PT-2026-68060

Name of the Vulnerable Software and Affected Versions WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars versions prior to 3.9.2 Description This issue is a generic SQL Injection, which occurs when an application fails to properly sanitize user input, allowing an attack...

PT-2021-16076

Name of the Vulnerable Software and Affected Versions Email Subscriber WordPress plugin versions 1.1 and earlier Description The kento email subscriber ajax AJAX action does not properly sanitise, validate, and escape the submitted subscribe email and subscribe name POST parameters. These...

PT-2020-13570

Name of the Vulnerable Software and Affected Versions bbPress plugin versions through 2.6.4 Description The issue concerns stored XSS in the Forum creation section of the bbPress plugin, allowing JavaScript execution at the "wp-admin/edit.php?post type=forum" API endpoint, which is the Forum...

CVE-2020-13487: Improper Neutralization of Input During Web Page Generation

The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?posttype=forum aka the Forum listing page for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI...

CVE-2015-9425

The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?posttype=opanda-item&page=license-manager-sociallocker-next licensekey parameter...

PT-2019-7384

Name of the Vulnerable Software and Affected Versions Social-locker plugin versions prior to 4.2.5 for WordPress Description The issue concerns a CSRF with resultant XSS in the social-locker plugin for WordPress. This occurs via the licensekey parameter in the "/wp-admin/edit.php?post...

PT-2019-7393

Name of the Vulnerable Software and Affected Versions kiwi-logo-carousel plugin versions prior to 1.7.2 Description The issue concerns a CSRF vulnerability that can lead to XSS. It is exploitable via the "wp-admin/edit.php" endpoint, specifically through the post type, page, tab, or tab flags ord...

CVE-2015-9434: Cross-Site Request Forgery (CSRF)

The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?posttype=kwlogos&page=kwlogossettings tab or tabflagsorder parameter...

PT-2019-7347

Name of the Vulnerable Software and Affected Versions mtouch-quiz plugin versions prior to 3.1.3 for WordPress Description The issue concerns a CSRF Cross-Site Request Forgery vulnerability in the wp-admin/edit.php endpoint, which can lead to XSS Cross-Site Scripting. This allows an attacker to...

CVE-2015-9388: Cross-Site Request Forgery (CSRF)

The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS...

CVE-2016-10962

The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php optionname parameter...

CVE-2016-10962

The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php optionname parameter...

CVE-2016-10962: Cross-Site Request Forgery (CSRF)

The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php optionname parameter...

CVE-2018-13137: Improper Neutralization of Input During Web Page Generation

The Events Manager plugin 5.9.4 for WordPress has XSS via the dbemeventreapprovedemailbody parameter to the wp-admin/edit.php?posttype=event&page=events-manager-options URI...

CVE-2019-9909: Improper Neutralization of Input During Web Page Generation

The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS...

CVE-2017-9603: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter to wp-admin/edit.php...

PT-2017-19063

Name of the Vulnerable Software and Affected Versions WP Jobs plugin version 1.4 and earlier Description The issue allows authenticated users to execute arbitrary SQL commands. This is achieved by exploiting the jobid parameter in the /wp-admin/edit.php endpoint. Recommendations For WP Jobs plugi...

Directory traversal

Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary local files via a .. dot dot in the tab parameter in the gdbbpressattachments page to wp-admin/edit.php...

CVE-2015-5481

The CVE-2015-5481 entry documents a Cross-site scripting (XSS) vulnerability in the GD bbPress Attachments WordPress plugin. Affects versions prior to 2.3, vulnerable code resides in forms/panels.php where the tab parameter of gdbbpress_attachments (on wp-admin/edit.php) is not properly filtered,...

PT-2015-6936

Name of the Vulnerable Software and Affected Versions GD bbPress Attachments plugin versions prior to 2.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the tab parameter in the gdbbpress...