CVE-2019-9912

The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...

PT-2019-19932

Name of the Vulnerable Software and Affected Versions yop-poll plugin versions prior to 6.0.3 Description The issue affects the yop-poll plugin, allowing for XSS through the poll id parameter in the "view-votes" action, accessible via the /wp-admin/admin.php?page=yop-polls&action=view-votes...

CVE-2019-9914: Improper Neutralization of Input During Web Page Generation

The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes pollid XSS...

CVE-2019-9912: Improper Neutralization of Input During Web Page Generation

The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...

CVE-2019-9910: Improper Neutralization of Input During Web Page Generation

The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS...

PT-2019-19926

Name of the Vulnerable Software and Affected Versions WordPress font-organizer plugin version 2.1.1 Description The issue concerns a Cross-Site Scripting XSS vulnerability in the font-organizer plugin for WordPress, specifically affecting the management of font IDs through the...

CVE-2019-9913: Improper Neutralization of Input During Web Page Generation

The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS...

CVE-2019-9911: Improper Neutralization of Input During Web Page Generation

The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS...

CVE-2019-9908: Improper Neutralization of Input During Web Page Generation

The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php managefontid XSS...

CVE-2019-9909: Improper Neutralization of Input During Web Page Generation

The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS...

CVE-2019-9787

WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...

CVE-2019-9787: Cross-Site Request Forgery (CSRF)

WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...

CVE-2019-9646: Improper Neutralization of Input During Web Page Generation

The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cpadminintedition.inc.php in the "custom edition area."...

PT-2019-19721

Name of the Vulnerable Software and Affected Versions Blog2Social plugin versions prior to 5.0.3 Description The issue allows for XSS in the wp-admin/admin.php?page=blog2social-ship API endpoint. No information is provided about the estimated number of potentially affected devices or real-world...

CVE-2019-9575: Improper Neutralization of Input During Web Page Generation

The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlwquizresults quizid XSS...

CVE-2019-9576: Improper Neutralization of Input During Web Page Generation

The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS...

PT-2019-19720

Name of the Vulnerable Software and Affected Versions The Quiz And Survey Master plugin version 6.0.4 Description The issue allows for a quiz id XSS in the wp-admin/admin.php?page=mlw quiz results page. Recommendations For The Quiz And Survey Master plugin version 6.0.4, update to a newer version...

CVE-2019-9568: Improper Neutralization of Special Elements used in an SQL Command

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry parameter if the attacker has the delete permission...

WordPress_4.9.8_RCE_POC

Summary A simple PoC for WordPress RCE author priviledge, re...

PT-2019-11257

Name of the Vulnerable Software and Affected Versions: MapSVG Lite versions prior to 3.3.0 Description: The issue allows an attacker to modify post data, including embedding javascript, due to a Cross Site Request Forgery CSRF vulnerability in the REST endpoint...