O:8:"stdClass":8:{s:9:"wordpress";a:93:{i:0;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2020-28032";s:19:"versionEndExcluding";s:5:"5.5.2";s:11:"description";s:112:"WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.";}i:1;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2020-28033";s:19:"versionEndExcluding";s:5:"5.5.2";s:11:"description";s:126:"WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.";}i:2;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2020-28034";s:19:"versionEndExcluding";s:5:"5.5.2";s:11:"description";s:67:"WordPress before 5.5.2 allows XSS associated with global variables.";}i:3;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2020-28035";s:19:"versionEndExcluding";s:5:"5.5.2";s:11:"description";s:71:"WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.";}i:4;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2020-28037";s:19:"versionEndExcluding";s:5:"5.5.2";s:11:"description";s:287:"is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation).";}i:5;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2020-28038";s:19:"versionEndExcluding";s:5:"5.5.2";s:11:"description";s:56:"WordPress before 5.5.2 allows stored XSS via post slugs.";}i:6;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2020-28039";s:19:"versionEndExcluding";s:5:"5.5.2";s:11:"description";s:181:"is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.";}i:7;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2020-28040";s:19:"versionEndExcluding";s:5:"5.5.2";s:11:"description";s:82:"WordPress before 5.5.2 allows CSRF attacks that change a theme's background image.";}i:8;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2020-4046";s:19:"versionEndExcluding";s:5:"5.4.2";s:11:"description";s:543:"In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).";}i:9;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2020-4047";s:19:"versionEndExcluding";s:5:"5.4.2";s:11:"description";s:532:"In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).";}i:10;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2020-4048";s:19:"versionEndExcluding";s:5:"5.4.2";s:11:"description";s:433:"In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).";}i:11;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2020-4049";s:19:"versionEndExcluding";s:5:"5.4.2";s:11:"description";s:504:"In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).";}i:12;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2020-4050";s:19:"versionEndExcluding";s:5:"5.4.2";s:11:"description";s:516:"In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34).";}i:13;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2020-11030";s:19:"versionEndExcluding";s:5:"5.4.1";s:11:"description";s:465:"In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).";}i:14;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-16781";s:19:"versionEndExcluding";s:5:"5.3.1";s:11:"description";s:256:"In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.";}i:15;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-20041";s:19:"versionEndExcluding";s:5:"5.3.1";s:11:"description";s:212:"wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript&colon; substring.";}i:16;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-20042";s:19:"versionEndExcluding";s:5:"5.3.1";s:11:"description";s:214:"WordPress before 5.3.1 allowed an attacker to create a cross-site scripting attack (XSS) in well crafted links, because of an insufficient protection mechanism in wp_targeted_link_rel in wp-includes/formatting.php.";}i:17;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-20043";s:19:"versionEndExcluding";s:5:"5.3.1";s:11:"description";s:201:"WordPress before 5.3.1 allowed an unauthenticated user to make a post sticky through the REST API because of missing access control in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php.";}i:18;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-16773";s:19:"versionEndExcluding";s:5:"5.3.1";s:11:"description";s:412:"In WordPress versions from 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. Automatic updates are enabled by default for minor releases and we strongly recommend that you keep them enabled.";}i:19;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-16788";s:19:"versionEndExcluding";s:5:"5.3.1";s:11:"description";s:507:"In WordPress versions from 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. Automatic updates are enabled by default for minor releases and we strongly recommend that you keep them enabled.";}i:20;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-17669";s:19:"versionEndExcluding";s:5:"5.2.4";s:11:"description";s:178:"WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.";}i:21;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-17670";s:19:"versionEndExcluding";s:5:"5.2.4";s:11:"description";s:158:"WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.";}i:22;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-17671";s:19:"versionEndExcluding";s:5:"5.2.4";s:11:"description";s:130:"In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.";}i:23;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-17672";s:19:"versionEndExcluding";s:5:"5.2.4";s:11:"description";s:101:"WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.";}i:24;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-17673";s:19:"versionEndExcluding";s:5:"5.2.4";s:11:"description";s:136:"WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header.";}i:25;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-17674";s:19:"versionEndExcluding";s:5:"5.2.4";s:11:"description";s:93:"WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer.";}i:26;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-17675";s:19:"versionEndExcluding";s:5:"5.2.4";s:11:"description";s:143:"WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.";}i:27;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-16217";s:19:"versionEndExcluding";s:5:"5.2.3";s:11:"description";s:99:"WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.";}i:28;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-16218";s:19:"versionEndExcluding";s:5:"5.2.3";s:11:"description";s:53:"WordPress