PT-2026-94157

Name of the Vulnerable Software and Affected Versions Paid Downloads versions prior to 3.16 Description The Paid Downloads plugin for WordPress allows unauthenticated arbitrary file upload through the admin request handler function. This occurs because the function lacks proper authorization and...

PT-2020-19356

Name of the Vulnerable Software and Affected Versions WP Database Reset versions 3.1 and earlier Description The issue allows any unauthenticated user to reset any table in the database to the initial WordPress set-up state, resulting in the deletion of all site content stored in that table. This...

CVE-2019-19982: Improper Authentication

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...

CVE-2016-10945: Cross-Site Request Forgery (CSRF)

The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF...

CVE-2019-14800

The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI...

PT-2019-13845

Name of the Vulnerable Software and Affected Versions FV Flowplayer Video Player plugin versions prior to 7.3.15.727 Description The issue allows unauthorized access to the email subscription list in CSV format. This can be achieved by accessing a specific URI,...

CVE-2019-14791: Improper Neutralization of Input During Web Page Generation

The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter...

CVE-2019-14773: Undefined Security Weakness

admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion...

PT-2019-13825

Name of the Vulnerable Software and Affected Versions Woody ad snippets plugin versions prior to 2.2.6 Description The issue concerns the "Woody ad snippets" plugin for WordPress, where a problem in the admin/includes/class.actions.snippet.php file allows unauthorized post deletion through the...

CVE-2019-9978: Improper Neutralization of Input During Web Page Generation

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swpdebug=loadoptions swpurl parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro...

PT-2018-10717

Name of the Vulnerable Software and Affected Versions MULTIDOTS Woo Checkout for Digital Goods plugin version 2.1 Description An issue allows attackers to change plugin settings by tricking an admin user into visiting a crafted URL. The woo checkout settings page function in the file...

CVE-2018-11632: Cross-Site Request Forgery (CSRF)

An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings via...

PT-2018-10716

Name of the Vulnerable Software and Affected Versions MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin version 1.0.8 Description An issue in the plugin allows an attacker to change its settings via a crafted URL, exploiting a CSRF vulnerability in the wp-admin/admin-post.php...

CVE-2015-1494: Improper Neutralization of Input During Web Page Generation

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting XSS attacks via an mfbfw parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfwpadding parameter and...

PT-2015-5329

Name of the Vulnerable Software and Affected Versions FancyBox for WordPress versions prior to 3.0.3 Description The issue allows remote attackers to conduct cross-site scripting XSS attacks via a mfbfw parameter in an update action to "wp-admin/admin-post.php". This has been exploited in the wil...

CVE-2014-4725

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

PT-2014-6077

Name of the Vulnerable Software and Affected Versions MailPoet Newsletters wysija-newsletters plugin versions prior to 2.6.7 Description The issue allows remote attackers to bypass authentication and execute arbitrary PHP code. This is achieved by uploading a crafted theme using the...

CVE-2014-4725: Improper Authentication

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...