CVE-2015-8353: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the objectname parameter in a rs-objectroleedit page to wp-admin/admin.php...

CVE-2017-12948: Improper Neutralization of Input During Web Page Generation

Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATHINFO to wp-admin/admin.php, related to PHPSELF...

CVE-2017-12068: Improper Neutralization of Input During Web Page Generation

The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an eladmincategories deletebulk action...

CVE-2017-9429: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php...

CVE-2017-9418: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php...

PT-2015-7576

Name of the Vulnerable Software and Affected Versions Pie Register plugin versions prior to 2.0.19 Description The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved via the select invitaion code bulk option or invi del id parameter in the...

PT-2015-7129

Name of the Vulnerable Software and Affected Versions Google Analyticator plugin versions prior to 6.4.9.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via vulnerable parameters in the google-analyticator page to wp-admin/admin.php. The vulnerable parameter...

CVE-2015-6965: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 create a field, 2 update a field, 3 delete a field, 4 create a form, 5 update a...

PT-2015-7425

Name of the Vulnerable Software and Affected Versions Contact Form Generator plugin versions 2.0.1 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including creating, updating, or deleting fields, forms, or templates, ...

WordPress LeagueManager Plugin <= 3.7 - Cross Site Scripting

This plugin is prone to a wp-admin/admin.php multiple parameter cross site scripting vulnerability. Solution Update the plugin...

CVE-2015-3986: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attack...

CVE-2015-3300: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allow remote attackers to inject arbitrary web script or HTML via the 1 billingfirstname, 2 billinglastname, 3...

CVE-2015-2755: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the AB Google Map Travel AB-MAP plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 lat Latitude, 2 long Longitude, 3...

CVE-2015-1874: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Contact Form DB aka CFDB and contact-form-7-to-database-extension plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the...

CVE-2015-2199: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow 1 remote authenticated users to execute arbitrary SQL commands via the itemid parameter in a wonderpluginaudiosaveitem action to wp-admin/admin-ajax.php or remote administrators to execut...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the imagefile parameter in an edit action in the...

CVE-2015-2084: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the imagefile parameter in an edit action in the...

CVE-2015-1436: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the 1 easingslidermanagecustomizations or 2 easingslidereditsliders page to wp-admin/admin.php...

CVE-2015-1582: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...

CVE-2015-1385

Cross-site scripting XSS vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmincategoryfeeds.php page to...