before 5.2.3 allows XSS in stored comments.";}i:29;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-16219";s:19:"versionEndExcluding";s:5:"5.2.3";s:11:"description";s:56:"WordPress before 5.2.3 allows XSS in shortcode previews.";}i:30;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-16220";s:19:"versionEndExcluding";s:5:"5.2.3";s:11:"description";s:148:"In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect.";}i:31;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-16221";s:19:"versionEndExcluding";s:5:"5.2.3";s:11:"description";s:61:"WordPress before 5.2.3 allows reflected XSS in the dashboard.";}i:32;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-16222";s:19:"versionEndExcluding";s:5:"5.2.3";s:11:"description";s:163:"WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks.";}i:33;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2019-16223";s:19:"versionEndExcluding";s:5:"5.2.3";s:11:"description";s:74:"WordPress before 5.2.3 allows XSS in post previews by authenticated users.";}i:34;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2019-9787";s:19:"versionEndExcluding";s:5:"5.1.1";s:11:"description";s:467:"WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php.";}i:35;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2019-8943";s:19:"versionEndExcluding";s:5:"5.0.4";s:11:"description";s:301:"WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.";}i:36;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2018-20147";s:19:"versionEndExcluding";s:5:"4.9.9";s:11:"description";s:128:"In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.";}i:37;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2018-20148";s:19:"versionEndExcluding";s:5:"4.9.9";s:11:"description";s:293:"In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.";}i:38;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2018-20149";s:19:"versionEndExcluding";s:5:"4.9.9";s:11:"description";s:230:"In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.";}i:39;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2018-20150";s:19:"versionEndExcluding";s:5:"4.9.9";s:11:"description";s:119:"In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.";}i:40;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2018-20151";s:19:"versionEndExcluding";s:5:"4.9.9";s:11:"description";s:288:"In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.";}i:41;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2018-20152";s:19:"versionEndExcluding";s:5:"4.9.9";s:11:"description";s:123:"In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.";}i:42;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2018-20153";s:19:"versionEndExcluding";s:5:"4.9.9";s:11:"description";s:147:"In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.";}i:43;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2019-8942";s:19:"versionEndExcluding";s:5:"4.9.9";s:11:"description";s:381:"WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.";}i:44;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2018-5776";s:19:"versionEndExcluding";s:5:"4.9.2";s:11:"description";s:111:"WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).";}i:45;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2017-17091";s:19:"versionEndExcluding";s:5:"4.9.1";s:11:"description";s:225:"wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.";}i:46;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2017-17092";s:19:"versionEndExcluding";s:5:"4.9.1";s:11:"description";s:202:"wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.";}i:47;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2017-17093";s:19:"versionEndExcluding";s:5:"4.9.1";s:11:"description";s:211:"wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.";}i:48;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2017-17094";s:19:"versionEndExcluding";s:5:"4.9.1";s:11:"description";s:178:"wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.";}i:49;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-9061";s:19:"versionEndExcluding";s:5:"4.7.5";s:11:"description";s:203:"In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.";}i:50;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-9062";s:19:"versionEndExcluding";s:5:"4.7.5";s:11:"description";s:98:"In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.";}i:51;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-9063";s:19:"versionEndExcluding";s:5:"4.7.5";s:11:"description";s:147:"In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.";}i:52;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-9064";s:19:"versionEndExcluding";s:5:"4.7.5";s:11:"description";s:178:"In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.";}i:53;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-9065";s:19:"versionEndExcluding";s:5:"4.7.5";s:11:"description";s:102:"In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.";}i:54;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-9066";s:19:"versionEndExcluding";s:5:"4.7.5";s:11:"description";s:104:"In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.";}i:55;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-6814";s:19:"versionEndExcluding";s:5:"4.7.3";s:11:"description";s:351:"In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js.";}i:56;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-6815";s:19:"versionEndExcluding";s:5:"4.7.3";s:11:"description";s:108:"In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.";}i:57;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-6816";s:19:"versionEndExcluding";s:5:"4.7.3";s:11:"description";s:140:"In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.";}i:58;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-6817";s:19:"versionEndExcluding";s:5:"4.7.3";s:11:"description";s:123:"In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.";}i:59;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-6818";s:19:"versionEndExcluding";s:5:"4.7.3";s:11:"description";s:113:"In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names.";}i:60;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-6819";s:19:"versionEndExcluding";s:5:"4.7.3";s:11:"description";s:272:"In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources. The CSRF can trigger an outbound HTTP request for a large file that is then parsed by Press This.";}i:61;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-5610";s:19:"versionEndExcluding";s:5:"4.7.2";s:11:"description";s:247:"wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms.";}i:62;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-5611";s:19:"versionEndExcluding";s:5:"4.7.2";s:11:"description";s:257:"SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name.";}i:63;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-5612";s:19:"versionEndExcluding";s:5:"4.7.2";s:11:"description";s:227:"Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt.";}i:64;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-5490";s:19:"versionEndExcluding";s:5:"4.7.1";s:11:"description";s:306:"Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php.";}i:65;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-5491";s:19:"versionEndExcluding";s:5:"4.7.1";s:11:"description";s:164:"wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.";}i:66;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-5492";s:19:"versionEndExcluding";s:5:"4.7.1";s:11:"description";s:324:"Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php.";}i:67;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2017-5493";s:19:"versionEndExcluding";s:5:"4.7.1";s:11:"description";s:267:"wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.";}i:68;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2016-7168";s:19:"versionEndExcluding";s:5:"4.6.1";s:11:"description";s:288:"Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename.";}i:69;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2016-10148";s:19:"versionEndExcluding";s:3:"4.6";s:11:"description";s:343:"The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896.";}i:70;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2016-6897";s:19:"versionEndExcluding";s:3:"4.6";s:11:"description";s:343:"Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.";}i:71;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2016-5834";s:19:"versionEndExcluding";s:5:"4.5.3";s:11:"description";s:278:"Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833.";}i:72;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2016-5835";s:19:"versionEndExcluding";s:5:"4.5.3";s:11:"description";s:210:"WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.";}i:73;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2016-5836";s:19:"versionEndExcluding";s:5:"4.5.3";s:11:"description";s:138:"The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.";}i:74;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2016-5837";s:19:"versionEndExcluding";s:5:"4.5.3";s:11:"description";s:154:"WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.";}i:75;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2016-5839";s:19:"versionEndExcluding";s:5:"4.5.3";s:11:"description";s:125:"WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.";}i:76;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2016-4566";s:19:"versionEndExcluding";s:5:"4.5.2";s:11:"description";s:236:"Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.";}i:77;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2016-4567";s:19:"versionEndExcluding";s:5:"4.5.2";s:11:"description";s:297:"Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."";}i:78;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2016-4029";s:19:"versionEndExcluding";s:3:"4.5";s:11:"description";s:218:"WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.";}i:79;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2016-6634";s:19:"versionEndExcluding";s:3:"4.5";s:11:"description";s:181:"Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.";}i:80;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2016-2222";s:19:"versionEndExcluding";s:5:"4.4.2";s:11:"description";s:263:"The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.";}i:81;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2010-4257";s:19:"versionEndExcluding";s:5:"3.0.2";s:11:"description";s:209:"SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field.";}i:82;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2006-4743";s:19:"versionEndExcluding";s:5:"2.0.6";s:11:"description";s:1220:"WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for (1) 404.php, (2) akismet.php, (3) archive.php, (4) archives.php, (5) attachment.php, (6) blogger.php, (7) comments.php, (8) comments-popup.php, (9) dotclear.php, (10) footer.php, (11) functions.php, (12) header.php, (13) hello.php, (14) wp-content/themes/default/index.php, (15) links.php, (16) livejournal.php, (17) mt.php, (18) page.php, (19) rss.php, (20) searchform.php, (21) search.php, (22) sidebar.php, (23) single.php, (24) textpattern.php, (25) upgrade-functions.php, (26) upgrade-schema.php, or (27) wp-db-backup.php, which reveal the path in various error messages.  