827 matches found
CVE-2015-9400: Improper Neutralization of Special Elements used in an SQL Command
The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection...
CVE-2015-9398: Improper Neutralization of Special Elements used in an SQL Command
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection...
CVE-2015-9401: Improper Neutralization of Input During Web Page Generation
The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php editstyle id XSS...
CVE-2015-9387: Cross-Site Request Forgery (CSRF)
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF...
CVE-2015-9408: Cross-Site Request Forgery (CSRF)
The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS...
CVE-2015-9397: Improper Neutralization of Input During Web Page Generation
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS...
CVE-2016-10992
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports fromyear parameter...
CVE-2016-10983: Improper Authentication
The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data...
CVE-2016-10989: Cross-Site Request Forgery (CSRF)
The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkmefacebook CSRF...
CVE-2016-10982: Cross-Site Request Forgery (CSRF)
The kento-post-view-counter plugin through 2.8 for WordPress has wp-admin/admin.php?page=kentopvcsettings CSRF...
CVE-2016-10992: Improper Neutralization of Input During Web Page Generation
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports fromyear parameter...
CVE-2016-10962
The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php optionname parameter...
CVE-2016-10962
The vulnerability CVE-2016-10962 affects the Icegram WordPress plugin prior to version 1.9.19. The issue is a Cross-Site Request Forgery (CSRF) vulnerability via the wp-admin/edit.php?option_name parameter, which could enable unauthorized actions within the plugin’s admin context. Affected softwa...
CVE-2016-10973: Improper Neutralization of Input During Web Page Generation
The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php...
CVE-2016-10959: Unrestricted Upload of File with Dangerous Type
The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload exploitable with CSRF via esmediaimages to wp-admin/admin-ajax.php...
CVE-2016-10962: Cross-Site Request Forgery (CSRF)
The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php optionname parameter...
CVE-2016-10958: Unrestricted Upload of File with Dangerous Type
The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via esmediaimages to wp-admin/admin-ajax.php...
Design/Logic Flaw
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter...
CVE-2016-10952
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter...
CVE-2017-18613: Improper Neutralization of Input During Web Page Generation
The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter...