CVE-2026-8626: Improper Neutralization of Input During Web Page Generation

The SponsorMe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHPSELF Parameter in all versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

PT-2024-11586

Name of the Vulnerable Software and Affected Versions Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress versions up to, and including, 2.4.17.1 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows...

PT-2024-15129

Name of the Vulnerable Software and Affected Versions Limit Login Attempts Reloaded plugin for WordPress versions up to, and including, 2.25.26 Description The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output escaping on...

Fast Flow < 1.2.13 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Create/edit a dashboard with an HTML widget...

Sql injection

A vulnerability classified as critical has been found in Kama Click Counter Plugin up to 3.4.8. This affects an unknown part of the file wp-admin/admin.php. The manipulation of the argument orderby/order with the input ASC%2cselectfromselectsleep2a leads to sql injection Blind. It is possible to...

CVE-2017-20103

CVE-2017-20103 describes a blind SQL injection in the Kama Click Counter Plugin (up to version 3.4.8) affecting wp-admin/admin.php via the order_by/order parameter (ASC, (select sleep(2))). The vulnerability can be exploited remotely and the public exploit has been disclosed. Upgrading to version...

CVE-2017-20103 Kama Click Counter Plugin admin.php Blind sql injection

A vulnerability classified as critical has been found in Kama Click Counter Plugin up to 3.4.8. This affects an unknown part of the file wp-admin/admin.php. The manipulation of the argument orderby/order with the input ASC%2cselectfromselectsleep2a leads to sql injection Blind. It is possible to...

CVE-2017-20103: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical has been found in Kama Click Counter Plugin up to 3.4.8. This affects an unknown part of the file wp-admin/admin.php. The manipulation of the argument orderby/order with the input ASC%2cselectfromselectsleep2a leads to sql injection Blind. It is possible to...

PT-2022-7976

Name of the Vulnerable Software and Affected Versions Kama Click Counter Plugin versions up to 3.4.8 Description A critical vulnerability has been found in the Kama Click Counter Plugin. This issue affects an unknown part of the file wp-admin/admin.php. The manipulation of the order by/order...

PT-2021-3318

Name of the Vulnerable Software and Affected Versions DSGVO All in one for WP versions prior to 4.0 Description The issue is related to the failure to neutralize special elements, which can lead to cross-site scripting XSS attacks. An unauthenticated attacker can exploit this by submitting...

PT-2021-15723

Name of the Vulnerable Software and Affected Versions: File Manager WordPress plugin versions prior to 7.1 Description: A Reflected XSS issue can occur in the default configuration of the plugin when a payload is submitted on the User-Agent parameter. This payload is then reflected back on the we...

CVE-2021-24177: Improper Neutralization of Input During Web Page Generation

In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wpfilemanagerproperties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response...

PT-2020-17138

Name of the Vulnerable Software and Affected Versions SabaiApp Directories Pro plugin version 1.3.45 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a POST to "/wp-admin/admin.php?page=drts/directories&q=%2F" with the drts form build...

CVE-2019-19109: Cross-Site Request Forgery (CSRF)

The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF...

PT-2020-10051

Name of the Vulnerable Software and Affected Versions wpForo plugin version 1.6.5 Description The issue concerns a CSRF vulnerability in the wpForo plugin for WordPress. It affects the "wp-admin/admin.php?page=wpforo-usergroups" endpoint. There is no information provided about the estimated numbe...

CVE-2019-19110: Improper Neutralization of Input During Web Page Generation

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter...

CVE-2019-19111: Improper Neutralization of Input During Web Page Generation

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter...

PT-2020-10053

Name of the Vulnerable Software and Affected Versions wpForo plugin version 1.6.5 Description The issue allows for XSS via the "wp-admin/admin.php?page=wpforo-phrases" API endpoint, specifically through the langid parameter. Recommendations For wpForo plugin version 1.6.5, avoid using the langid...

PT-2020-20618

Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar plugin versions prior to 1.3.35 Description The issue allows user input in fields such as Description or Name in any booking form to be any formula. This input could then be exported via the Bookings list tab in...

PT-2020-7816

Name of the Vulnerable Software and Affected Versions: Huge-IT Slider slider-image plugin versions prior to 2.7.0 Description: The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved via the removeslide parameter in a popup posts or edit cat action in the...