PT-2019-9723

Name of the Vulnerable Software and Affected Versions Media File Manager plugin version 1.4.2 Description The issue allows for arbitrary file movement through a ../ directory traversal in the dir from and dir to parameters of an mrelocator move action to the "wp-admin/admin-ajax.php" URI...

PT-2019-9722

Name of the Vulnerable Software and Affected Versions Media File Manager plugin version 1.4.2 Description The issue allows for XSS via the dir parameter of an mrelocator getdir action to the "wp-admin/admin-ajax.php" API endpoint. Recommendations For Media File Manager plugin version 1.4.2, avoid...

PT-2019-9721

Name of the Vulnerable Software and Affected Versions Media File Manager plugin version 1.4.2 Description The issue allows directory listing via a ../ directory traversal in the dir parameter of an mrelocator getdir action to the "wp-admin/admin-ajax.php" URI. Recommendations For Media File Manag...

CVE-2018-19040: Improper Limitation of a Pathname to a Restricted Directory

The Media File Manager plugin 1.4.2 for WordPress allows directory listing via a ../ directory traversal in the dir parameter of an mrelocatorgetdir action to the wp-admin/admin-ajax.php URI...

CVE-2018-19041: Improper Neutralization of Input During Web Page Generation

The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocatorgetdir action to the wp-admin/admin-ajax.php URI...

CVE-2016-10736: Improper Neutralization of Input During Web Page Generation

The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpspmessageclass parameter...

PT-2019-7535

Name of the Vulnerable Software and Affected Versions Social Pug - Easy Social Share Buttons plugin versions prior to 1.2.6 Description The issue allows for XSS via the dpsp message class parameter in the "wp-admin/admin.php?page=dpsp-toolkit" API endpoint. Recommendations For Social Pug - Easy...

CVE-2018-20368: Improper Neutralization of Input During Web Page Generation

The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback...

CVE-2018-14846

The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php...

CVE-2018-14846: Improper Neutralization of Input During Web Page Generation

The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php...

PT-2018-12759

Name of the Vulnerable Software and Affected Versions Mondula Multi Step Form plugin versions prior to 1.2.8 Description The issue concerns multiple stored XSS instances. The vulnerability can be exploited via the "wp-admin/admin-ajax.php" API endpoint. Recommendations For versions prior to 1.2.8...

CVE-2018-19564

Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters ikcfclient and ikcfposition and ikcfother have Cross-Site Scripting...

CVE-2018-19564: Improper Neutralization of Input During Web Page Generation

Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters ikcfclient and ikcfposition and ikcfother have Cross-Site Scripting...

PT-2018-15008

Name of the Vulnerable Software and Affected Versions Easy Testimonials plugin version 3.2 for WordPress Description A Stored XSS issue was found, allowing for Cross-Site Scripting through the ikcf client, ikcf position, and ikcf other parameters in the wp-admin/post.php endpoint. Recommendations...

WordPress 4.5.x < 4.5.12 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

Design/Logic Flaw

XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page request...

CVE-2018-18069: Improper Neutralization of Input During Web Page Generation

processforms in the WPML aka sitepress-multilingual-cms plugin through 3.6.3 for WordPress has XSS via any localefilename parameter such as localefilenameen in an authenticated theme-localization.php request to wp-admin/admin.php...

PT-2018-13920

Name of the Vulnerable Software and Affected Versions Quizlord plugin versions prior to 2.1 Description The issue allows for Stored XSS attacks through the title parameter in a ql insert action to "wp-admin/admin.php". Recommendations For Quizlord plugin versions prior to 2.1, update to version 2...

CVE-2018-17140: Improper Neutralization of Input During Web Page Generation

The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a qlinsert action to wp-admin/admin.php...

CVE-2018-16285: Improper Neutralization of Input During Web Page Generation

The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userproshortcodetemplate action to wp-admin/admin-ajax.php...