CVE-2019-15318

The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field...

CVE-2019-15320

The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled...

CVE-2019-15324

The ad-inserter plugin before 2.4.22 for WordPress has remote code execution...

CVE-2015-9462

The awesome-filterable-portfolio plugin before 1.9 for WordPress has afpgetnewcategorypage SQL injection via the catid parameter...

CVE-2015-9443

The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=AccuDataWP...

CVE-2018-20963

The contact-form-to-email plugin before 1.2.66 for WordPress has XSS...

CVE-2018-20986

The advanced-custom-fields aka Elliot Condon Advanced Custom Fields plugin before 5.7.8 for WordPress has XSS by authors...

CVE-2018-21004

The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection...

CVE-2017-18534

The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters...

CVE-2017-1002014

Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/adminsetting.php via galleryname parameter...

CVE-2015-9339

The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files...

CVE-2017-18561

The embed-comment-images plugin before 0.6 for WordPress has XSS...

CVE-2016-10876

The wp-database-backup plugin before 4.3.1 for WordPress has CSRF...

CVE-2015-9362

The Post Connector plugin before 1.0.4 for WordPress has XSS via addqueryarg and removequeryarg...

CVE-2015-9302

The simple-fields plugin before 1.4.11 for WordPress has XSS...

CVE-2017-1002026

Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function editeventcategory does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement...

CVE-2015-9402

The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload...

CVE-2015-9340

The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files...

CVE-2015-9335

The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling...

CVE-2015-9469

The content-grabber plugin 1.0 for WordPress has XSS via objfieldname or objfieldid...