6480 matches found
CVE-2016-10966
The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload...
CVE-2015-9384
The relevant plugin before 1.0.8 for WordPress has XSS...
CVE-2015-9345
The link-log plugin before 2.0 for WordPress has HTTP Response Splitting...
CVE-2015-9472
The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header...
CVE-2019-15836
The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS...
CVE-2019-15779
The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qliggdismissnotice or qliggformitemdelete...
CVE-2019-15819
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for ndrstimportsettingsphpfunction authentication...
CVE-2017-18512
The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF...
CVE-2019-15318
The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field...
CVE-2019-15320
The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled...
CVE-2019-15324
The ad-inserter plugin before 2.4.22 for WordPress has remote code execution...
CVE-2015-9462
The awesome-filterable-portfolio plugin before 1.9 for WordPress has afpgetnewcategorypage SQL injection via the catid parameter...
CVE-2015-9443
The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=AccuDataWP...
CVE-2018-20963
The contact-form-to-email plugin before 1.2.66 for WordPress has XSS...
CVE-2018-20986
The advanced-custom-fields aka Elliot Condon Advanced Custom Fields plugin before 5.7.8 for WordPress has XSS by authors...
CVE-2018-21004
The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection...
CVE-2017-18534
The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters...
CVE-2017-1002014
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/adminsetting.php via galleryname parameter...