12320 matches found
CVE-2017-18576
The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation...
CVE-2017-18501
The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues...
CVE-2017-18545
The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input...
CVE-2017-18572
The gnucommerce plugin before 1.4.2 for WordPress has XSS...
CVE-2017-18491
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues...
CVE-2017-18568
The my-wp-translate plugin before 1.0.4 for WordPress has XSS...
CVE-2017-18599
The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter...
CVE-2017-18520
The democracy-poll plugin before 5.4 for WordPress has XSS via updatel10n in admin/class.DemAdminInit.php...
CVE-2017-18511
The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF...
CVE-2017-18573
The simple-login-log plugin before 1.1.2 for WordPress has SQL injection...
CVE-2017-18609
The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter...
CVE-2017-18494
The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues...
CVE-2017-18593
The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file...
CVE-2019-18854
A Denial Of Service vulnerability exists in the safe-svg aka Safe SVG plugin through 1.9.4 for WordPress, related to unlimited recursion for a '' substring...
CVE-2019-11843
The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL Reflective Server-Side XSS...
CVE-2019-11591
The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the latter is...
CVE-2019-11565
Server Side Request Forgery SSRF exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter...
CVE-2019-11590
The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the latter is...
CVE-2019-11185
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file...