PT-2019-14380

Name of the Vulnerable Software and Affected Versions nd-shortcodes plugin versions prior to 6.0 Description The issue allows modification of the siteurl setting through a nopriv AJAX action. Recommendations For nd-shortcodes plugin versions prior to 6.0, update to version 6.0 or later to resolve...

CVE-2019-15771: URL Redirection to Untrusted Site

The nd-shortcodes plugin before 6.0 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...

WordPress shortcodes-ultimate plugin input validation error vulnerability

WordPress is a blogging platform from the WordPress Foundation developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. shortcodes-ultimate is one of the plugins used in it, which supports the creation of tabs, buttons, sliders,...

CVE-2017-18580

The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode...

CVE-2017-18580

The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode...

PT-2019-8514

Name of the Vulnerable Software and Affected Versions shortcodes-ultimate plugin versions prior to 5.0.1 Description The issue allows for remote code execution via a filter in a meta, post, or user shortcode. Recommendations For versions prior to 5.0.1, update to version 5.0.1 or later to resolve...

CVE-2017-18580: Improper Input Validation

The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode...

CVE-2017-18540

The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes...

CVE-2017-18539

The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes...

PT-2019-8473 · WordPress · Weblibrarian

Name of the Vulnerable Software and Affected Versions: weblibrarian plugin versions prior to 3.4.8.6 for WordPress Description: The issue concerns a Cross-Site Scripting XSS vulnerability. XSS is a type of security vulnerability that allows an attacker to inject malicious scripts into a website,...

PT-2019-8474 · Unknown · Weblibrarian Plugin

Name of the Vulnerable Software and Affected Versions: weblibrarian plugin versions prior to 3.4.8.7 Description: The issue allows for cross-site scripting XSS attacks via front-end short codes. Recommendations: For versions prior to 3.4.8.7, update to version 3.4.8.7 or later to resolve the issu...

CVE-2015-9318

The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies...

Security feature bypass

The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies...

CVE-2015-9318

The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies...

CVE-2015-9318

CVE-2015-9318 affects the WordPress plugin Awesome Support prior to 3.1.7. The vulnerability is that shortcodes are allowed in replies, stemming from the plugin’s handling of reply content. According to NVD, the issue has CVSS v2 base score 5.0 (MEDIUM) with impact on integrity while allowing net...

CVE-2015-9318

The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies...

PT-2019-7277

Name of the Vulnerable Software and Affected Versions awesome-support plugin versions prior to 3.1.7 Description The issue allows shortcodes in replies, which can lead to a security problem. Recommendations For versions prior to 3.1.7, update to version 3.1.7 or later to resolve the issue...

CVE-2015-9318: Undefined Security Weakness

The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies...

Design/Logic Flaw

In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection...

CVE-2017-18356: Improper Control of Generation of Code

In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection...