CVE-2015-9420

The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=getsoundcloudplayer id parameter...

PT-2019-7398

Name of the Vulnerable Software and Affected Versions addthis plugin versions prior to 5.0.13 Description The issue concerns a CSRF vulnerability that can lead to XSS. It is exploited via the "pubid" parameter in the "/wp-admin/options-general.php?page=addthis social widget" API endpoint...

CVE-2015-9448: Improper Neutralization of Special Elements used in an SQL Command

The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter...

PT-2019-7405

Name of the Vulnerable Software and Affected Versions unite-gallery-lite plugin versions prior to 1.5 Description The issue allows for SQL injection. This can be achieved through the datagalleryID variable in the /wp-admin/admin-ajax.php API endpoint. Recommendations For unite-gallery-lite plugin...

PT-2019-7382

Name of the Vulnerable Software and Affected Versions PlugNedit Adaptive Editor plugin versions prior to 6.2.0 Description The issue concerns a cross-site scripting XSS problem. It affects the wp-admin/admin-ajax.php endpoint, specifically when the action parameter is set to "simple fields field...

PT-2019-7387

Name of the Vulnerable Software and Affected Versions wplegalpages plugin versions prior to 1.1 Description The issue concerns a CSRF with resultant XSS. It is exploitable via the wp-admin/admin.php?page=legal-pages endpoint with parameters such as lp-domain-name, lp-business-name, lp-phone,...

PT-2019-7384

Name of the Vulnerable Software and Affected Versions Social-locker plugin versions prior to 4.2.5 for WordPress Description The issue concerns a CSRF with resultant XSS in the social-locker plugin for WordPress. This occurs via the licensekey parameter in the "/wp-admin/edit.php?post...

PT-2019-7393

Name of the Vulnerable Software and Affected Versions kiwi-logo-carousel plugin versions prior to 1.7.2 Description The issue concerns a CSRF vulnerability that can lead to XSS. It is exploitable via the "wp-admin/edit.php" endpoint, specifically through the post type, page, tab, or tab flags ord...

PT-2019-7388

Name of the Vulnerable Software and Affected Versions yith-maintenance-mode plugin versions prior to 1.2.0 Description The issue concerns a CSRF vulnerability with resultant XSS in the yith-maintenance-mode plugin for WordPress. This can be exploited via the...

PT-2019-7392

Name of the Vulnerable Software and Affected Versions wp-social-bookmarking-light plugin versions prior to 1.7.10 Description The issue concerns a CSRF vulnerability that can lead to XSS, specifically via configuration parameters for social media platforms such as Tumblr, Twitter, and Facebook...

PT-2019-7391

Name of the Vulnerable Software and Affected Versions alpine-photo-tile-for-instagram plugin versions prior to 1.2.7.6 Description The issue concerns a CSRF vulnerability that can lead to XSS. It is exploited via the "tab" parameter in the...

PT-2019-7402

Name of the Vulnerable Software and Affected Versions accurate-form-data-real-time-form-validation plugin version 1.2 Description The issue concerns a CSRF vulnerability that can lead to XSS. It is exploited via the wp-admin/options-general.php?page=Accu Data WP endpoint. Recommendations For...

PT-2019-7400

Name of the Vulnerable Software and Affected Versions Bookmarkify plugin version 2.9.2 for WordPress Description The issue concerns a CSRF vulnerability that leads to XSS. It is exploited via the "wp-admin/options-general.php?page=bookmarkify.php" API endpoint. Recommendations For Bookmarkify...

PT-2019-7399

Name of the Vulnerable Software and Affected Versions monetize plugin versions through 1.03 Description The issue concerns a CSRF vulnerability that leads to XSS. It can be exploited via the "wp-admin/admin.php?page=monetize-zones-new" endpoint. Recommendations For monetize plugin versions throug...

PT-2019-7404

Name of the Vulnerable Software and Affected Versions unite-gallery-lite plugin versions prior to 1.5 Description The issue concerns a unite-gallery-lite plugin for WordPress, where there is a potential for CSRF and SQL injection attacks. This can occur via the wp-admin/admin-ajax.php endpoint in...

PT-2019-7406

Name of the Vulnerable Software and Affected Versions unite-gallery-lite plugin versions prior to 1.5 Description The issue concerns CSRF and SQL injection flaws. Specifically, the galleryid or id parameters in wp-admin/admin.php are vulnerable. Recommendations For unite-gallery-lite plugin...

PT-2019-7407

Name of the Vulnerable Software and Affected Versions sendpress plugin versions prior to 1.2 Description The issue allows for SQL Injection via the "listid" parameter in the wp-admin/admin.php?page=sp-queue endpoint. Recommendations For versions prior to 1.2, update to version 1.2 or later to...

PT-2019-7408

Name of the Vulnerable Software and Affected Versions microblog-poster plugin versions prior to 1.6.2 Description The issue allows for SQL Injection via the account id parameter in the "wp-admin/options-general.php?page=microblogposter.php" API endpoint. Recommendations For versions prior to 1.6....

CVE-2015-9441: Cross-Site Request Forgery (CSRF)

The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php...

CVE-2015-9442: Cross-Site Request Forgery (CSRF)

The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenirplugin...