PT-2018-13463

Name of the Vulnerable Software and Affected Versions UserPro plugin versions prior to 4.9.24 Description The issue allows for XSS via the shortcode parameter in a userpro shortcode template action to the "/wp-admin/admin-ajax.php" API endpoint. Recommendations For versions prior to 4.9.24, updat...

CVE-2018-16159: Improper Neutralization of Special Elements used in an SQL Command

The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the templateid parameter in a wp-admin/admin-ajax.php wpgvdoajaxfronttemplate request...

PT-2018-13432

Name of the Vulnerable Software and Affected Versions The Gift Vouchers plugin versions prior to 2.0.2 Description The issue allows SQL Injection via the template id parameter in a "wp-admin/admin-ajax.php" wpgv doajax front template request. This could potentially lead to unauthorized access to...

CVE-2018-15877: Improper Neutralization of Special Elements used in an OS Command

The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainviewactivitymonitor&tab=activitytools request...

CVE-2018-14430: Improper Neutralization of Input During Web Page Generation

The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fwdata id1, fwdata id2, fwdata id3, fwdata id4, or email field of the contact form, exploitable with an fwsendemail action to wp-admin/admin-ajax.php...

PT-2018-12508

Name of the Vulnerable Software and Affected Versions Mondula Multi Step Form plugin versions prior to 1.2.6 Description The issue allows for XSS exploitation via specific fields in the contact form, including fw data id1, fw data id2, fw data id3, fw data id4, or the email field. This can be...

Design/Logic Flaw

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...

CVE-2018-13136

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...

CVE-2018-13136

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...

CVE-2018-13136

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...

CVE-2018-13136

CVE-2018-13136 affects the WordPress plugin Ultimate Member (aka ultimatemember) for versions prior to 2.0.18, exposing a cross-site scripting (XSS) vulnerability via the wp-admin settings screen. The issue is documented across multiple sources (CNVD/EUVD/OpenVAS/NVD/CVE records) as an XSS in thi...

CVE-2018-13136: Improper Neutralization of Input During Web Page Generation

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...

PT-2018-11625

Name of the Vulnerable Software and Affected Versions The Ultimate Member plugin versions prior to 2.0.18 Description The issue allows for XSS via the wp-admin settings screen. Recommendations For versions prior to 2.0.18, update to version 2.0.18 or later to resolve the issue...

innebandycuper.se XSS vulnerability

Open Bug Bounty ID: OBB-638038 Description| Value ---|--- Affected Website:| innebandycuper.se Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

longes.fr XSS vulnerability

Open Bug Bounty ID: OBB-638019 Description| Value ---|--- Affected Website:| longes.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

auftakt-musikschule.de XSS vulnerability

Open Bug Bounty ID: OBB-637680 Description| Value ---|--- Affected Website:| auftakt-musikschule.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

tejnif.dk XSS vulnerability

Open Bug Bounty ID: OBB-637593 Description| Value ---|--- Affected Website:| tejnif.dk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-12895

CVE-2018-12895 affects WordPress up to version 4.9.6. An Author (needs files and posts capabilities) can trigger directory traversal via the thumb parameter in wp-admin/post.php, causing the PHP unlink call to delete wp-config.php through a missing filename validation in wp-includes/post.php wp_d...

CVE-2018-12895

WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the...

CVE-2018-12895: Improper Limitation of a Pathname to a Restricted Directory

WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the...