CVE-2018-18919

The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area...

CVE-2015-20105

The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scriptin...

CVE-2019-15817

The easy-property-listings plugin before 3.4 for WordPress has XSS...

CVE-2018-20979

The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capabilitytype mishandling in registerposttype...

CVE-2019-15835

The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF...

CVE-2018-20974

The js-jobs plugin before 1.0.7 for WordPress has CSRF...

CVE-2017-18548

The note-press plugin before 0.1.2 for WordPress has SQL injection...

CVE-2015-9447

The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters...

CVE-2018-21011

The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details...

CVE-2018-20972

The companion-auto-update plugin before 3.2.1 for WordPress has CSRF...

CVE-2018-20988

The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation...

CVE-2016-10922

The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation...

CVE-2016-10948

The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function...

CVE-2016-10890

The aryo-activity-log plugin before 2.3.2 for WordPress has XSS...

CVE-2016-10914

The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file...

CVE-2015-9297

The events-manager plugin before 5.6 for WordPress has XSS...

CVE-2015-9436

The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=termtree prefix or widgetid parameter...

CVE-2015-9343

The wp-rollback plugin before 1.2.3 for WordPress has CSRF...

CVE-2019-15838

The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789...

CVE-2012-6714

The count-per-day plugin before 3.2.3 for WordPress has XSS via search words...