12342 matches found
CVE-2011-4595
Pretty-Link WordPress plugin 1.5.2 has XSS...
CVE-2011-5307
Cross-site scripting XSS vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...
CVE-2017-18570
The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries...
CVE-2012-6717
The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562...
CVE-2011-4568
Cross-site scripting XSS vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI...
CVE-2019-15889
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or searchpublishdate parameter...
CVE-2012-6718
The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491...
CVE-2015-9314
The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header...
CVE-2011-5329
The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562...
CVE-2013-0291
NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability...
CVE-2014-9442
SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the q parameter in a promotionProductSearch action to wp-admin/admin-ajax.php...
CVE-2015-9441
The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php...
CVE-2019-25060
The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site...
CVE-2015-9377
iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via addqueryarg and removequeryarg...
CVE-2015-9470
The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter...
CVE-2014-4723
Cross-site scripting XSS vulnerability in the Easy Banners plugin 1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter to wp-admin/options-general.php...
CVE-2019-17234
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion...
CVE-2019-15833
The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS...