PT-2021-3638

Name of the Vulnerable Software and Affected Versions Instant Images – One Click Unsplash Uploads WordPress plugin versions prior to 4.4.0.1 Description The issue is related to the improper validation and sanitization of the unsplash download w and unsplash download h parameter settings in the...

CVE-2018-6194

A cross-site scripting XSS vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search parameter to wp-admin/upload.php...

CVE-2018-6195

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows authenticated administrator, editor, or author remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter t...

CVE-2018-6194: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in admin/partials/wp-splashing-admin-sidebar.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search parameter to wp-admin/upload.php...

CVE-2018-6195: Improperly Controlled Modification of Object Prototype Attributes

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin wp-splashing-images before 2.1.1 for WordPress allows authenticated administrator, editor, or author remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter t...

PT-2018-17399

Name of the Vulnerable Software and Affected Versions wp-splashing-images versions prior to 2.1.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the search parameter to "wp-admin/upload.php". Recommendations For versions prior to 2.1.1,...

PT-2015-5656

Name of the Vulnerable Software and Affected Versions WP Media Cleaner plugin version 2.2.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via the view, paged, or s parameter in the "wp-media-cleaner" page to "wp-admin/upload.php". This can lead to cross-site...

CVE-2015-2195: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 view, 2 paged, or 3 s parameter in the wp-media-cleaner page to wp-admin/upload.php...