Unvalidated input in the Ajax Load More WordPress plugin, versions before 5.3.2, lead to SQL Injection in POST /wp-admin/admin-ajax.php with param repeater=' or sleep(5)#&type=test.
7.2CVSS
7.3AI Score
0.001EPSS
The Instant Images β One Click Unsplash Uploads WordPress plugin before 4.4.0.1 did not properly validate and sanitise its unsplash_download_w and unsplash_download_h parameter settings (/wp-admin/upload.php?page=instant-images), only validating them client side before saving them, leading to a Sto...
5.4CVSS
5.2AI Score
0.001EPSS
The WordPress Infinite Scroll β Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeaters_export' parameter in versions up to, and including 5.5.3. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they ...
8.8CVSS
8.6AI Score
0.003EPSS
The WordPress Infinite Scroll β Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insufficient file path validation on the alm_repeaters_export() function. This makes it possible for authenticated attackers, with administrativ...
4.9CVSS
4.9AI Score
0.001EPSS
The WordPress Infinite Scroll β Ajax Load More plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.5.3 via the 'type' parameter found in the alm_get_layout() function. This makes it possible for authenticated attackers, with administrative permissions, to r...
4.9CVSS
3.9AI Score
0.002EPSS
The WordPress Infinite Scroll WordPress plugin before 5.6.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting att...
5.4CVSS
5.5AI Score
0.001EPSS
Server-Side Request Forgery (SSRF) vulnerability in Darren Cooney Instant Images plugin <= 5.1.0.2 versions.
8.8CVSS
8.6AI Score
0.001EPSS
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite Scroll β Ajax Load More allows Stored XSS.This issue affects WordPress Infinite Scroll β Ajax Load More: from n/a through 6.1.0.1.
6.5CVSS
5.8AI Score
0.0004EPSS
The Instant Images β One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized arbitrary options update due to an insufficient check that neglects to verify whether the updated option belongs to the plugin on the instant-images/license R...
8.8CVSS
7AI Score
0.001EPSS