6471 matches found
CVE-2019-15110
The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS...
CVE-2019-14328
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section...
CVE-2019-19980
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users Subscriber or greater access to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wpajax...
CVE-2019-15082
The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS...
CVE-2019-15323
The ad-inserter plugin before 2.4.20 for WordPress has path traversal...
CVE-2019-14947
The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade...
CVE-2019-15650
The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes such as disabling unattended theme updates because of a nonce check error...
CVE-2019-15643
The ultimate-faqs plugin before 1.8.22 for WordPress has XSS...
CVE-2019-15321
The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled...
CVE-2019-14799
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS...
CVE-2019-19984
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with editpost capabilities to manage plugin settings and email campaigns...
CVE-2018-18919
The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area...
CVE-2015-20105
The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scriptin...
CVE-2019-15817
The easy-property-listings plugin before 3.4 for WordPress has XSS...
CVE-2018-20979
The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capabilitytype mishandling in registerposttype...
CVE-2019-15835
The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF...
CVE-2018-20974
The js-jobs plugin before 1.0.7 for WordPress has CSRF...
CVE-2017-18548
The note-press plugin before 0.1.2 for WordPress has SQL injection...