CVE-2019-25144

The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.2.10 due to insufficient input sanitization. This makes it possible for unauthenticated attackers to inject arbitrary HTML in pages that execute if they can successfully trick a administrator...

CVE-2016-10966

The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload...

CVE-2015-9384

The relevant plugin before 1.0.8 for WordPress has XSS...

CVE-2015-9345

The link-log plugin before 2.0 for WordPress has HTTP Response Splitting...

CVE-2015-9472

The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header...

CVE-2019-15836

The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS...

CVE-2019-15779

The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qliggdismissnotice or qliggformitemdelete...

CVE-2019-15819

The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for ndrstimportsettingsphpfunction authentication...

CVE-2017-18512

The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF...

CVE-2019-15318

The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field...

CVE-2019-15320

The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled...

CVE-2019-15324

The ad-inserter plugin before 2.4.22 for WordPress has remote code execution...

CVE-2015-9462

The awesome-filterable-portfolio plugin before 1.9 for WordPress has afpgetnewcategorypage SQL injection via the catid parameter...

CVE-2015-9443

The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=AccuDataWP...

CVE-2018-20963

The contact-form-to-email plugin before 1.2.66 for WordPress has XSS...

CVE-2018-20986

The advanced-custom-fields aka Elliot Condon Advanced Custom Fields plugin before 5.7.8 for WordPress has XSS by authors...

CVE-2018-21004

The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection...

CVE-2017-18534

The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters...

CVE-2017-1002014

Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/adminsetting.php via galleryname parameter...

CVE-2015-9339

The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files...