3376 matches found
CVE-2018-5655
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php security parameter...
CVE-2018-5312
The tabs-responsive plugin 1.8.0 for WordPress has XSS via the posttitle parameter to wp-admin/post.php...
CVE-2019-14786
The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter...
CVE-2019-15114
The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF...
CVE-2019-15830
The icegram plugin before 1.10.29 for WordPress has igcatlist XSS...
CVE-2017-18597
The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId parameter...
CVE-2019-14950
The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page...
CVE-2018-21013
The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php...
CVE-2017-1000224
CSRF in YouTube WordPress plugin could allow unauthenticated attacker to change any setting within the plugin...
CVE-2018-18379
The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS...
CVE-2015-9379
iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via addqueryarg and removequeryarg...
CVE-2015-9308
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature...
CVE-2016-10895
The option-tree plugin before 2.6.0 for WordPress has XSS via an addlistitem or addsociallinks AJAX request...
CVE-2015-9391
The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter...
CVE-2025-4133
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in a dashboard, which could allow users with the contributor role to perform Cross-Site Scripting attacks...
CVE-2017-12946
classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators...
CVE-2013-7477
The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form...
CVE-2025-4133 Blog2Social: Social Media Auto Post & Scheduler < 8.4.0 - Contributor+ Stored XSS
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in a dashboard, which could allow users with the contributor role to perform Cross-Site Scripting attacks...
CVE-2011-4342
PHP remote file inclusion vulnerability in wpxmlexport.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the wpabs parameter...