CVE-2016-10958: Unrestricted Upload of File with Dangerous Type

The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via esmediaimages to wp-admin/admin-ajax.php...

Design/Logic Flaw

The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter...

CVE-2016-10952

The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter...

CVE-2017-18613: Improper Neutralization of Input During Web Page Generation

The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter...

CVE-2016-10945: Cross-Site Request Forgery (CSRF)

The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF...

CVE-2016-10944: Cross-Site Request Forgery (CSRF)

The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF...

CVE-2016-10952: Improper Neutralization of Input During Web Page Generation

The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter...

CVE-2017-18603

The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postmanemaillog page parameter...

CVE-2017-18603: Improper Neutralization of Input During Web Page Generation

The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postmanemaillog page parameter...

CVE-2017-18602: Improper Neutralization of Special Elements used in an SQL Command

The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examappUserResult id parameter...

CVE-2018-21013: Improper Privilege Management

The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php...

CVE-2019-15873: Improper Control of Generation of Code

The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pmtemplatepreview&html=...

CVE-2019-15829: Improper Neutralization of Input During Web Page Generation

The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS...

CVE-2019-15777: Improper Neutralization of Input During Web Page Generation

The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&adminemail= XSS...

CVE-2019-15647: Improper Control of Generation of Code

The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulkactionlistener remote code execution...

CVE-2017-18521: Cross-Site Request Forgery (CSRF)

The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n...

CVE-2015-9332: Cross-Site Request Forgery (CSRF)

The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI...

CVE-2019-14789: Improper Neutralization of Input During Web Page Generation

The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter...

CVE-2019-14790: Improper Neutralization of Input During Web Page Generation

The limb-gallery aka Limb Gallery plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,...

CVE-2019-14795: Improper Neutralization of Input During Web Page Generation

The toggle-the-title aka Toggle The Title plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=updatetitleoptions isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter...