877 matches found
CVE-2019-14790: Improper Neutralization of Input During Web Page Generation
The limb-gallery aka Limb Gallery plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode task parameter,...
Sql injection
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfcwppollsajaxrequest via the pollid parameter...
CVE-2019-14216: Cross-Site Request Forgery (CSRF)
An issue was discovered in the svg-vector-icon-plugin aka WP SVG Icons plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mishandles Custom Icon uploads. CSRF leads to upload of a ZIP archive containing a .php file...
CVE-2015-9316: Improper Neutralization of Special Elements used in an SQL Command
The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfcwppollsajaxrequest via the pollid parameter...
CVE-2019-14796
The mq-woocommerce-products-price-bulk-edit aka Woocommerce Products Price Bulk Edit plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=updateoptions showproductspagelimit parameter...
Design/Logic Flaw
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectanglename or rectangleopacity parameter...
CVE-2016-10865: Cross-Site Request Forgery (CSRF)
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery CSRF via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS...
CVE-2019-14791: Improper Neutralization of Input During Web Page Generation
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter...
CVE-2019-14796: Improper Neutralization of Input During Web Page Generation
The mq-woocommerce-products-price-bulk-edit aka Woocommerce Products Price Bulk Edit plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=updateoptions showproductspagelimit parameter...
CVE-2019-14798: Improper Limitation of a Pathname to a Restricted Directory
The 10Web Photo Gallery plugin before 1.5.25 for WordPress has Authenticated Local File Inclusion via directory traversal in the wp-admin/admin-ajax.php?action=shortcodebwg tagtext parameter...
CVE-2019-14681: Cross-Site Request Forgery (CSRF)
The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=dafsettings&dafremove=true CSRF...
CVE-2019-14774: Improper Neutralization of Input During Web Page Generation
The woo-variation-swatches aka Variation Swatches for WooCommerce plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter...
CVE-2019-14773: Undefined Security Weakness
admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion...
CVE-2019-14682: Cross-Site Request Forgery (CSRF)
The acf-better-search aka ACF: Better Search plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbsadminpage CSRF...
CVE-2019-14683: Cross-Site Request Forgery (CSRF)
The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acuideleteattachment CSRF...
CVE-2019-14679: Cross-Site Request Forgery (CSRF)
core/views/arpriceimportexport.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arpliteimportexport CSRF...
CVE-2019-14680: Cross-Site Request Forgery (CSRF)
The admin-renamer-extended aka Admin renamer extended plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF...
CVE-2019-14364: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpxname wp-admin/admin-ajax.php POST parameter...
Essential Real Estate <= 1.7.1 - XSS
Multiple XSS across the plugin Example: https:///wp-admin/edit.php?poststatus=all&posttype=userpackage&packageuser="&filteraction=Filter&paged=1 https:///wp-admin/edit.php?poststatus=all&posttype=property&propertyauthor="&propertyidentity&filteraction=Filter&paged=1...
CVE-2013-7472: Improper Neutralization of Input During Web Page Generation
The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpdmetaboxes daytoshow parameter...