1367 matches found
CVE-2015-4065: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php...
PT-2015-6403
Name of the Vulnerable Software and Affected Versions NewStatPress plugin versions prior to 0.9.9 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by exploiting the where1 parameter in the nsp search page to wp-admin/admin.php...
WordPress Landing Pages Plugin <= 1.8.4 - XSS
Cross-site scripting XSS vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php. Solution Upgrade the plugin...
PT-2015-6388
Name of the Vulnerable Software and Affected Versions FeedWordPress plugin versions prior to 2015.0514 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the link ids parameter in an Update action in the "syndication.php" page to...
PT-2018-4249
Name of the Vulnerable Software and Affected Versions Brute Force Login Protection module version 1.3 for WordPress Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack user authentication for requests with unknown impact. This is achieved through a...
WordPress LeagueManager Plugin <= 3.7 - Cross Site Scripting
This plugin is prone to a wp-admin/admin.php multiple parameter cross site scripting vulnerability. Solution Update the plugin...
WordPress WP Photo Album Plus Plugin <= 5.0.10 - XSS
This plugin is prone to wp-admin/admin.php editid parameter cross site scripting vulnerability. Solution Update the plugin...
WordPress Rockhoist Ratings Plugin <= 1.2.2 - SQL Injection
This plugin is prone to an SQL injection vulnerability in wp-admin/admin-ajax.php postID parameter. Solution Update the plugin...
CVE-2015-3986: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attack...
CVE-2015-3300: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the 1 billingfirstname, 2 billinglastname, 3...
CVE-2014-9311
Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...
CVE-2014-9311: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...
PT-2015-4182
Name of the Vulnerable Software and Affected Versions Shareaholic plugin versions prior to 7.6.1.0 for WordPress Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter i...
CVE-2015-2755
Multiple cross-site request forgery CSRF vulnerabilities in the AB Google Map Travel AB-MAP plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 lat Latitude, 2 long Longitude, 3...
CVE-2015-2755: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in the AB Google Map Travel AB-MAP plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 lat Latitude, 2 long Longitude, 3...
Wordpress WP Marketplace 2.4.0 - Remote Code Execution (Add WP Admin) Vulnerability
WordPress Marketplace plugin version 2.4.0 add administrator exploit that leverages a vulnerability that allows an attacker to execute any php function unauthenticated. !/usr/bin/python Exploit Name: WP Marketplace 2.4.0 Remote Command Execution Vulnerability discovered by Kacper Szurek...
PT-2015-5698
Name of the Vulnerable Software and Affected Versions WordPress SEO by Yoast plugin versions 1.5.7 and earlier, 1.6.x before 1.6.4, 1.7.x before 1.7.4 Description The issue allows remote authenticated users to execute arbitrary SQL commands via the order by or order parameter in the "wpseo...
CVE-2015-1874: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the Contact Form DB aka CFDB and contact-form-7-to-database-extension plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the...
PT-2015-5480
Name of the Vulnerable Software and Affected Versions Contact Form DB plugin versions prior to 2.8.32 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the...
CVE-2015-2220
Multiple cross-site scripting XSS vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the ninjaformsfield1 parameter in a ninjaformsajaxsubmit action to wp-admin/admin-ajax.php or 2 remote administrators to injec...