists due to insufficient sanitization of the file name in a "create-file-popup" action, and the directory name in a "create-directory-popup" action, in the HTTP POST method to the "/plugin/filemanager/" script aka an...

WordPress download manager plugin elevation of privilege vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site.WordPress Download Manager is one of the file download management plugin. A security vulnerability exists in the...

CVE-2014-9260

The CVE-2014-9260 entry concerns the WordPress Download Manager plugin. The vulnerability is in the basic_settings function of the plugin before version 2.7.3, which allows remote authenticated users to update every WordPress option. This privilege escalation enables an attacker with existing WP ...

WordPress WooCommerce Stock Manager Plugin <= 1.0.7 - Authenticated Product Settings Change Vulnerability

In the function function stockmanagersaveoneproductstockdata, doesn't check for user capabilities so any logged in user can change the settings. Solution Update the plugin...

Wordpress Download Manager plugin cross-site request forgery vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the Wordpress Download Manager plugin. An attacker can exploit the...

WordPress SP Projects and Document Manager Plugin SQL Injection

An SQL injection vulnerability exists in the WordPress SP Projects and Document Manager Plugin. It allows an authenticated remote attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data...

WordPress User Meta Manager Plugin 3.4.6 - Information Disclosure

Because of this vulnerability, any user, who is registered, can perform many AJAX requests and in that way get all contents of "usermeta" DB table. Solution Upgrade to version 3.4.8...

WordPress User Meta Manager Plugin 3.4.6 - Privilege Escalation

Because of this vulnerability, a registered user can modify the meta information. Solution Update the plugin...

WordPress Job Manager Plugin <= 0.7.24 - Cross Site Scripting (XSS)

This plugin is prone to a cross site scripting vulnerability, because authenticated administrators can inject HTML or JS code. Vulnerable parameter is "jobman-rating". Solution Update the plugin...

CVE-2015-2321

Cross-site scripting XSS vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the email field...

CVE-2015-2321

The CVE-2015-2321 entry applies to the WordPress Job Manager plugin (Job Manager Plugin for WordPress) version

WordPress Job Manager Plugin 0.7.22 - Persistent XSS

Job Manager plugin is prone to a persistent XSS vulnerability, because email field was not sanitized. It allows an attacler to steal cookies or perform phishing attacks. Other attacks are also possible. Solution Update the plugin...

WordPress Smart Manager Plugin <= 3.9.6 - SQL Injection

Because of this vulnerability, unauthenticated remote attackers can execute arbitrary SQL commands. Solution Update the plugin...

N-Media File Uploader <= 3.7 - Arbitrary File Upload

The Frontend File Manager Plugin WordPress plugin was affected by an Arbitrary File Upload security vulnerability...

WordPress Events Manager Plugin <= 5.3.8 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

WordPress Plugin SP Project & Document Manager 2.5.3 - Blind SQL Injection

Exploit Title: WordPress SP Project & Document Manager 2.5.3 Blind SQL Injection Google Dork: inurl:wp-content/plugins/sp-client-document-manager Date: 2015-03-04 Exploit Author: catsecurity Vendor Homepage: http://smartypantsplugins.com Software Link:...

Open redirect

Open redirect vulnerability in track-click.php in the Ad-Manager plugin 1.1.2 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the out parameter...