CVE-2018-18019: Improper Neutralization of Input During Web Page Generation

XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slidetitle, Slidemediafile, or Slideimageurl parameter...

CVE-2018-18018: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Galleryid or Gallerytitle parameter...

CVE-2018-17584: Cross-Site Request Forgery (CSRF)

The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page...

CVE-2018-18017: Improper Neutralization of Input During Web Page Generation

XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Galleryid or Gallerytitle parameter...

CVE-2018-13137: Improper Neutralization of Input During Web Page Generation

The Events Manager plugin 5.9.4 for WordPress has XSS via the dbemeventreapprovedemailbody parameter to the wp-admin/edit.php?posttype=event&page=events-manager-options URI...

CVE-2019-9978: Improper Neutralization of Input During Web Page Generation

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swpdebug=loadoptions swpurl parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro...

Design/Logic Flaw

The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...

CVE-2019-9912

The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...

CVE-2019-9910: Improper Neutralization of Input During Web Page Generation

The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS...

CVE-2019-9914: Improper Neutralization of Input During Web Page Generation

The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes pollid XSS...

CVE-2019-9908: Improper Neutralization of Input During Web Page Generation

The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php managefontid XSS...

CVE-2019-9909: Improper Neutralization of Input During Web Page Generation

The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS...

CVE-2019-9911: Improper Neutralization of Input During Web Page Generation

The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS...

CVE-2019-9912: Improper Neutralization of Input During Web Page Generation

The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...

CVE-2019-9913: Improper Neutralization of Input During Web Page Generation

The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS...

CVE-2019-9787: Cross-Site Request Forgery (CSRF)

WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...

CVE-2019-9646: Improper Neutralization of Input During Web Page Generation

The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cpadminintedition.inc.php in the "custom edition area."...

CVE-2019-9575: Improper Neutralization of Input During Web Page Generation

The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlwquizresults quizid XSS...

CVE-2019-9576: Improper Neutralization of Input During Web Page Generation

The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS...

CVE-2019-9568: Improper Neutralization of Special Elements used in an SQL Command

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry parameter if the attacker has the delete permission...