827 matches found
CVE-2016-10945: Cross-Site Request Forgery (CSRF)
The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF...
CVE-2016-10944: Cross-Site Request Forgery (CSRF)
The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF...
CVE-2016-10952: Improper Neutralization of Input During Web Page Generation
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter...
CVE-2017-18603
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postmanemaillog page parameter...
CVE-2017-18602: Improper Neutralization of Special Elements used in an SQL Command
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examappUserResult id parameter...
CVE-2017-18603: Improper Neutralization of Input During Web Page Generation
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postmanemaillog page parameter...
CVE-2018-21013: Improper Privilege Management
The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php...
CVE-2019-15873: Improper Control of Generation of Code
The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pmtemplatepreview&html=...
CVE-2019-15829: Improper Neutralization of Input During Web Page Generation
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS...
CVE-2019-15777: Improper Neutralization of Input During Web Page Generation
The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&adminemail= XSS...
CVE-2019-15647: Improper Control of Generation of Code
The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulkactionlistener remote code execution...
CVE-2017-18521: Cross-Site Request Forgery (CSRF)
The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n...
CVE-2015-9332: Cross-Site Request Forgery (CSRF)
The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI...
CVE-2019-14789: Improper Neutralization of Input During Web Page Generation
The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter...
CVE-2019-14795: Improper Neutralization of Input During Web Page Generation
The toggle-the-title aka Toggle The Title plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=updatetitleoptions isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter...
CVE-2019-14790: Improper Neutralization of Input During Web Page Generation
The limb-gallery aka Limb Gallery plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,...
Sql injection
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfcwppollsajaxrequest via the pollid parameter...
CVE-2019-14216: Cross-Site Request Forgery (CSRF)
An issue was discovered in the svg-vector-icon-plugin aka WP SVG Icons plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mishandles Custom Icon uploads. CSRF leads to upload of a ZIP archive containing a .php file...
CVE-2015-9316: Improper Neutralization of Special Elements used in an SQL Command
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfcwppollsajaxrequest via the pollid parameter...
CVE-2019-14796
The mq-woocommerce-products-price-bulk-edit aka Woocommerce Products Price Bulk Edit plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=updateoptions showproductspagelimit parameter...