876 matches found
CVE-2019-11807: Unrestricted Upload of File with Dangerous Type
The WooCommerce Checkout Manager plugin before 4.3 for WordPress allows media deletion via the wp-admin/admin-ajax.php?action=updateattachmentwccm wccmdefaultkeysload parameter because of a nopriv registration and a lack of capabilities checks...
CVE-2019-11590: Improper Limitation of a Pathname to a Restricted Directory
The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the latter is...
CVE-2019-11557: Improper Limitation of a Pathname to a Restricted Directory
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the...
Sql injection
SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Galleryid or Gallerytitle parameter...
CVE-2018-18019: Improper Neutralization of Input During Web Page Generation
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slidetitle, Slidemediafile, or Slideimageurl parameter...
CVE-2018-18017: Improper Neutralization of Input During Web Page Generation
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Galleryid or Gallerytitle parameter...
CVE-2018-17584: Cross-Site Request Forgery (CSRF)
The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page...
CVE-2018-18018: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Galleryid or Gallerytitle parameter...
CVE-2018-13137: Improper Neutralization of Input During Web Page Generation
The Events Manager plugin 5.9.4 for WordPress has XSS via the dbemeventreapprovedemailbody parameter to the wp-admin/edit.php?posttype=event&page=events-manager-options URI...
CVE-2019-9978: Improper Neutralization of Input During Web Page Generation
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swpdebug=loadoptions swpurl parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro...
Design/Logic Flaw
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...
CVE-2019-9912
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...
CVE-2019-9910: Improper Neutralization of Input During Web Page Generation
The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS...
CVE-2019-9914: Improper Neutralization of Input During Web Page Generation
The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes pollid XSS...
CVE-2019-9908: Improper Neutralization of Input During Web Page Generation
The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php managefontid XSS...
CVE-2019-9911: Improper Neutralization of Input During Web Page Generation
The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS...
CVE-2019-9912: Improper Neutralization of Input During Web Page Generation
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...
CVE-2019-9909: Improper Neutralization of Input During Web Page Generation
The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS...
CVE-2019-9913: Improper Neutralization of Input During Web Page Generation
The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS...
CVE-2019-9787: Cross-Site Request Forgery (CSRF)
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...