219 matches found
Exploit for CVE-2026-97347
CVE-2026-97347 — Stored XSS in Post Views Stats Counter WordP...
CVE-2016-20083: Cross-Site Request Forgery (CSRF)
WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF token validation. Attackers can craft malicious web pages that trick logged-in administrators into adding or deleting custom fields and boxe...
CVE-2022-50955: Cross-Site Request Forgery (CSRF)
WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by crafting malicious requests. Attackers can trick authenticated administrators into submitting forged requests to the options-general.php page...
EUVD-2015-9283
Malware in sbrugna...
Social Pixel <= 2.1 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Go to:...
CVE-2017-20108 Easy Table Plugin options-general.php cross site scripting
A vulnerability classified as problematic has been found in Easy Table Plugin 1.6. This affects an unknown part of the file /wordpress/wp-admin/options-general.php. The manipulation with the input "alert1 leads to basic cross site scripting. It is possible to initiate the attack remotely...
CVE-2017-20108 Easy Table Plugin options-general.php cross site scripting
A vulnerability classified as problematic has been found in Easy Table Plugin 1.6. This affects an unknown part of the file /wordpress/wp-admin/options-general.php. The manipulation with the input "alert1 leads to basic cross site scripting. It is possible to initiate the attack remotely...
CVE-2017-20108: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
A vulnerability classified as problematic has been found in Easy Table Plugin 1.6. This affects an unknown part of the file /wordpress/wp-admin/options-general.php. The manipulation with the input " leads to basic cross site scripting. It is possible to initiate the attack remotely...
PT-2022-7981
Name of the Vulnerable Software and Affected Versions Easy Table Plugin version 1.6 Description A problematic issue has been found in the Easy Table Plugin, affecting an unknown part of the file /wordpress/wp-admin/options-general.php. The manipulation with the input "alert1 leads to basic cross...
Alipay <= 3.7.2 - Authenticated SQL Injection
A proid GET parameter of the plugin is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection. GET /wp-admin/options-general.php?page=wsalipay&action=edit&proid=-5818%20UNION%20ALL%20SELECT...
PT-2020-17355
Name of the Vulnerable Software and Affected Versions limit-login-attempts-reloaded plugin versions prior to 2.17.4 for WordPress Description The issue allows a malicious user to cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the us...
CVE-2020-35589: Improper Neutralization of Input During Web Page Generation
The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed b...
Subscribe Sidebar <= 1.3.1 - Authenticated Reflected Cross-Site Scripting
The 'status' GET parameter in subscribesidebar.php, which is displayed in the plugin's option page, is vulnerable to reflected XSS attacks. /wp-admin/options-general.php?page=subscribesidebar.php&status=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E...
CVE-2015-5483
Multiple cross-site request forgery CSRF vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 add users, 2 delete posts, or 3 modify PHP files via unspecified vectors, or 4 conduct cross-site...
PT-2019-7456
Name of the Vulnerable Software and Affected Versions ad-inserter plugin versions prior to 1.5.3 Description The issue concerns a CSRF vulnerability with resultant XSS in the ad-inserter plugin for WordPress. This can be exploited via the "wp-admin/options-general.php?page=ad-inserter.php"...
CVE-2015-9497: Cross-Site Request Forgery (CSRF)
The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php...
Code injection
The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter...
PT-2019-7418
Name of the Vulnerable Software and Affected Versions searchterms-tagging-2 plugin versions 1.535 and earlier Description The issue is related to a Cross-Site Scripting XSS vulnerability. It occurs via the count parameter in the wp-admin/options-general.php API endpoint. This allows for potential...
CVE-2015-9459: Improper Neutralization of Input During Web Page Generation
The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter...
