PT-2019-7456

Name of the Vulnerable Software and Affected Versions ad-inserter plugin versions prior to 1.5.3 Description The issue concerns a CSRF vulnerability with resultant XSS in the ad-inserter plugin for WordPress. This can be exploited via the "wp-admin/options-general.php?page=ad-inserter.php"...

CVE-2015-9497: Cross-Site Request Forgery (CSRF)

The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php...

PT-2019-15002

Name of the Vulnerable Software and Affected Versions broken-link-checker plugin version 1.11.8 Description A reflected XSS issue was found in the broken-link-checker plugin for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the s...

CVE-2019-17207: Improper Neutralization of Input During Web Page Generation

A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker aka Broken Link Checker plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the...

PT-2019-7418

Name of the Vulnerable Software and Affected Versions searchterms-tagging-2 plugin versions 1.535 and earlier Description The issue is related to a Cross-Site Scripting XSS vulnerability. It occurs via the count parameter in the wp-admin/options-general.php API endpoint. This allows for potential...

CVE-2015-9459: Improper Neutralization of Input During Web Page Generation

The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter...

WordPress Elementor Pro Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. elementor is a drag-and-drop page builder plugin used in it. A cross-site scripting vulnerability exists in the elementor-edit-templat...

Directory traversal

The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfbphotos parameter in a bpfbremovetempimages action...

CVE-2015-9456

The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisiusctcthemeeditorajax&subcmd=savefile theme1, theme1file, or theme1filecontents parameter...

CVE-2015-9455

The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfbphotos parameter in a bpfbremovetempimages action...

CVE-2015-9455

The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfbphotos parameter in a bpfbremovetempimages action...

CVE-2015-9454

The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin currentsliderid parameter...

CVE-2015-9452

The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nexformsId parameter...

CVE-2018-18379

The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS...

Cross site scripting

The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS...

CVE-2018-18379

The CVE-2018-18379 entry concerns the Elementor Pro WordPress plugin before version 2.0.10, where the elementor-edit-template class in wp-admin/customize.php enables cross-site scripting due to improper validation of client-side data. The vulnerability affects Elementor Pro on WordPress and is ex...

PT-2019-7410

Name of the Vulnerable Software and Affected Versions plugmatter-optin-feature-box-lite plugin version 2.0.13 and earlier Description The issue concerns a SQL injection vulnerability. It affects the wp-admin/admin-ajax.php endpoint, specifically the action=pmfb mailchimp and the pmfb tid paramete...

PT-2019-7415

Name of the Vulnerable Software and Affected Versions orbisius-child-theme-creator plugin versions prior to 1.2.8 Description The issue concerns incorrect access control for file modification. It can be exploited via the wp-admin/admin-ajax.php?action=orbisius ctc theme editor ajax&sub cmd=save...

PT-2019-7413

Name of the Vulnerable Software and Affected Versions smooth-slider plugin versions prior to 2.7 Description The issue concerns SQL Injection via the current slider id parameter in the /wp-admin/admin.php?page=smooth-slider-admin API endpoint. This allows for potential exploitation. No informatio...

CVE-2015-9456: Incorrect Permission Assignment for Critical Resource

The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisiusctcthemeeditorajax&subcmd=savefile theme1, theme1file, or theme1filecontents parameter...