CVE-2019-14791: Improper Neutralization of Input During Web Page Generation

The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter...

CVE-2019-14796: Improper Neutralization of Input During Web Page Generation

The mq-woocommerce-products-price-bulk-edit aka Woocommerce Products Price Bulk Edit plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=updateoptions showproductspagelimit parameter...

CVE-2016-10865: Cross-Site Request Forgery (CSRF)

The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery CSRF via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS...

CVE-2019-14680

The admin-renamer-extended aka Admin renamer extended plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF...

CVE-2019-14682

The acf-better-search aka ACF: Better Search plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbsadminpage CSRF...

PT-2019-5819

Name of the Vulnerable Software and Affected Versions ARPrice Lite plugin version 2.2 for WordPress Description The issue is related to insufficient protection against CSRF requests in the ARPrice Lite plugin for WordPress. This can allow a remote attacker to perform a CSRF attack. The specific...

PT-2019-13777

Name of the Vulnerable Software and Affected Versions Deny All Firewall plugin versions prior to 1.1.7 Description The issue allows for a CSRF attack via the wp-admin/options-general.php?page=daf settings&daf remove=true endpoint, potentially affecting the security of WordPress installations usin...

PT-2019-13825

Name of the Vulnerable Software and Affected Versions Woody ad snippets plugin versions prior to 2.2.6 Description The issue concerns the "Woody ad snippets" plugin for WordPress, where a problem in the admin/includes/class.actions.snippet.php file allows unauthorized post deletion through the...

PT-2019-13778

Name of the Vulnerable Software and Affected Versions acf-better-search plugin versions prior to 3.3.1 Description The issue allows for a CSRF attack via the wp-admin/options-general.php?page=acfbs admin page endpoint. Recommendations For acf-better-search plugin versions prior to 3.3.1, update t...

CVE-2019-14679: Cross-Site Request Forgery (CSRF)

core/views/arpriceimportexport.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arpliteimportexport CSRF...

CVE-2019-14680: Cross-Site Request Forgery (CSRF)

The admin-renamer-extended aka Admin renamer extended plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF...

CVE-2019-14773: Undefined Security Weakness

admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion...

CVE-2019-14774: Improper Neutralization of Input During Web Page Generation

The woo-variation-swatches aka Variation Swatches for WooCommerce plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter...

CVE-2019-14681: Cross-Site Request Forgery (CSRF)

The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=dafsettings&dafremove=true CSRF...

CVE-2019-14682: Cross-Site Request Forgery (CSRF)

The acf-better-search aka ACF: Better Search plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbsadminpage CSRF...

CVE-2019-14683: Cross-Site Request Forgery (CSRF)

The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acuideleteattachment CSRF...

CVE-2019-14364: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpxname wp-admin/admin-ajax.php POST parameter...

PT-2019-13033

Name of the Vulnerable Software and Affected Versions wp-code-highlightjs plugin through 0.6.2 for WordPress Description An issue was discovered that allows CSRF, as demonstrated by an XSS payload in the hljs additional css parameter, via the "wp-admin/options-general.php?page=wp-code-highlight-j...

PT-2019-13279

Name of the Vulnerable Software and Affected Versions CRUDLab WP Like Button plugin versions prior to 1.6.1 Description The issue allows unauthenticated attackers to change settings due to an authentication bypass. The contains function in wp like button.php did not check if the current request i...

Essential Real Estate <= 1.7.1 - XSS

Multiple XSS across the plugin Example: https:///wp-admin/edit.php?poststatus=all&posttype=userpackage&packageuser="&filteraction=Filter&paged=1 https:///wp-admin/edit.php?poststatus=all&posttype=property&propertyauthor="&propertyidentity&filteraction=Filter&paged=1...