16516 matches found
CVE-2019-6027
Cross-site request forgery CSRF vulnerability in WP Spell Check 7.1.9 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2019-5960
Cross-site request forgery CSRF vulnerability in WP Open Graph 1.6.1 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...
CVE-2019-15112
The wp-slimstat plugin before 4.8.1 for WordPress has XSS...
CVE-2019-15660
The wp-members plugin before 3.2.8 for WordPress has CSRF...
CVE-2018-20983
The wp-retina-2x plugin before 5.2.3 for WordPress has XSS...
CVE-2019-14792
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectanglename or rectangleopacity parameter...
CVE-2019-14366
WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...
CVE-2019-12498
The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplcapipermissioncheck protection mechanism...
CVE-2018-20838
ampforwpsavestepsdata in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS...
CVE-2019-14949
The wp-database-backup plugin before 5.1.2 for WordPress has XSS...
CVE-2019-15835
The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF...
CVE-2017-15863
Cross Site Scripting XSS exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php...
CVE-2016-11013
The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS...
CVE-2019-14950
The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page...
CVE-2015-9414
The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/getalbumitem.php?size parameter...
CVE-2015-9308
The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature...
CVE-2019-12934
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljsadditionalcss parameter...
CVE-2016-11011
The wp-invoice plugin before 4.1.1 for WordPress has wpiupdateuseroption privilege escalation...