1359 matches found
PT-2021-15686
Name of the Vulnerable Software and Affected Versions: Ajax Load More WordPress plugin versions prior to 5.3.2 Description: The issue concerns unvalidated input in the Ajax Load More WordPress plugin, leading to SQL Injection. This occurs in the POST /wp-admin/admin-ajax.php endpoint with the...
CVE-2021-24140: Improper Neutralization of Special Elements used in an SQL Command
Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep5&type=test...
CVE-2020-35749
Directory traversal vulnerability in class-simplejobboardresumedownloadhandler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjbfile parameter to wp-admin/post.php...
CVE-2020-35749
Directory traversal vulnerability in class-simplejobboardresumedownloadhandler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjbfile parameter to wp-admin/post.php...
CVE-2020-35749: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in class-simplejobboardresumedownloadhandler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjbfile parameter to wp-admin/post.php...
CVE-2020-35582: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/post.php request with the posttitle parameter...
PT-2021-11843
Name of the Vulnerable Software and Affected Versions: Simple Board Job plugin versions 2.9.3 and earlier Description: A directory traversal issue allows remote attackers to read arbitrary files via the sjb file parameter to "wp-admin/post.php". Recommendations: For Simple Board Job plugin versio...
PT-2021-11809
Name of the Vulnerable Software and Affected Versions: Envira Gallery Lite versions prior to 1.8.3.3 Description: A stored cross-site scripting XSS issue allows remote attackers to inject arbitrary JavaScript/HTML code via a POST "/wp-admin/post.php" request with the post title parameter...
PT-2020-17355
Name of the Vulnerable Software and Affected Versions limit-login-attempts-reloaded plugin versions prior to 2.17.4 for WordPress Description The issue allows a malicious user to cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the us...
CVE-2020-35589: Improper Neutralization of Input During Web Page Generation
The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed b...
PT-2020-17138
Name of the Vulnerable Software and Affected Versions SabaiApp Directories Pro plugin version 1.3.45 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a POST to "/wp-admin/admin.php?page=drts/directories&q=%2F" with the drts form build...
PT-2020-16483
Name of the Vulnerable Software and Affected Versions Testimonial Rotator Wordpress Plugin version 3.0.2 Description The issue concerns a Cross Site Scripting XSS problem. Specifically, it involves the /wp-admin/post.php endpoint. If a user intercepts a request and inserts a payload in the cite...
CVE-2020-26672: Improper Neutralization of Input During Web Page Generation
Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting XSS in /wp-admin/post.php. If a user intercepts a request and inserts a payload in "cite" parameter, the payload will be stored in the database...
Subscribe Sidebar <= 1.3.1 - Authenticated Reflected Cross-Site Scripting
The 'status' GET parameter in subscribesidebar.php, which is displayed in the plugin's option page, is vulnerable to reflected XSS attacks. /wp-admin/options-general.php?page=subscribesidebar.php&status=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E...
Newsletter < 6.8.2 - Authenticated Cross-Site Scripting (XSS)
Newsletter suffers from an Authenticated Reflected Cross-Site ScriptingXSS vulnerability via the ‘tnpcrender’ AJAX action found in newsletter/emails/emails.php. Due to how the corresponding ‘tnpcrendercallback‘ function decodes input via the ‘restoreoptionsfromrequest’ function and renders them v...
PT-2020-14091
Name of the Vulnerable Software and Affected Versions Final Tiles Gallery plugin versions prior to 3.4.19 Description The issue allows remote attackers to inject arbitrary web script or HTML via the imageTitle or description field of an image to the "/wp-admin/admin-ajax.php" API endpoint...
CVE-2020-14959: Improper Neutralization of Input During Web Page Generation
Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-admin/post.php Client Name, Position, Web Address, Other, Location Reviewed, Product Reviewed, Item Reviewed, or Rating parameter...
CVE-2020-14962: Improper Neutralization of Input During Web Page Generation
Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title aka imageTitle or Caption aka description field of an image to wp-admin/admin-ajax.php...
