CVE-2018-16285: Improper Neutralization of Input During Web Page Generation

The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userproshortcodetemplate action to wp-admin/admin-ajax.php...

CVE-2018-16159: Improper Neutralization of Special Elements used in an SQL Command

The Gift Vouchers plugin through 2.0.1 for WordPress allows SQL Injection via the templateid parameter in a wp-admin/admin-ajax.php wpgvdoajaxfronttemplate request...

CVE-2018-15877: Improper Neutralization of Special Elements used in an OS Command

The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainviewactivitymonitor&tab=activitytools request...

CVE-2018-14430: Improper Neutralization of Input During Web Page Generation

The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fwdata id1, fwdata id2, fwdata id3, fwdata id4, or email field of the contact form, exploitable with an fwsendemail action to wp-admin/admin-ajax.php...

CVE-2018-13136

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...

Design/Logic Flaw

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...

CVE-2018-13136

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...

CVE-2018-13136

CVE-2018-13136 affects the WordPress plugin Ultimate Member (aka ultimatemember) for versions prior to 2.0.18, exposing a cross-site scripting (XSS) vulnerability via the wp-admin settings screen. The issue is documented across multiple sources (CNVD/EUVD/OpenVAS/NVD/CVE records) as an XSS in thi...

CVE-2018-13136: Improper Neutralization of Input During Web Page Generation

The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...

innebandycuper.se XSS vulnerability

Open Bug Bounty ID: OBB-638038 Description| Value ---|--- Affected Website:| innebandycuper.se Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

longes.fr XSS vulnerability

Open Bug Bounty ID: OBB-638019 Description| Value ---|--- Affected Website:| longes.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

auftakt-musikschule.de XSS vulnerability

Open Bug Bounty ID: OBB-637680 Description| Value ---|--- Affected Website:| auftakt-musikschule.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

tejnif.dk XSS vulnerability

Open Bug Bounty ID: OBB-637593 Description| Value ---|--- Affected Website:| tejnif.dk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-12895

CVE-2018-12895 affects WordPress up to version 4.9.6. An Author (needs files and posts capabilities) can trigger directory traversal via the thumb parameter in wp-admin/post.php, causing the PHP unlink call to delete wp-config.php through a missing filename validation in wp-includes/post.php wp_d...

CVE-2018-12895: Improper Limitation of a Pathname to a Restricted Directory

WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the...

PT-2018-11457

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.9.7 Description The issue allows Author users to execute arbitrary code by leveraging directory traversal in the "wp-admin/post.php" endpoint, specifically the thumb parameter, which is passed to the PHP unlink...

tpl.fr Improper Access Control vulnerability

Open Bug Bounty ID: OBB-635265 Description| Value ---|--- Affected Website:| tpl.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

proteine.be Improper Access Control vulnerability

Open Bug Bounty ID: OBB-635240 Description| Value ---|--- Affected Website:| proteine.be Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

CVE-2018-11632: Cross-Site Request Forgery (CSRF)

An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings via...

CVE-2018-10234: Improper Neutralization of Input During Web Page Generation

Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=umoptions&section=account page...