CVE-2014-3210: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in dopbs-backend-forms.php in the Booking System Booking Calendar plugin before 1.3 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the bookingformid parameter to wp-admin/admin-ajax.php...

PT-2014-2476

Name of the Vulnerable Software and Affected Versions CommentLuv plugin versions prior to 2.92.4 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the ajax nonce parameter to the "wp-admin/admin-ajax.php" API endpoint...

CVE-2013-1409: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ajaxnonce parameter to wp-admin/admin-ajax.php...

CVE-2012-6624

Cross-site scripting XSS vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter in a soundcloudisgoldplayerpreview action to wp-admin/admin-ajax.php...

CVE-2012-6624: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter in a soundcloudisgoldplayerpreview action to wp-admin/admin-ajax.php...

CVE-2013-5673

SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the customquery parameter in a testimonialadd action to wp-admin/admin-ajax.php...

PT-2013-5719

Name of the Vulnerable Software and Affected Versions IndiaNIC Testimonial plugin version 2.2 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including adding testimonials, listing templates, and widget templates. It...

PT-2013-5720

Name of the Vulnerable Software and Affected Versions IndiaNIC Testimonial plugin version 2.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the custom query parameter in a testimonial add action to the "wp-admin/admin-ajax.php"...

PT-2013-5292

Name of the Vulnerable Software and Affected Versions BuddyPress Extended Friendship Request plugin versions prior to 1.0.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via the friendship request message parameter to the "wp-admin/admin-ajax.php" API endpoi...

CVE-2012-1936: Cross-Site Request Forgery (CSRF)

The wpcreatenonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery CSRF attacks on specific actions and objects by sniffing t...

CVE-2007-2821

SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via the cookie parameter...

CVE-2007-2821

SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via the cookie parameter...

CVE-2007-2821: Undefined Security Weakness

SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via the cookie parameter...