Browse CVEs

MEDIUM 6.5 CVE-2015-9440 The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new. Monetize after 1.03 Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9441 The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php. Bookmarkify No fix yet Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9442 The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin. Directdownload No fix yet Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9443 The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data… Wp Accurate Form Data No fix yet Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9431 The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_fil… Qtranslate X 3.4.4+ Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9432 The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-… Alpine Photo Tile For Instagram 1.2.7.6+ Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9433 The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Face… Wp Social Bookmarking Light 1.7.10+ Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9434 The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_setting… Kiwi Logo Carousel 1.7.2+ Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9437 The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit paramete… Dynamic Widgets 1.5.11+ Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9421 The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter. Olevmedia Shortcodes 1.1.9+ Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9422 The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_ty… Plugnedit 6.2.0+ Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9424 The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_… Multicons 3.0+ Fix from $1,6002019-09-26 MEDIUM 5.4 CVE-2015-9425 The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-… Social Locker 4.2.5+ Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9427 The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID par… Googmonify after 0.5.1 Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9428 The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name… Wp Legal Pages 1.1+ Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9429 The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_… Yith Maintenance Mode 1.2.0+ Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9413 The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter. Eshop after 6.3.13 Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9417 The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS. Testimonial Slider after 1.2.1 Fix from $1,6002019-09-26 MEDIUM 6.5 CVE-2015-9409 The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php. Alo Easymail 2.6.01+ Fix from $1,6002019-09-25 MEDIUM 6.5 CVE-2019-4515 IBM Security Key Lifecycle Manager 3.0 and 3.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and u… Security Key Lifecycle Manager after 3.0.1.1 Fix from $1,6002019-09-24 MEDIUM 6.5 CVE-2019-16719 WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS. Wtcms No fix yet Fix from $1,6002019-09-23 MEDIUM 6.5 CVE-2019-16721 NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user. Nonecms No fix yet Fix from $1,6002019-09-23 HIGH 8.8 CVE-2019-16706 kkcms v1.3 has a CSRF vulnerablity that can add an user account via admin/cms_user_add.php. Kkcms No fix yet Fix from $1,9502019-09-23 MEDIUM 6.5 CVE-2019-16677 An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF. Icms No fix yet Fix from $1,6002019-09-21 MEDIUM 6.5 CVE-2019-16678 admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route. Yzmcms No fix yet Fix from $1,6002019-09-21 HIGH 8.8 CVE-2019-16658 TuziCMS 2.0.6 has index.php/manage/notice/do_add CSRF. Tuzicms No fix yet Fix from $1,9502019-09-21 HIGH 8.8 CVE-2019-16659 TuziCMS 2.0.6 has index.php/manage/link/do_add CSRF. Tuzicms No fix yet Fix from $1,9502019-09-21 HIGH 8.8 CVE-2019-16660 joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF. Joyplus No fix yet Fix from $1,9502019-09-21 MEDIUM 6.5 CVE-2018-17789 Prospecta Master Data Online (MDO) allows CSRF. Master Data Online No fix yet Fix from $1,6002019-09-20 MEDIUM 6.5 CVE-2015-9408 The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS. Xpinner Lite after 2.2 Fix from $1,6002019-09-20