CVE-2015-9397: Improper Neutralization of Input During Web Page Generation

The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS...

CVE-2015-9394: Cross-Site Request Forgery (CSRF)

The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=packageaddnew to wp-admin/admin-ajax.php...

CVE-2015-9388: Cross-Site Request Forgery (CSRF)

The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS...

CVE-2015-9398: Improper Neutralization of Special Elements used in an SQL Command

The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection...

CVE-2015-9387: Cross-Site Request Forgery (CSRF)

The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF...

CVE-2015-9408: Cross-Site Request Forgery (CSRF)

The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS...

CVE-2016-10992

The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports fromyear parameter...

CVE-2016-10989

The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkmefacebook CSRF...

CVE-2016-10983

The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data...

PT-2019-7782

Name of the Vulnerable Software and Affected Versions leenkme plugin versions prior to 2.6.0 Description The issue concerns a CSRF problem in the leenkme plugin for WordPress. The affected endpoint is "wp-admin/admin.php?page=leenkme facebook". Recommendations For versions prior to 2.6.0, update ...

PT-2019-7776

Name of the Vulnerable Software and Affected Versions WordPress ghost plugin versions prior to 0.5.6 Description The issue concerns a lack of access control in the ghost plugin for WordPress, allowing unauthorized downloads of exported data through the "wp-admin/tools.php?ghostexport=true"...

PT-2019-7775

Name of the Vulnerable Software and Affected Versions kento-post-view-counter plugin versions prior to 2.8 Description The issue concerns a CSRF problem in the kento-post-view-counter plugin for WordPress, specifically affecting the wp-admin/admin.php?page=kentopvc settings page. Recommendations...

PT-2019-7785

Name of the Vulnerable Software and Affected Versions music-store plugin versions prior to 1.0.43 Description The issue allows for XSS via the "from year" parameter in the "/wp-admin/admin.php?page=music-store-menu-reports" API endpoint. Recommendations For music-store plugin versions prior to...

CVE-2016-10989: Cross-Site Request Forgery (CSRF)

The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkmefacebook CSRF...

CVE-2016-10992: Improper Neutralization of Input During Web Page Generation

The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports fromyear parameter...

CVE-2016-10983: Improper Authentication

The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data...

CVE-2016-10982: Cross-Site Request Forgery (CSRF)

The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvcsettings CSRF...

CVE-2016-10962

The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php optionname parameter...

CVE-2016-10962

The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php optionname parameter...

CVE-2016-10962

The vulnerability CVE-2016-10962 affects the Icegram WordPress plugin prior to version 1.9.19. The issue is a Cross-Site Request Forgery (CSRF) vulnerability via the wp-admin/edit.php?option_name parameter, which could enable unauthorized actions within the plugin’s admin context. Affected softwa...