1359 matches found
PT-2019-7021
Name of the Vulnerable Software and Affected Versions Count per Day plugin versions prior to 3.2.6 Description The issue allows for XSS exploitation via the daytoshow parameter in the /wp-admin/?page=cpd metaboxes API endpoint. Recommendations For versions prior to 3.2.6, update to version 3.2.6 ...
CVE-2013-7472: Improper Neutralization of Input During Web Page Generation
The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpdmetaboxes daytoshow parameter...
CVE-2018-18872: Improper Neutralization of Input During Web Page Generation
The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the eventtitle parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI...
PT-2019-12497
Name of the Vulnerable Software and Affected Versions WooCommerce Checkout Manager plugin versions prior to 4.3 Description The issue allows media deletion due to a lack of capabilities checks and a nopriv registration. This can be exploited via the "wp-admin/admin-ajax.php?action=update attachme...
CVE-2019-11807: Unrestricted Upload of File with Dangerous Type
The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=updateattachmentwccm wccmdefaultkeysload parameter because of a nopriv registration and a lack of capabilities checks...
CVE-2019-11590: Improper Limitation of a Pathname to a Restricted Directory
The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the latter is...
PT-2019-12400
Name of the Vulnerable Software and Affected Versions 10Web Form Maker plugin versions prior to 1.13.5 Description The issue allows for CSRF via the "wp-admin/admin-ajax.php" action parameter, potentially leading to local file inclusion through directory traversal. This is due to a discrepancy...
CVE-2019-11557: Improper Limitation of a Pathname to a Restricted Directory
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the...
Sql injection
SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Galleryid or Gallerytitle parameter...
PT-2019-9547
Name of the Vulnerable Software and Affected Versions Tribulant Slideshow Gallery plugin version 1.6.8 Description A security issue exists in the Tribulant Slideshow Gallery plugin for WordPress, allowing for XSS attacks. This is possible through the...
PT-2019-9509
Name of the Vulnerable Software and Affected Versions WP Fastest Cache plugin version 0.8.8.5 Description The issue concerns a CSRF problem. It affects the wp-admin/admin.php page, specifically the wpfastestcacheoptions section. Recommendations For WP Fastest Cache plugin version 0.8.8.5, conside...
PT-2019-9545
Name of the Vulnerable Software and Affected Versions Tribulant Slideshow Gallery plugin version 1.6.8 Description A security issue exists in the Tribulant Slideshow Gallery plugin for WordPress, allowing for XSS attacks. This is possible via the...
CVE-2018-18019: Improper Neutralization of Input During Web Page Generation
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slidetitle, Slidemediafile, or Slideimageurl parameter...
CVE-2018-18018: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Galleryid or Gallerytitle parameter...
CVE-2018-18017: Improper Neutralization of Input During Web Page Generation
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Galleryid or Gallerytitle parameter...
CVE-2018-17584: Cross-Site Request Forgery (CSRF)
The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page...
PT-2019-9546
Name of the Vulnerable Software and Affected Versions Tribulant Slideshow Gallery plugin version 1.6.8 Description The issue exists due to SQL Injection in the Tribulant Slideshow Gallery plugin for WordPress. This can be exploited via the "wp-admin/admin.php?page=slideshow-galleries&method=save"...
CVE-2018-13137: Improper Neutralization of Input During Web Page Generation
The Events Manager plugin 5.9.4 for WordPress has XSS via the dbemeventreapprovedemailbody parameter to the wp-admin/edit.php?posttype=event&page=events-manager-options URI...
CVE-2019-9978: Improper Neutralization of Input During Web Page Generation
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swpdebug=loadoptions swpurl parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro...