6503 matches found
CVE-2019-14799
The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS...
CVE-2019-19984
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with editpost capabilities to manage plugin settings and email campaigns...
CVE-2018-18919
The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area...
CVE-2015-20105
The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scriptin...
CVE-2019-15817
The easy-property-listings plugin before 3.4 for WordPress has XSS...
CVE-2018-20979
The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capabilitytype mishandling in registerposttype...
CVE-2019-15835
The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF...
CVE-2018-20974
The js-jobs plugin before 1.0.7 for WordPress has CSRF...
CVE-2017-18548
The note-press plugin before 0.1.2 for WordPress has SQL injection...
CVE-2015-9447
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters...
CVE-2018-21011
The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details...
CVE-2018-20972
The companion-auto-update plugin before 3.2.1 for WordPress has CSRF...
CVE-2018-20988
The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation...
CVE-2016-10922
The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation...
CVE-2016-10948
The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function...
CVE-2016-10890
The aryo-activity-log plugin before 2.3.2 for WordPress has XSS...
CVE-2016-10914
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file...
CVE-2015-9297
The events-manager plugin before 5.6 for WordPress has XSS...