16466 matches found
CVE-2023-5672
The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files...
CVE-2023-5645
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor...
CVE-2023-5802
Cross-Site Request Forgery CSRF vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin = 1.3.4 versions...
CVE-2023-5943
The Wp-Adv-Quiz WordPress plugin before 1.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
CVE-2023-5448
The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.9. This is due to missing or incorrect nonce validation on the updatepasswordvalidate function. This makes it possible for unauthenticated attackers to res...
CVE-2023-5673
The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution...
CVE-2023-5956
The Wp-Adv-Quiz WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2023-49813
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005...
CVE-2023-36517
Cross-Site Request Forgery CSRF vulnerability in Kevon Adonis WP Abstracts plugin = 2.6.2 versions...
CVE-2023-36678
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin = 3.5.5 versions...
CVE-2023-36692
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Christian Kramer & Hendrik Thole WP-Cirrus plugin = 0.6.11 versions...
CVE-2023-36382
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Jeffrey-WP Media Library Categories plugin = 2.0.0 versions...
CVE-2023-36693
Cross-Site Request Forgery CSRF vulnerability in Alain Gonzalez WP RSS Images plugin = 1.1 versions...
CVE-2023-27438
Cross-Site Request Forgery CSRF vulnerability in Evgen Yurchenko WP Translitera plugin = p1.2.5 versions...
CVE-2023-27623
Cross-Site Request Forgery CSRF vulnerability in Jens Törnell WP Page Numbers plugin = 0.5 versions...
CVE-2023-27605
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Sajjad Hossain WP Reroute Email allows SQL Injection.This issue affects WP Reroute Email: from n/a through 1.4.6...
CVE-2023-27606
Cross-Site Request Forgery CSRF vulnerability in Sajjad Hossain WP Reroute Email plugin = 1.4.6 versions...
CVE-2023-45645
Cross-Site Request Forgery CSRF vulnerability in InfoD74 WP Open Street Map plugin = 1.25 versions...