PT-2015-5672

Name of the Vulnerable Software and Affected Versions Ninja Forms plugin versions prior to 2.8.9 Description The issue allows remote attackers to inject arbitrary web script or HTML, and it also affects remote administrators. This can be achieved through the "ninja forms field 1" parameter in a...

CVE-2015-2220: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the ninjaformsfield1 parameter in a ninjaformsajaxsubmit action to wp-admin/admin-ajax.php or 2 remote administrators to injec...

CVE-2015-2196: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the catid parameter in a spiderbigcalendarmonth action to wp-admin/admin-ajax.php...

CVE-2015-2199: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow 1 remote authenticated users to execute arbitrary SQL commands via the itemid parameter in a wonderpluginaudiosaveitem action to wp-admin/admin-ajax.php or remote administrators to execut...

PT-2015-5597

Name of the Vulnerable Software and Affected Versions WordPress Survey and Poll plugin version 1.1.7 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the survey id parameter in an ajax survey action to the "/wp-admin/admin-ajax.php" A...

CVE-2015-2090: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the ajaxsurvey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the surveyid parameter in an ajaxsurvey action to wp-admin/admin-ajax.php...

CVE-2015-2065

SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery contus-video-gallery plugin before 2.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the vid parameter in a rss action to wp-admin/admin-ajax.php...

CVE-2015-2065: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery contus-video-gallery plugin before 2.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the vid parameter in a rss action to wp-admin/admin-ajax.php...

CVE-2015-1579: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734...

PT-2015-5369

Name of the Vulnerable Software and Affected Versions Spider Facebook plugin versions prior to 1.0.11 Description The issue allows remote attackers to inject arbitrary web script or HTML via certain parameters. Specifically, the appid parameter in a registration task to the default URI is...

CVE-2015-1582: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...

CVE-2015-1055: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the orderby parameter in a GalleryBox action to wp-admin/admin-ajax.php...

PT-2015-3660

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin version 1.3.12 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to purchase limit or the name, intl, nocod, or time parameter in an "add delivery...

CVE-2012-5853: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the "thesearchfunction" function in cardozaajaxsearch.php in the AJAX Post Search cardoza-ajax-search plugin before 1.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the srchtxt parameter in a "thesearchtext" action to...

CVE-2014-9461

Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to read arbitrary files via a .. dot dot in the memberdownload action to wp-admin/admin-ajax.php...

CVE-2014-9441

Multiple cross-site request forgery CSRF vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct cross-site scripting XSS attacks via...

CVE-2014-9442

SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the q parameter in a promotionProductSearch action to wp-admin/admin-ajax.php...

PT-2015-4224

Name of the Vulnerable Software and Affected Versions Cart66 Lite plugin versions prior to 1.5.4 Description The issue allows remote authenticated users to read arbitrary files due to a directory traversal vulnerability. This is achieved by using a .. dot dot in the member download action to the...

PT-2015-4204

Name of the Vulnerable Software and Affected Versions Lightbox Photo Gallery plugin version 1.0 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for requests, potentially leading to changes in plugin settings or cross-site scripting XSS...

PT-2015-4205

Name of the Vulnerable Software and Affected Versions Cart66 Lite plugin versions prior to 1.5.4 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by exploiting the q parameter in a promotionProductSearch action to the...