CVE-2018-6469

A cross-site scripting XSS vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSStags parameter to wp-admin/options-general.php...

CVE-2018-6468

A cross-site scripting XSS vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSSid parameter to wp-admin/options-general.php...

CVE-2018-6469: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSStags parameter to wp-admin/options-general.php...

CVE-2018-6467: Cross-Site Request Forgery (CSRF)

The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php...

CVE-2018-6466: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSSset parameter to wp-admin/options-general.php...

CVE-2018-6468: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSSid parameter to wp-admin/options-general.php...

PT-2018-17563

Name of the Vulnerable Software and Affected Versions flickrRSS plugin version 5.3.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the flickrRSS set parameter to "wp-admin/options-general.php". Recommendations For version 5.3.1, consid...

PT-2018-17564

Name of the Vulnerable Software and Affected Versions flickrRSS plugin version 5.3.1 Description The issue concerns a CSRF problem. It affects the "wp-admin/options-general.php" API endpoint. Recommendations For flickrRSS plugin version 5.3.1, consider restricting access to the...

PT-2018-17565

Name of the Vulnerable Software and Affected Versions flickrRSS plugin version 5.3.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the flickrRSS id parameter to "wp-admin/options-general.php" API endpoint. Recommendations For flickrRSS...

PT-2018-17566

Name of the Vulnerable Software and Affected Versions flickrRSS plugin version 5.3.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the flickrRSS tags parameter to "wp-admin/options-general.php". Recommendations For version 5.3.1, avoid...

CVE-2018-6195

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows authenticated administrator, editor, or author remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter t...

CVE-2018-6195

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows authenticated administrator, editor, or author remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter t...

CVE-2018-6194

A cross-site scripting XSS vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search parameter to wp-admin/upload.php...

CVE-2018-6194: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search parameter to wp-admin/upload.php...

CVE-2018-6195: Improperly Controlled Modification of Object Prototype Attributes

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows authenticated administrator, editor, or author remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter t...

PT-2018-17399

Name of the Vulnerable Software and Affected Versions wp-splashing-images versions prior to 2.1.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the search parameter to "wp-admin/upload.php". Recommendations For versions prior to 2.1.1,...

CVE-2018-6357

The acxasmwsaveordercallback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant socialwidgeticonarrayorder XSS...

CVE-2018-6357

The acxasmwsaveordercallback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant socialwidgeticonarrayorder XSS...

CVE-2018-6357: Improper Neutralization of Input During Web Page Generation

The acxasmwsaveordercallback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant socialwidgeticonarrayorder XSS...

PT-2018-17500

Name of the Vulnerable Software and Affected Versions acurax-social-media-widget plugin versions prior to 3.2.6 Description The issue concerns a CSRF vulnerability via the recordsArray parameter to the "/wp-admin/admin-ajax.php" API endpoint, potentially leading to social widget icon array order...