12450 matches found
CVE-2023-4810
The Responsive Pricing Table WordPress plugin before 5.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2018-12534
A SQL injection issue was discovered in the Quick Chat plugin before 4.00 for WordPress...
CVE-2018-18872
The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the eventtitle parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI...
CVE-2018-6001
The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php warsdyplpreview parameter...
CVE-2025-13701 Shabat Keeper <= 0.4.4 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
The Shabat Keeper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER'PHPSELF' parameter in all versions up to, and including, 0.4.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...
CVE-2016-10898
The total-security plugin before 3.4.1 for WordPress has XSS...
CVE-2016-10999
The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter...
CVE-2016-10968
The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax-save privilege escalation...
CVE-2016-10995
The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via singleupload.php or single-upload.php...
CVE-2016-10959
The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload exploitable with CSRF via esmediaimages to wp-admin/admin-ajax.php...
CVE-2016-10983
The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data...
CVE-2016-10938
The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location...
CVE-2016-10974
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frssave CSRF with resultant stored XSS...
CVE-2016-10956
The mail-masta plugin 1.0 for WordPress has local file inclusion in countofsend.php and csvexport.php...
CVE-2016-10921
The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection...
CVE-2016-10912
The universal-analytics plugin before 1.3.1 for WordPress has XSS...
CVE-2016-10961
The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter...
CVE-2016-10934
The check-email plugin before 0.5.2 for WordPress has XSS...