Sql injection

SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watuproquestions parameter in a watuprosubmit action to wp-admin/admin-ajax.php...

CVE-2017-9834: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watuproquestions parameter in a watuprosubmit action to wp-admin/admin-ajax.php...

CVE-2017-12948: Improper Neutralization of Input During Web Page Generation

Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATHINFO to wp-admin/admin.php, related to PHPSELF...

CVE-2017-12199: Improper Neutralization of Special Elements used in an SQL Command

The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogueupdateorder list-item, videoupdateorder video-item, imageupdateorder list-item, taggroupupdateorder listitem, categoryproductsupdateorder...

CVE-2017-12068: Improper Neutralization of Input During Web Page Generation

The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an eladmincategories deletebulk action...

Cross-Site Request Forgery(CSRF)

Wordpress is vulnerable to cross-site request forgery CSRF attacks. The attacks can be launched because wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php have flaws, allowing the widget-access action requests to be hijacked by the attackers...

WordPress WP Jobs Plugin SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.WP Jobs plugin is one of the post management plugin. A SQL injection vulnerability exists in WordPress WP Jobs plug...

CVE-2017-9603: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter to wp-admin/edit.php...

CVE-2017-9429: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php...

CVE-2017-9418: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php...

spacehost.de XSS vulnerability

Vulnerable URL: https://spacehost.de/blog/wp-admin/admin-ajax.php Details: Description| Value ---|--- Patched:| Yes, at 14.05.2017 Latest check for patch:| 14.05.2017 20:49 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1786851 VIP website status:| No Check...

CVE-2017-6818: Improper Neutralization of Input During Web Page Generation

In WordPress before 4.7.3 wp-admin/js/tags-box.js, there is cross-site scripting XSS via taxonomy term names...

CVE-2017-6816: Incorrect Authorization

In WordPress before 4.7.3 wp-admin/plugins.php, unintended files can be deleted by administrators using the plugin deletion functionality...

CVE-2017-6819: Cross-Site Request Forgery (CSRF)

In WordPress before 4.7.3, there is cross-site request forgery CSRF in Press This wp-admin/includes/class-wp-press-this.php, leading to excessive use of server resources. The CSRF can trigger an outbound HTTP request for a large file that is then parsed by Press This...

CVE-2017-5610

wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms...

CVE-2017-5612

Cross-site scripting XSS vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt...

CVE-2017-5612

Cross-site scripting XSS vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt...

CVE-2017-5612

Cross-site scripting XSS vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt...

CVE-2017-5612

Cross-site scripting XSS vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt...

CVE-2017-5612: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt...