CVE-2019-17675: Cross-Site Request Forgery (CSRF)

WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF...

CVE-2015-9472

The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header...

CVE-2015-9472

The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header...

CVE-2015-9472

The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header...

PT-2019-7431

Name of the Vulnerable Software and Affected Versions incoming-links plugin versions prior to 0.9.10b for WordPress Description The issue allows for XSS via the Referer HTTP header in the referrers.php file. Recommendations For versions prior to 0.9.10b, update to version 0.9.10b or later to...

CVE-2015-9472: Improper Neutralization of Input During Web Page Generation

The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header...

CVE-2015-9453

The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist...

CVE-2015-9453

The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist...

CVE-2015-9453

The CVE concerns the WordPress Broken Link Manager plugin, affected versions before 0.6.0. Root cause: the plugin does not properly validate or sanitize input via HTTP Referer or User‑Agent headers when requests target a non-existent URL, enabling cross‑site scripting. Impact: attacker can inject...

CVE-2015-9453

The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist...

PT-2019-7412

Name of the Vulnerable Software and Affected Versions broken-link-manager plugin versions prior to 0.6.0 for WordPress Description The issue allows for XSS via the HTTP Referer or User-Agent header to a URL that does not exist. Recommendations For versions prior to 0.6.0, update to version 0.6.0 ...

CVE-2015-9453: Improper Neutralization of Input During Web Page Generation

The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist...

CVE-2016-10988

The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebookmessage, facebooklinkname, facebookcaption, facebookdescription, defaultimage, or wphttpreferer...

PT-2019-5221 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.4 Description: The issue is related to a type confusion error during referer validation on admin pages, which could lead to a CSRF attack. This might allow a remote attacker to access confidential data,...

CVE-2019-15826

The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field...

CVE-2019-15826

The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field...

CVE-2019-15826

The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field...

CVE-2019-15826

The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field...

CVE-2019-15826: Undefined Security Weakness

The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field...

PT-2019-14415

Name of the Vulnerable Software and Affected Versions wps-hide-login plugin versions prior to 1.5.3 Description The issue allows for protection bypass via the "wp-login.php" page, specifically through manipulation of the Referer field. Recommendations For versions prior to 1.5.3, update to versio...