CVE-2014-2550: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disablecommentssettings page to wp-admin/options-general.php...

CVE-2018-6467

The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php...

CVE-2018-6468: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSSid parameter to wp-admin/options-general.php...

CVE-2018-6467: Cross-Site Request Forgery (CSRF)

The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php...

CVE-2018-6469: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSStags parameter to wp-admin/options-general.php...

CVE-2018-6466: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the flickrRSSset parameter to wp-admin/options-general.php...

CVE-2018-5667: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnuusernamevalidationpattern parameter...

CVE-2018-5668: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnuusernamevalidationtitle parameter...

CVE-2018-5669: Cross-Site Request Forgery (CSRF)

An issue was discovered in the read-and-understood plugin 2.1 for WordPress. CSRF exists via wp-admin/options-general.php...

CVE-2018-5369

The SrbTransLatin plugin 1.46 for WordPress is affected by CVE-2018-5369: a Cross-Site Scripting (XSS) vulnerability via the srbtranslatoptions action to wp-admin/options-general.php with the lang_identificator parameter. This, as documented, can allow injection of arbitrary web script or HTML. S...

CVE-2018-5368: Cross-Site Request Forgery (CSRF)

The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php...

CVE-2018-5369: Improper Neutralization of Input During Web Page Generation

The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a langidentificator parameter...

CVE-2018-5285: Cross-Site Request Forgery (CSRF)

The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php...

CVE-2018-5284: Improper Neutralization of Input During Web Page Generation

The ImageInject plugin 1.15 for WordPress has XSS via the flickrappid parameter to wp-admin/options-general.php...

PT-2015-7286

Name of the Vulnerable Software and Affected Versions Portfolio plugin for WordPress versions prior to 1.05 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests with unspecified impact. This is achieved via a reque...

CVE-2015-5535: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the qTranslate plugin 2.5.39 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the qtranslate page to wp-admin/options-general.php...

CVE-2015-4140

Cross-site request forgery CSRF vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for requests that conduct cross-site scripting XSS attacks via the s4w-more parameter to the smilies4wp.php page to wp-admin/options-general.ph...

CVE-2015-4140

CVE-2015-4140 : In the WP Smiley plugin for WordPress (version 1.4.1), a CSRF vulnerability allows remote attackers to hijack the authentication of editors and carry out cross-site scripting (XSS) via the s4w-more parameter to smilies4wp.php, targeting wp-admin/options-general.php. The issue stem...

CVE-2015-4139: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in smilies4wp.php in the WP Smiley plugin 1.4.1 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the s4w-more parameter to wp-admin/options-general.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the iframeurl parameter in an Update Page action in the...