12315 matches found
CVE-2018-12534
A SQL injection issue was discovered in the Quick Chat plugin before 4.00 for WordPress...
CVE-2018-18872
The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the eventtitle parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI...
CVE-2018-6001
The Soundy Audio Playlist plugin 4.6 and below for WordPress has Cross-Site Scripting via soundy-audio-playlist\templates\front-end.php warsdyplpreview parameter...
CVE-2025-13701 Shabat Keeper <= 0.4.4 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
The Shabat Keeper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER'PHPSELF' parameter in all versions up to, and including, 0.4.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...
CVE-2016-10898
The total-security plugin before 3.4.1 for WordPress has XSS...
CVE-2016-10999
The Goodnews theme through 2016-02-28 for WordPress has XSS via the s parameter...
CVE-2016-10968
The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax-save privilege escalation...
CVE-2016-10995
The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via singleupload.php or single-upload.php...
CVE-2016-10959
The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload exploitable with CSRF via esmediaimages to wp-admin/admin-ajax.php...
CVE-2016-10983
The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data...
CVE-2016-10938
The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location...
CVE-2016-10974
The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frssave CSRF with resultant stored XSS...
CVE-2016-10956
The mail-masta plugin 1.0 for WordPress has local file inclusion in countofsend.php and csvexport.php...
CVE-2016-10921
The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection...
CVE-2016-10912
The universal-analytics plugin before 1.3.1 for WordPress has XSS...
CVE-2016-10961
The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter...
CVE-2016-10934
The check-email plugin before 0.5.2 for WordPress has XSS...
CVE-2016-10996
The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak...