6503 matches found
Remote code execution
WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability...
Cross site scripting
The ultimate-weather plugin 1.0 for WordPress has XSS...
EUVD-2014-4488
The ultimate-weather plugin 1.0 for WordPress has XSS...
CVE-2019-19915
The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users with subscriber or greater access to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=epsredirectsave and /admin-ajax.php?action=epsredirectdelete actions. This coul...
CVE-2015-9494
CVE-2015-9494 affects the WordPress plugin indieweb-post-kinds (versions prior to 1.3.1.1). It enables a DOM-based XSS via the genericons/example.html anchor identifier, allowing injected script to run in a victim’s browser when that anchor is processed. PoC demonstrates the vulnerability. Remedi...
WordPress ad-inserter plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. ad-inserter is an ad management plugin used in it. A cross-site request forgery vulnerability exists in WordPress ad-inserter plugin...
SyntaxHighlighter Evolved <= 3.5.0 - Stored Cross-Site Scripting (XSS)
The SyntaxHighlighter Evolved WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...
CVE-2019-16521
The broken-link-checker plugin through 1.11.8 for WordPress aka Broken Link Checker is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by providing an XSS...
CVE-2015-9471
The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload...
CVE-2015-9437
The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config pagelimit parameter...
CVE-2015-9430
The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header...
EUVD-2015-9255
The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion...
Directory traversal
The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal...
CVE-2016-10964
The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header...
Sql injection
The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter...
Cross site scripting
The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS...
CVE-2015-9346
The cp-polls plugin before 1.0.5 for WordPress has XSS...
CVE-2018-20987
The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection...