CVE-2017-18580: Improper Input Validation

The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode...

CVE-2017-18540

The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes...

CVE-2017-18539

The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes...

PT-2019-8474 · Unknown · Weblibrarian Plugin

Name of the Vulnerable Software and Affected Versions: weblibrarian plugin versions prior to 3.4.8.7 Description: The issue allows for cross-site scripting XSS attacks via front-end short codes. Recommendations: For versions prior to 3.4.8.7, update to version 3.4.8.7 or later to resolve the issu...

PT-2019-8473 · WordPress · Weblibrarian

Name of the Vulnerable Software and Affected Versions: weblibrarian plugin versions prior to 3.4.8.6 for WordPress Description: The issue concerns a Cross-Site Scripting XSS vulnerability. XSS is a type of security vulnerability that allows an attacker to inject malicious scripts into a website,...

CVE-2015-9318

The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies...

Security feature bypass

The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies...

CVE-2015-9318

CVE-2015-9318 affects the WordPress plugin Awesome Support prior to 3.1.7. The vulnerability is that shortcodes are allowed in replies, stemming from the plugin’s handling of reply content. According to NVD, the issue has CVSS v2 base score 5.0 (MEDIUM) with impact on integrity while allowing net...

CVE-2015-9318

The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies...

CVE-2015-9318: Undefined Security Weakness

The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies...

Design/Logic Flaw

In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection...

CVE-2017-18356: Improper Control of Generation of Code

In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection...

Image Intense <= 3.2.5 - Authenticated SQL Injection in shortcodes

The vendor does not consider it to be a vulnerability, it remains unfixed. SQL Injection in handling of the "etpbimagen10s" shortcode. The last version at the time of the original advisory, 3.2.5, is known to be affected. PoC etpbsection bbbuilt="1"etpbrowetpbcolumn type="44"etpbimagen10s...

Image Intense <= 3.2.5 - Authenticated SQL Injection in shortcodes

The vendor does not consider it to be a vulnerability, it remains unfixed. SQL Injection in handling of the "etpbimagen10s" shortcode. The last version at the time of the original advisory, 3.2.5, is known to be affected. etpbsection bbbuilt="1"etpbrowetpbcolumn type="44"etpbimagen10s...

CVE-2018-0586: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to read arbitrary files via unspecified vectors...

WordPress File Upload plugin <=4.3.2 - Security Issue in plugin shortcodes

Security Issue in plugin shortcodes found in WordPress File Upload plugin versions =4.3.2. Solution Update the WordPress File Upload plugin to the latest available version at least 4.3.3...

Shortcodes Ultimate <= 5.0.0 - Authenticated Contributor Code Execution

The Shortcodes Ultimate plugin does not sanitize the "filter" argument to the "sumeta", "suuser", and "supost" shortcodes, allowing the filter to be set to the "system" function which runs arbitrary code. This is being exploited in the wild; I discovered this though analysis of modsecurity audit...

Shortcodes Ultimate <= 5.0.0 - Authenticated Contributor Code Execution

The Shortcodes Ultimate plugin does not sanitize the "filter" argument to the "sumeta", "suuser", and "supost" shortcodes, allowing the filter to be set to the "system" function which runs arbitrary code. This is being exploited in the wild; I discovered this though analysis of modsecurity audit...

VulnCheck KEV: CVE-2017-18580

The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode...

WordPress TinyMCE Virtual Editor Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL servers to set up a personal blog site.TinyMCE visual editor is one of the virtual editor. A cross-site scripting vulnerability exists in the TinyMCE...