CVE-2015-20105

The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scriptin...

CVE-2019-15817

The easy-property-listings plugin before 3.4 for WordPress has XSS...

CVE-2018-20979

The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capabilitytype mishandling in registerposttype...

CVE-2019-15835

The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF...

CVE-2018-20974

The js-jobs plugin before 1.0.7 for WordPress has CSRF...

CVE-2017-18548

The note-press plugin before 0.1.2 for WordPress has SQL injection...

CVE-2015-9447

The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters...

CVE-2018-21011

The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details...

CVE-2018-20972

The companion-auto-update plugin before 3.2.1 for WordPress has CSRF...

CVE-2018-20988

The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation...

CVE-2016-10922

The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation...

CVE-2016-10948

The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function...

CVE-2016-10890

The aryo-activity-log plugin before 2.3.2 for WordPress has XSS...

CVE-2016-10914

The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file...

CVE-2015-9297

The events-manager plugin before 5.6 for WordPress has XSS...

CVE-2015-9436

The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=termtree prefix or widgetid parameter...

CVE-2015-9343

The wp-rollback plugin before 1.2.3 for WordPress has CSRF...

CVE-2019-15838

The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789...

CVE-2012-6714

The count-per-day plugin before 3.2.3 for WordPress has XSS via search words...

CVE-2019-25144

The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.2.10 due to insufficient input sanitization. This makes it possible for unauthenticated attackers to inject arbitrary HTML in pages that execute if they can successfully trick a administrator...