CVE-2015-9438

The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dwshowwidget idbase, widgetnumber, or instance parameter...

Cross site request forgery (csrf)

The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config pagelimit parameter...

Design/Logic Flaw

The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=termtree prefix or widgetid parameter...

CVE-2015-9438

The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dwshowwidget idbase, widgetnumber, or instance parameter...

CVE-2015-9438

The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dwshowwidget idbase, widgetnumber, or instance parameter...

CVE-2015-9438

The CVE-2015-9438 entry concerns the WordPress display-widgets plugin. Affected product: WordPress display-widgets (plugin) versions before 2.04. Root cause: lack of input validation in the web application leads to cross-site scripting. Impact: XSS via admin-ajax.php endpoint (action=dw_show_widg...

CVE-2015-9437

The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config pagelimit parameter...

CVE-2015-9437

The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config pagelimit parameter...

CVE-2015-9437

The CVE refers to the WordPress Dynamic Widgets plugin, affected versions prior to 1.5.11. The issue is a CSRF that can lead to a stored/XSS outcome via the wp-admin/themes.php?page=dynwid-config page_limit parameter. Several connected sources confirm that this vulnerability concerns Dynamic Widg...

CVE-2015-9436

The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=termtree prefix or widgetid parameter...

CVE-2015-9436

CVE-2015-9436 affects the WordPress Dynamic Widgets plugin prior to 1.5.11. The issue is an XSS vulnerability caused by insufficient input validation, exploitable via wp-admin/admin-ajax.php?action=term_tree prefix or the widget_id parameter. Impact is client-side code execution in affected conte...

CVE-2015-9436

The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=termtree prefix or widgetid parameter...

CVE-2015-9438: Improper Neutralization of Input During Web Page Generation

The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dwshowwidget idbase, widgetnumber, or instance parameter...

CVE-2015-9437: Cross-Site Request Forgery (CSRF)

The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config pagelimit parameter...

CVE-2015-9436: Improper Neutralization of Input During Web Page Generation

The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=termtree prefix or widgetid parameter...

PT-2019-7397

Name of the Vulnerable Software and Affected Versions display-widgets plugin versions prior to 2.04 Description The issue allows for XSS via the "wp-admin/admin-ajax.php?action=dw show widget" API endpoint, specifically through the id base, widget number, or instance parameters. Recommendations F...

PT-2019-7396 · WordPress · Dynamic Widgets

Name of the Vulnerable Software and Affected Versions: dynamic-widgets plugin versions prior to 1.5.11 Description: The issue concerns a CSRF with resultant XSS. It is exploitable via the "page limit" parameter in the "/wp-admin/themes.php?page=dynwid-config" API endpoint. Recommendations: For...

PT-2019-7395 · WordPress · Dynamic Widgets

Name of the Vulnerable Software and Affected Versions: dynamic-widgets plugin versions prior to 1.5.11 Description: The issue concerns a cross-site scripting XSS problem. It can be exploited via the "action=term tree" prefix or the widget id parameter in the "/wp-admin/admin-ajax.php" API endpoin...

PT-2019-14493

Name of the Vulnerable Software and Affected Versions Total.js CMS version 12.0.0 Description An issue allows an authenticated user with the widgets privilege to achieve Remote Command Execution RCE on the remote server. This is done by creating a malicious widget with a special tag containing...

CVE-2019-15954: Missing Authorization

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution RCE on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of...