CVE-2015-9440: Cross-Site Request Forgery (CSRF)

The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new...

CVE-2015-9413

The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter...

PT-2019-7372

Name of the Vulnerable Software and Affected Versions eshop plugin for WordPress versions through 6.3.13 Description The issue concerns a CSRF with resultant XSS in the eshop plugin for WordPress. This occurs via the "title" parameter in the "/wp-admin/admin.php?page=eshop-downloads.php" API...

CVE-2015-9413: Cross-Site Request Forgery (CSRF)

The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter...

CVE-2015-9400

The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection...

CVE-2015-9398

The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection...

Cross site scripting

The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php editstyle id XSS...

CVE-2015-9398

The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection...

CVE-2015-9397

The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS...

PT-2019-7353

Name of the Vulnerable Software and Affected Versions users-ultra plugin versions prior to 1.5.63 for WordPress Description The issue concerns a CSRF vulnerability. It can be exploited via the action=package add new parameter to the "/wp-admin/admin-ajax.php" API endpoint. Recommendations For...

PT-2019-7805

Name of the Vulnerable Software and Affected Versions sola-support-tickets plugin versions prior to 3.13 Description The issue is related to incorrect access control, which results in a cross-site scripting XSS flaw. This affects the /wp-admin API endpoint. Recommendations For versions prior to...

PT-2019-7346

Name of the Vulnerable Software and Affected Versions mtouch-quiz plugin versions prior to 3.1.3 for WordPress Description The issue concerns a CSRF vulnerability in the wp-admin/options-general.php endpoint. This allows for potential unauthorized actions. No information is provided about the...

PT-2019-7347

Name of the Vulnerable Software and Affected Versions mtouch-quiz plugin versions prior to 3.1.3 for WordPress Description The issue concerns a CSRF Cross-Site Request Forgery vulnerability in the wp-admin/edit.php endpoint, which can lead to XSS Cross-Site Scripting. This allows an attacker to...

PT-2019-7356

Name of the Vulnerable Software and Affected Versions gocodes plugin for WordPress versions through 1.3.5 Description The issue concerns a deletegc XSS in the wp-admin/tools.php file. This affects the gocodes plugin for WordPress, potentially allowing for cross-site scripting attacks...

PT-2019-7357

Name of the Vulnerable Software and Affected Versions gocodes plugin for WordPress versions through 1.3.5 Description The issue concerns a SQL injection vulnerability in the gocodes plugin for WordPress, specifically affecting the wp-admin/tools.php endpoint with the gcid parameter. This allows f...

PT-2019-7359

Name of the Vulnerable Software and Affected Versions wordpress-meta-robots plugin versions through 2.1 Description The issue concerns a text SQL injection in the wp-admin/post-new.php page of the wordpress-meta-robots plugin for WordPress. Recommendations For wordpress-meta-robots plugin version...

PT-2019-7360

Name of the Vulnerable Software and Affected Versions websimon-tables plugin versions 1.3.4 and earlier Description The issue concerns a Cross-Site Scripting XSS vulnerability, specifically related to the edit style id parameter in the wp-admin/tools.php endpoint. This allows for potential...

PT-2019-7367

Name of the Vulnerable Software and Affected Versions xpinner-lite plugin versions through 2.2 for WordPress Description The issue concerns a CSRF vulnerability with resultant XSS in the wp-admin/options-general.php endpoint. This allows for cross-site request forgery attacks that can lead to...

CVE-2015-9401: Improper Neutralization of Input During Web Page Generation

The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php editstyle id XSS...

CVE-2015-9400: Improper Neutralization of Special Elements used in an SQL Command

The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection...