6471 matches found
CVE-2018-20972
The companion-auto-update plugin before 3.2.1 for WordPress has CSRF...
CVE-2018-20988
The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation...
CVE-2016-10922
The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation...
CVE-2016-10948
The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function...
CVE-2016-10890
The aryo-activity-log plugin before 2.3.2 for WordPress has XSS...
CVE-2016-10914
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file...
CVE-2015-9297
The events-manager plugin before 5.6 for WordPress has XSS...
CVE-2015-9436
The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=termtree prefix or widgetid parameter...
CVE-2015-9343
The wp-rollback plugin before 1.2.3 for WordPress has CSRF...
CVE-2019-15838
The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789...
CVE-2012-6714
The count-per-day plugin before 3.2.3 for WordPress has XSS via search words...
CVE-2019-25144
The WP HTML Mail plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 2.2.10 due to insufficient input sanitization. This makes it possible for unauthenticated attackers to inject arbitrary HTML in pages that execute if they can successfully trick a administrator...
CVE-2016-10966
The real3d-flipbook-lite plugin 1.0 for WordPress has bookName=../ directory traversal for file upload...
CVE-2015-9384
The relevant plugin before 1.0.8 for WordPress has XSS...
CVE-2015-9345
The link-log plugin before 2.0 for WordPress has HTTP Response Splitting...
CVE-2015-9472
The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header...
CVE-2019-15836
The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS...
CVE-2019-15779
The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qliggdismissnotice or qliggformitemdelete...