PT-2018-17068

Name of the Vulnerable Software and Affected Versions: read-and-understood plugin version 2.1 Description: A security issue exists in the read-and-understood plugin for WordPress, where a CSRF vulnerability is present via the "wp-admin/options-general.php" API endpoint. Recommendations: For...

PT-2018-17067

Name of the Vulnerable Software and Affected Versions: read-and-understood plugin version 2.1 Description: A security issue was found in the read-and-understood plugin for WordPress. This issue allows for cross-site scripting XSS attacks through the rnu username validation title parameter in the...

CVE-2018-5668

An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnuusernamevalidationtitle parameter...

CVE-2018-5667: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnuusernamevalidationpattern parameter...

CVE-2018-5369

The SrbTransLatin plugin 1.46 for WordPress is affected by CVE-2018-5369: a Cross-Site Scripting (XSS) vulnerability via the srbtranslatoptions action to wp-admin/options-general.php with the lang_identificator parameter. This, as documented, can allow injection of arbitrary web script or HTML. S...

CVE-2018-5369: Improper Neutralization of Input During Web Page Generation

The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a langidentificator parameter...

CVE-2018-5368: Cross-Site Request Forgery (CSRF)

The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php...

PT-2018-17066

Name of the Vulnerable Software and Affected Versions: read-and-understood plugin version 2.1 Description: A security issue exists in the read-and-understood plugin for WordPress, where cross-site scripting XSS is possible. This occurs via the "wp-admin/options-general.php" endpoint, specifically...

PT-2018-16925

Name of the Vulnerable Software and Affected Versions SrbTransLatin plugin version 1.46 Description The issue concerns a CSRF vulnerability. It can be exploited via an srbtranslatoptions action to the "/wp-admin/options-general.php" API endpoint. Recommendations For SrbTransLatin plugin version...

PT-2018-16926

Name of the Vulnerable Software and Affected Versions SrbTransLatin plugin version 1.46 Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved by sending a specific request to the "wp-admin/options-general.php" endpoint with a lang...

CVE-2018-5284

The ImageInject plugin 1.15 for WordPress has XSS via the flickrappid parameter to wp-admin/options-general.php...

CVE-2018-5284

The ImageInject plugin 1.15 for WordPress has XSS via the flickrappid parameter to wp-admin/options-general.php...

CVE-2018-5285

The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php...

CVE-2018-5284: Improper Neutralization of Input During Web Page Generation

The ImageInject plugin 1.15 for WordPress has XSS via the flickrappid parameter to wp-admin/options-general.php...

CVE-2018-5285: Cross-Site Request Forgery (CSRF)

The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php...

PT-2018-16865

Name of the Vulnerable Software and Affected Versions ImageInject plugin version 1.15 Description The issue allows for XSS via the flickr appid parameter to the "/wp-admin/options-general.php" API endpoint. Recommendations For ImageInject plugin version 1.15, avoid using the flickr appid paramete...

PT-2018-16866

Name of the Vulnerable Software and Affected Versions ImageInject plugin version 1.15 for WordPress Description The issue concerns a CSRF vulnerability. It affects the wp-admin/options-general.php API endpoint. Recommendations For ImageInject plugin version 1.15, consider disabling access to the...

PT-2017-14657

Name of the Vulnerable Software and Affected Versions InLinks plugin versions through 1.1 for WordPress Description The issue allows authenticated users to execute arbitrary SQL commands. This is achieved via the "keyword" parameter to the "/wp-admin/options-general.php?page=inlinks/inlinks.php"...

PT-2017-14245

Name of the Vulnerable Software and Affected Versions wp-noexternallinks plugin versions prior to 3.5.19 Description A Cross Site Scripting XSS issue exists, allowing exploitation via the date1 or date2 parameter to the "wp-admin/options-general.php" API endpoint. Recommendations For versions pri...

CVE-2015-5533

SQL injection vulnerability in counter-options.php in the Count Per Day plugin before 3.4.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the cpdkeepmonth parameter to wp-admin/options-general.php. NOTE: this can be leveraged using CSRF to allow...