CVE-2015-1385

Cross-site scripting XSS vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmincategoryfeeds.php page to...

PT-2015-5262

Name of the Vulnerable Software and Affected Versions Photo Gallery plugin versions prior to 1.2.11 for WordPress Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the asc or desc parameter in a create gallery request in the "galleries...

CVE-2015-1204

Cross-site scripting XSS vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fsresource parameter in the wp-slim-view-2 page to wp-admin/admin.php...

PT-2015-5162

Name of the Vulnerable Software and Affected Versions WP Slimstat plugin versions prior to 3.9.2 Description A cross-site scripting XSS issue exists in the Save Filters functionality of the WP Slimstat plugin. This allows remote attackers to inject arbitrary web script or HTML via the fsresource...

CVE-2015-1204: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fsresource parameter in the wp-slim-view-2 page to wp-admin/admin.php...

WordPress Photo Gallery Plugin <= 1.2.7 - SQL Injection

Because of this vulnerability, attackers to execute arbitrary SQL commands via the "orderby parameter" in a GalleryBox action to wp-admin/admin-ajax.php. Solution Update the plugin...

CVE-2015-1055: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the orderby parameter in a GalleryBox action to wp-admin/admin-ajax.php...

CVE-2014-7956: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods page to wp-admin/admin.php...

PT-2015-4280

Name of the Vulnerable Software and Affected Versions MyWebsiteAdvisor Simple Security plugin versions 1.1.5 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the datefilter parameter in the "access log" page to...

PT-2015-3981

Name of the Vulnerable Software and Affected Versions WordPress Pods plugin versions prior to 2.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods page to "wp-admin/admin.php"...

PT-2015-3982

Name of the Vulnerable Software and Affected Versions Pods plugin versions prior to 2.5 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including conducting cross-site scripting XSS attacks, deleting pods, resetting...

CVE-2014-7957: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 conduct cross-site scripting XSS attacks via the toggled parameter in a toggle action in the pods-componen...

CVE-2014-9570: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 datefilter parameter in the accesslog page to wp-admin/users.php or 2 simplesecurityipblacklist...

CVE-2014-100018

Cross-site scripting XSS vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in the unconfirmed page to wp-admin/network/users.php...

PT-2015-3630

Name of the Vulnerable Software and Affected Versions mTouch Quiz versions prior to 3.0.7 Description The issue allows remote attackers to inject arbitrary web script or HTML via the quiz parameter to the "wp-admin/edit.php" endpoint. This can be exploited by sending malicious input to the...

PT-2015-3624

Name of the Vulnerable Software and Affected Versions WordPress Unconfirmed plugin versions prior to 1.2.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the s parameter in the unconfirmed page to "wp-admin/network/users.php"...

PT-2015-3629

Name of the Vulnerable Software and Affected Versions mTouch Quiz versions prior to 3.0.7 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the quiz parameter in the wp-admin/edit.php endpoint. Recommendations For versions prior to...

WordPress mTouch Quiz Plugin <= 3.0.6 - SQL Injection

Because of this vulnerability in question.php, the attackers can execute arbitrary SQL commands via the "quiz" parameter to wp-admin/edit.php. Solution Update the plugin...

CVE-2014-10017: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 changeSort or 2 switch parameter in the uscesitemedit page to wp-admin/admin.php...

PT-2015-3660

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin version 1.3.12 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to purchase limit or the name, intl, nocod, or time parameter in an "add delivery...