6480 matches found
CVE-2018-25105
The File Manager plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the /inc/root.php file in versions up to, and including, 3.0. This makes it possible for unauthenticated attackers to download arbitrary files from the server and upload arbitrary file...
CVE-2025-4405
CVE-2025-4405 affects the WordPress Hot Random Image plugin (versions up to and including 1.9.2). Root cause: insufficient input sanitization and output escaping on the link parameter, enabling stored Cross-Site Scripting. Exploitation requires authenticated access at Contributor level or higher ...
CVE-2018-20977
The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page...
CVE-2017-1002015
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/adminsetting.php via selectMulGallery parameter...
CVE-2012-6719
The sharebar plugin before 1.2.2 for WordPress has SQL injection...
CVE-2014-10387
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection...
CVE-2014-125102
A vulnerability classified as problematic was found in Bestwebsoft Relevant Plugin up to 1.0.7 on WordPress. Affected by this vulnerability is an unknown functionality of the component Thumbnail Handler. The manipulation leads to information disclosure. The attack can be launched remotely...
CVE-2019-15713
The my-calendar plugin before 3.1.10 for WordPress has XSS...
CVE-2019-15317
The give plugin before 2.4.7 for WordPress has XSS via a donor name...
CVE-2019-15110
The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS...
CVE-2019-14328
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section...
CVE-2019-19980
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users Subscriber or greater access to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wpajax...
CVE-2019-15082
The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS...
CVE-2019-15323
The ad-inserter plugin before 2.4.20 for WordPress has path traversal...
CVE-2019-14947
The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade...
CVE-2019-15650
The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes such as disabling unattended theme updates because of a nonce check error...
CVE-2019-15643
The ultimate-faqs plugin before 1.8.22 for WordPress has XSS...
CVE-2019-15321
The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled...