1359 matches found
CVE-2016-10959
The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload exploitable with CSRF via esmediaimages to wp-admin/admin-ajax.php...
CVE-2016-10958
The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via esmediaimages to wp-admin/admin-ajax.php...
PT-2019-7751
Name of the Vulnerable Software and Affected Versions Estatik plugin versions prior to 2.3.0 for WordPress Description The issue allows for unauthenticated arbitrary file upload. This is achieved by exploiting the es media images parameter in the "wp-admin/admin-ajax.php" API endpoint...
CVE-2016-10958: Unrestricted Upload of File with Dangerous Type
The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via esmediaimages to wp-admin/admin-ajax.php...
CVE-2016-10973: Improper Neutralization of Input During Web Page Generation
The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php...
CVE-2016-10962: Cross-Site Request Forgery (CSRF)
The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php optionname parameter...
CVE-2016-10959: Unrestricted Upload of File with Dangerous Type
The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload exploitable with CSRF via esmediaimages to wp-admin/admin-ajax.php...
Design/Logic Flaw
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter...
CVE-2016-10952
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter...
CVE-2016-10944
The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF...
PT-2019-7745
Name of the Vulnerable Software and Affected Versions quotes-collection plugin versions prior to 2.0.6 Description The issue concerns a Cross-Site Scripting XSS vulnerability. It affects the quotes-collection plugin for WordPress, specifically via the wp-admin/admin.php?page=quotes-collection pag...
PT-2019-7737
Name of the Vulnerable Software and Affected Versions multisite-post-duplicator plugin versions prior to 1.1.3 Description The issue concerns a CSRF vulnerability in the multisite-post-duplicator plugin for WordPress. It affects the wp-admin/tools.php?page=mpd endpoint. Recommendations For versio...
PT-2019-8544
Name of the Vulnerable Software and Affected Versions trust-form plugin version 2.0 Description The issue concerns a problem with the trust-form plugin for WordPress, where there is a potential for XSS via the "page" parameter in the wp-admin/admin.php page, specifically when editing trust forms...
CVE-2016-10945: Cross-Site Request Forgery (CSRF)
The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF...
CVE-2017-18613: Improper Neutralization of Input During Web Page Generation
The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter...
CVE-2016-10952: Improper Neutralization of Input During Web Page Generation
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter...
CVE-2016-10944: Cross-Site Request Forgery (CSRF)
The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF...
CVE-2017-18603
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postmanemaillog page parameter...
PT-2019-12838
Name of the Vulnerable Software and Affected Versions SlickQuiz plugin for WordPress versions through 1.3.7.1 Description A stored XSS issue was discovered, allowing unauthenticated users to submit malicious data via the /wp-admin/admin-ajax.php endpoint, specifically through the save quiz score...
PT-2019-12837
Name of the Vulnerable Software and Affected Versions SlickQuiz plugin versions prior to 1.3.7.2 Description The issue allows SQL Injection by Subscriber users. This can be demonstrated through specific API endpoints such as "/wp-admin/admin.php?page=slickquiz-scores&id=",...