Skip to content

CVE-2015-9xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

547 records · Page 2 of 6

CVE-2015-9451: The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter. Unscored
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
Updated 2024-08-06
CVE-2015-9450: The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter. Unscored
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.
Updated 2024-08-06
CVE-2015-9449: The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter. Unscored
The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
Updated 2024-08-06
CVE-2015-9448: The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter. Unscored
The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter.
Updated 2024-08-06
CVE-2015-9447: The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters. Unscored
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.
Updated 2024-08-06
CVE-2015-9446: The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php. Unscored
The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php.
Updated 2024-08-06
CVE-2015-9445: The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation. Unscored
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.
Updated 2024-08-06
CVE-2015-9444: The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF. Unscored
The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.
Updated 2024-08-06
CVE-2015-9443: The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP. Unscored
The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.
Updated 2024-08-06
CVE-2015-9442: The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin. Unscored
The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.
Updated 2024-08-06
CVE-2015-9441: The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php. Unscored
The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.
Updated 2024-08-06
CVE-2015-9440: The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new. Unscored
The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.
Updated 2024-08-06
CVE-2015-9439: The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter. Unscored
The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.
Updated 2024-08-06
CVE-2015-9438: The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter. Unscored
The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.
Updated 2024-08-06
CVE-2015-9437: The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter. Unscored
The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.
Updated 2024-08-06
CVE-2015-9436: The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter. Unscored
The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.
Updated 2024-08-06
CVE-2015-9435: The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers. Unscored
The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.
Updated 2024-08-06
CVE-2015-9434: The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parame Unscored
The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
Updated 2024-08-06
CVE-2015-9433: The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc. in wp-admin/options- Unscored
The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc. in wp-admin/options-general.php?page=wp-social-bookmarking-light%2Fmodules%2Fadmin.php.
Updated 2024-08-06
CVE-2015-9432: The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settin Unscored
The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.
Updated 2024-08-06
CVE-2015-9431: The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config p Unscored
The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config parameter.
Updated 2024-08-06
CVE-2015-9430: The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header. Unscored
The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header.
Updated 2024-08-06
CVE-2015-9429: The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter. Unscored
The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter.
Updated 2024-08-06
CVE-2015-9428: The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city- Unscored
The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters.
Updated 2024-08-06
CVE-2015-9427: The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter. Unscored
The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.
Updated 2024-08-06
CVE-2015-9426: The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter. Unscored
The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.
Updated 2024-08-06
CVE-2015-9425: The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey pa Unscored
The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter.
Updated 2024-08-06
CVE-2015-9424: The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter. Unscored
The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter.
Updated 2024-08-06
CVE-2015-9423: The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGColor, PlugneditEdit Unscored
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGColor, PlugneditEditorMargin, plugnedit_width, pnemedcount, or plugneditcontent parameters.
Updated 2024-08-06
CVE-2015-9422: The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load plugnedit_w Unscored
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load plugnedit_width, pnemedcount, PlugneditBGColor, PlugneditEditorMargin, or plugneditcontent parameters.
Updated 2024-08-06
CVE-2015-9421: The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter. Unscored
The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.
Updated 2024-08-06
CVE-2015-9420: The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter. Unscored
The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter.
Updated 2024-08-06
CVE-2015-9419: The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section. Unscored
The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section.
Updated 2024-08-06
CVE-2015-9418: The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes. Unscored
The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.
Updated 2024-08-06
CVE-2015-9417: The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS. Unscored
The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.
Updated 2024-08-06
CVE-2015-9416: The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header. Unscored
The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.
Updated 2024-08-06
CVE-2015-9415: The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion. Unscored
The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.
Updated 2024-08-06
CVE-2015-9414: The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter. Unscored
The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter.
Updated 2024-08-06
CVE-2015-9413: The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter. Unscored
The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.
Updated 2024-08-06
CVE-2015-9412: The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter. Unscored
The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.
Updated 2024-08-06
CVE-2015-9411: The Postmatic plugin before 1.4.6 for WordPress has XSS. Unscored
The Postmatic plugin before 1.4.6 for WordPress has XSS.
Updated 2024-08-06
CVE-2015-9410: The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter. Unscored
The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.
Updated 2024-08-06
CVE-2015-9409: The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php. Unscored
The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.
Updated 2024-08-06
CVE-2015-9408: The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS. Unscored
The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.
Updated 2024-08-06
CVE-2015-9407: The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS. Unscored
The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.
Updated 2024-08-06
CVE-2015-9406: Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files parameter to css/css. Unscored
Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files parameter to css/css.php.
Updated 2024-08-06
CVE-2015-9405: The wp-piwik plugin before 1.0.5 for WordPress has XSS. Unscored
The wp-piwik plugin before 1.0.5 for WordPress has XSS.
Updated 2024-08-06
CVE-2015-9404: The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS. Unscored
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS.
Updated 2024-08-06
CVE-2015-9403: The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS. Unscored
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.
Updated 2024-08-06
CVE-2015-9402: The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload. Unscored
The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.
Updated 2024-08-06
CVE-2015-9401: The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS. Unscored
The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.
Updated 2024-08-06
CVE-2015-9400: The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection. Unscored
The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.
Updated 2024-08-06
CVE-2015-9399: The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection. Unscored
The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.
Updated 2024-08-06
CVE-2015-9398: The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection. Unscored
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.
Updated 2024-08-06
CVE-2015-9397: The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS. Unscored
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.
Updated 2024-08-06
CVE-2015-9396: The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS. Unscored
The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS.
Updated 2024-08-06
CVE-2015-9395: The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action. Unscored
The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.
Updated 2024-08-06
CVE-2015-9394: The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php. Unscored
The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.
Updated 2024-08-06
CVE-2015-9393: The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter. Unscored
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.
Updated 2024-08-06
CVE-2015-9392: The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter. Unscored
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.
Updated 2024-08-06
CVE-2015-9391: The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter. Unscored
The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter.
Updated 2024-08-06
CVE-2015-9390: The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled. Unscored
The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled.
Updated 2024-08-06
CVE-2015-9389: The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name. Unscored
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name.
Updated 2024-08-06
CVE-2015-9388: The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS. Unscored
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.
Updated 2024-08-06
CVE-2015-9387: The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF. Unscored
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF.
Updated 2024-08-06
CVE-2015-9386: The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation. Unscored
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.
Updated 2024-08-06
CVE-2015-9385: The quotes-and-tips plugin before 1.20 for WordPress has XSS. Unscored
The quotes-and-tips plugin before 1.20 for WordPress has XSS.
Updated 2024-08-06
CVE-2015-9384: The relevant plugin before 1.0.8 for WordPress has XSS. Unscored
The relevant plugin before 1.0.8 for WordPress has XSS.
Updated 2024-08-06
CVE-2015-9383: FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c. Unscored
FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.
Updated 2024-08-06
CVE-2015-9382: FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation. Unscored
FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation.
Updated 2024-08-06
CVE-2015-9381: FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c. Unscored
FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c.
Updated 2024-08-06
CVE-2015-9380: The photo-gallery plugin before 1.2.42 for WordPress has CSRF. Unscored
The photo-gallery plugin before 1.2.42 for WordPress has CSRF.
Updated 2024-08-06
CVE-2015-9379: iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9378: iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9377: iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9376: iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9375: Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9374: Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9373: PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9372: Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9371: Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9370: Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9369: Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9368: Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9367: Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9366: Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9365: Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9364: 2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9363: iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9362: The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9361: The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9360: The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9359: The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9358: The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg(). Unscored
The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().
Updated 2024-08-06
CVE-2015-9357: The akismet plugin before 3.1.5 for WordPress has XSS. Unscored
The akismet plugin before 3.1.5 for WordPress has XSS.
Updated 2024-08-06
CVE-2015-9356: The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460. Unscored
The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.
Updated 2024-08-06
CVE-2015-9355: The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area. Unscored
The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.
Updated 2024-08-06
CVE-2015-9354: The gigpress plugin before 2.3.11 for WordPress has XSS. Unscored
The gigpress plugin before 2.3.11 for WordPress has XSS.
Updated 2024-08-06
CVE-2015-9353: The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066. Unscored
The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.
Updated 2024-08-06
CVE-2015-9352: The wp-polls plugin before 2.72 for WordPress has SQL injection. Unscored
The wp-polls plugin before 2.72 for WordPress has SQL injection.
Updated 2024-08-06

Search a CVE ID or check dependency files →