1359 matches found
PT-2019-8534
Name of the Vulnerable Software and Affected Versions postman-smtp plugin through 2017-10-04 for WordPress Description The issue concerns a cross-site scripting XSS problem. It is exploited via the page parameter in the "wp-admin/tools.php" page, specifically when accessing the postman email log...
CVE-2017-18603: Improper Neutralization of Input During Web Page Generation
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postmanemaillog page parameter...
CVE-2017-18602: Improper Neutralization of Special Elements used in an SQL Command
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examappUserResult id parameter...
PT-2019-10438
Name of the Vulnerable Software and Affected Versions Swape theme for WordPress versions prior to 1.2.1 Description The issue concerns incorrect access control in the Swape theme for WordPress. This allows unauthorized creation of new administrator accounts through specific vectors involving the...
CVE-2018-21013: Improper Privilege Management
The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php...
CVE-2019-15873
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pmtemplatepreview&html=?php substring followed by PHP code...
PT-2019-14453
Name of the Vulnerable Software and Affected Versions profilegrid-user-profiles-groups-and-communities plugin versions prior to 2.8.6 Description The issue allows for remote code execution. This can be achieved through a request to the wp-admin/admin-ajax.php endpoint with specific parameters,...
CVE-2019-15873: Improper Control of Generation of Code
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pmtemplatepreview&html=...
CVE-2019-15829
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS...
PT-2019-14418
Name of the Vulnerable Software and Affected Versions photoblocks-grid-gallery plugin versions prior to 1.1.33 Description The issue concerns a Cross-Site Scripting XSS flaw. The "wp-admin/admin.php?page=photoblocks-edit&id=" endpoint is vulnerable to XSS attacks. The id parameter is implicated i...
CVE-2019-15829: Improper Neutralization of Input During Web Page Generation
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS...
CVE-2019-15777: Improper Neutralization of Input During Web Page Generation
The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&adminemail= XSS...
PT-2019-14319
Name of the Vulnerable Software and Affected Versions Groundhogg plugin versions prior to 1.3.5 Description The issue allows for remote code execution via the "action=bulk action listener" parameter in the wp-admin/admin-ajax.php API endpoint. Recommendations For versions prior to 1.3.5, update t...
CVE-2019-15647: Improper Control of Generation of Code
The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulkactionlistener remote code execution...
CVE-2017-18521
The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n...
PT-2019-8455
Name of the Vulnerable Software and Affected Versions democracy-poll plugin versions prior to 5.4 Description The issue concerns a CSRF problem. It can be exploited via the "wp-admin/options-general.php?page=democracy-poll&subpage=l10n" API endpoint. Recommendations For versions prior to 5.4,...
CVE-2017-18521: Cross-Site Request Forgery (CSRF)
The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n...
PT-2019-7291
Name of the Vulnerable Software and Affected Versions WordPress uninstall plugin versions prior to 1.2 Description The issue allows for CSRF, enabling the deletion of all tables via the "wp-admin/admin-ajax.php?action=uninstall" API endpoint. Recommendations For versions prior to 1.2, update to...
CVE-2015-9332: Cross-Site Request Forgery (CSRF)
The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI...