CVE-2015-9339

The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files...

CVE-2017-20094

A vulnerability, which was classified as problematic, has been found in NewStatPress Plugin 1.2.4. This issue affects some unknown processing. The manipulation leads to basic cross site scripting Persistent. The attack may be initiated remotely. Upgrading to version 1.2.5 is able to address this...

CVE-2017-18561

The embed-comment-images plugin before 0.6 for WordPress has XSS...

CVE-2016-10876

The wp-database-backup plugin before 4.3.1 for WordPress has CSRF...

CVE-2015-9302

The simple-fields plugin before 1.4.11 for WordPress has XSS...

CVE-2015-9362

The Post Connector plugin before 1.0.4 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2017-1002026

Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function editeventcategory does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement...

CVE-2015-9402

The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload...

CVE-2015-9390

The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wpajax functions are mishandled...

CVE-2015-9340

The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files...

CVE-2015-9335

The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling...

CVE-2015-9469

The content-grabber plugin 1.0 for WordPress has XSS via objfieldname or objfieldid...

CVE-2015-9320

The option-tree plugin before 2.5.4 for WordPress has XSS related to addqueryarg...

CVE-2015-10124

A vulnerability was found in Most Popular Posts Widget Plugin up to 0.8 on WordPress. It has been classified as critical. Affected is the function addviews/showviews of the file functions.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to...

CVE-2005-4845

The Java Plug-in 1.4.203 and 1.4.204 controls, and the 1.4.203 and 1.4.204 redirector controls, allow remote attackers to cause a denial of service Internet Explorer crash by creating a COM object of the class associated with the control's CLSID, which is not intended for use within Internet...

WordPress plugin Hot Random Image 跨站脚本漏洞

WordPress Hot Random Image is a basic plugin for displaying randomly selected images from a specified folder. A cross-site scripting vulnerability exists in WordPress Hot Random Image, which stems from insufficient link parameter input cleanup and escaping, and can be exploited by an attacker to...

CVE-2007-10003

A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress. This issue affects some unknown processing of the file ajaxblurb.php of the component HTTP POST Request Handler. The manipulation of the argument user leads to sql injection. Th...

WordPress MapSVG plugin <= 8.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Mo'men Saad in WordPress Plugin MapSVG versions = 8.6.4...

WordPress Hot Random Image plugin <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via link Parameter vulnerability discovered by Kishan Vyas in WordPress Plugin Hot Random Image versions = 1.9.2...

CVE-2025-4221

The Animated Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-downloader' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...