CVE-2015-4065

Summary (CVE-2015-4065) : The WordPress Landing Pages plugin (versions before 1.8.5) contains an XSS vulnerability in shared/shortcodes/inbound-shortcodes.php. An authenticated remote user can inject arbitrary script/HTML via the post parameter passed to wp-admin/post-new.php, caused by echoing u...

CVE-2015-4064

SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php...

CVE-2015-4065: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php...

PT-2015-6406

Name of the Vulnerable Software and Affected Versions Landing Pages plugin versions prior to 1.8.5 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML. The injection can be done v...

PT-2015-6403

Name of the Vulnerable Software and Affected Versions NewStatPress plugin versions prior to 0.9.9 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by exploiting the where1 parameter in the nsp search page to wp-admin/admin.php...

PT-2015-6405

Name of the Vulnerable Software and Affected Versions Landing Pages plugin versions prior to 1.8.5 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the post parameter in an edit delete-variation action to "wp-admin/post.php"...

PT-2015-6404

Name of the Vulnerable Software and Affected Versions NewStatPress plugin versions prior to 0.9.9 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp search pa...

WordPress Landing Pages Plugin <= 1.8.4 - XSS

Cross-site scripting XSS vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php. Solution Upgrade the plugin...

PT-2015-6388

Name of the Vulnerable Software and Affected Versions FeedWordPress plugin versions prior to 2015.0514 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the link ids parameter in an Update action in the "syndication.php" page to...

PT-2018-4249

Name of the Vulnerable Software and Affected Versions Brute Force Login Protection module version 1.3 for WordPress Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack user authentication for requests with unknown impact. This is achieved through a...

WordPress LeagueManager Plugin <= 3.7 - Cross Site Scripting

This plugin is prone to a wp-admin/admin.php multiple parameter cross site scripting vulnerability. Solution Update the plugin...

WordPress Rockhoist Ratings Plugin <= 1.2.2 - SQL Injection

This plugin is prone to an SQL injection vulnerability in wp-admin/admin-ajax.php postID parameter. Solution Update the plugin...

WordPress WP Photo Album Plus Plugin <= 5.0.10 - XSS

This plugin is prone to wp-admin/admin.php editid parameter cross site scripting vulnerability. Solution Update the plugin...

CVE-2015-3986: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attack...

CVE-2015-3300: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the 1 billingfirstname, 2 billinglastname, 3...

CVE-2014-9311

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

PT-2015-4182

Name of the Vulnerable Software and Affected Versions Shareaholic plugin versions prior to 7.6.1.0 for WordPress Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter i...

CVE-2014-9311: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the locationid parameter in a shareaholicaddlocation action to wp-admin/admin-ajax.php...

CVE-2015-2755

Multiple cross-site request forgery CSRF vulnerabilities in the AB Google Map Travel AB-MAP plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 lat Latitude, 2 long Longitude, 3...

CVE-2015-2755: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the AB Google Map Travel AB-MAP plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 lat Latitude, 2 long Longitude, 3...