12342 matches found
CVE-2014-9444
Cross-site scripting XSS vulnerability in the Frontend Uploader plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the errorsfu-disallowed-mime-type0name parameter to the default URI...
CVE-2015-9533
The Easy Digital Downloads EDD Lattice theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...
CVE-2013-5918
Cross-site scripting XSS vulnerability in platinumseopack.php in the Platinum SEO plugin before 1.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter...
CVE-2011-5270
wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publishposts capability requirement, which allows remote authenticated users to perform publish actions by leveraging the Contributor role...
CVE-2011-5257
Multiple cross-site scripting XSS vulnerabilities in the Classipress theme before 3.1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 twitterid parameter related to the Twitter widget and 2 facebookid parameter related to the Facebook widget...
CVE-2017-18517
The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues...
CVE-2017-18516
The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues...
CVE-2011-5192
Cross-site scripting XSS vulnerability in pretty-bar.php in Pretty Link Lite plugin before 1.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter, a different vulnerability than CVE-2011-5191...
CVE-2017-18490
The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues...
CVE-2014-9179
Cross-site scripting XSS vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the "URL optional" field in a new ticket...
CVE-2010-5106
The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended access restrictions, and publish, edit, or delete posts, by leveraging the Author or Contributor role...
CVE-2014-9100
Cross-site scripting XSS vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the idcode parameter in the whydoworkadsense page to wp-admin/options-general.php...
CVE-2013-3479
Cross-site request forgery CSRF vulnerability in the ShareThis plugin before 7.0.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify this plugin's settings...
CVE-2016-10962
The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php optionname parameter...
CVE-2013-3254
Cross-site scripting XSS vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppamanagecomments edit action...
CVE-2012-6716
The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links...
CVE-2017-20008
The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting...
CVE-2015-9411
The Postmatic plugin before 1.4.6 for WordPress has XSS...