NOTE: another researcher has disputed the details of this report, stating that version 2.0.5 does not exist. NOTE: the admin-footer.php, admin-functions.php, default-filters.php, edit-form-advanced.php, edit-link-form.php, edit-page-form.php, kses.php, locale.php, rss-functions.php, template-loader.php, and wp-db.php vectors are already covered by CVE-2006-0986. The edit-form-comment.php, vars.php, and wp-settings.php vectors are already covered by CVE-2005-4463. The menu-header.php vector is already covered by CVE-2005-2110.";}i:83;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2007-0106";s:19:"versionEndExcluding";s:5:"2.0.6";s:11:"description";s:346:"Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when WordPress generates a new link to verify the request.";}i:84;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2006-6808";s:19:"versionEndExcluding";s:5:"2.0.5";s:11:"description";s:300:"Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter.  NOTE: some sources have reported this as a vulnerability in the get_file_description function in wp-admin/admin-functions.php.";}i:85;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2007-0109";s:19:"versionEndExcluding";s:5:"2.0.5";s:11:"description";s:201:"wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.";}i:86;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2006-3389";s:19:"versionEndExcluding";s:5:"2.0.4";s:11:"description";s:327:"index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in an SQL error message.  NOTE: this issue has been disputed by a third party who states that the issue does not leak any target-specific information.";}i:87;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2006-1263";s:19:"versionEndExcluding";s:5:"2.0.3";s:11:"description";s:181:"Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.";}i:88;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2006-1012";s:19:"versionEndExcluding";s:5:"1.5.3";s:11:"description";s:203:"SQL injection vulnerability in WordPress 1.5.2, and possibly other versions before 2.0, allows remote attackers to execute arbitrary SQL commands via the User-Agent field in an HTTP header for a comment.";}i:89;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2004-1559";s:19:"versionEndExcluding";s:5:"1.2.1";s:11:"description";s:459:"Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, text, popupurl, or popuptitle parameters to wp-login.php, (2) redirect_url parameter to admin-header.php, (3) popuptitle, popupurl, content, or post_title parameters to bookmarklet.php, (4) cat_ID parameter to categories.php, (5) s parameter to edit.php, or (6) s or mode parameter to edit-comments.php.";}i:90;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2004-1584";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:200:"CRLF injection vulnerability in wp-login.php in WordPress 1.2 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the text parameter.";}i:91;O:8:"stdClass":3:{s:6:"CVE_ID";s:13:"CVE-2015-5730";s:19:"versionEndExcluding";s:0:"";s:11:"description";s:288:"The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.";}i:92;O:8:"stdClass":3:{s:6:"CVE_ID";s:14:"CVE-2020-11026";s:19:"versionEndExcluding";s:0:"";s:11:"description";s:470:"In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).";}}s:7:"plugins";a:990:{i:0;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-19487";s:4:"slug";s:10:"wp-jobhunt";s:19:"versionEndExcluding";s:11:"version 2.4";s:11:"description";s:250:"The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profile() function through the admin-ajax.php file, which allows remote unauthenticated attackers to enumerate information about users.";s:4:"refs";s:321:"[{"url":"https:\/\/github.com\/Antho59\/wp-jobhunt-exploit","name":"https:\/\/github.com\/Antho59\/wp-jobhunt-exploit","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9206","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9206","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:1;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-19488";s:4:"slug";s:10:"wp-jobhunt";s:19:"versionEndExcluding";s:11:"version 2.4";s:11:"description";s:244:"The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() function through the admin-ajax.php file, which allows remote unauthenticated attackers to reset the password of a user's account.";s:4:"refs";s:321:"[{"url":"https:\/\/github.com\/Antho59\/wp-jobhunt-exploit","name":"https:\/\/github.com\/Antho59\/wp-jobhunt-exploit","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9206","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9206","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:2;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-19370";s:4:"slug";s:13:"wordpress-seo";s:19:"versionEndExcluding";s:5:"9.2.0";s:11:"description";s:246:"A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.";s:4:"refs";s:671:"[{"url":"https:\/\/github.com\/Yoast\/wordpress-seo\/pull\/11502\/commits\/3bfa70a143f5ea3ee1934f3a1703bb5caf139ffa","name":"https:\/\/github.com\/Yoast\/wordpress-seo\/pull\/11502\/commits\/3bfa70a143f5ea3ee1934f3a1703bb5caf139ffa","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wordpress-seo\/#developers","name":"https:\/\/wordpress.org\/plugins\/wordpress-seo\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/www.youtube.com\/watch?v=nL141dcDGCY","name":"https:\/\/www.youtube.com\/watch?v=nL141dcDGCY","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:3;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15331";s:4:"slug";s:40:"wp-support-plus-responsive-ticket-system";s:19:"versionEndExcluding";s:5:"9.1.2";s:11:"description";s:98:"The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection.";s:4:"refs";s:240:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:4;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-7299";s:4:"slug";s:40:"wp-support-plus-responsive-ticket-system";s:19:"versionEndExcluding";s:5:"9.1.2";s:11:"description";s:341:"A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the subject parameter in wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/ajax/submit_ticket.php.";s:4:"refs";s:741:"[{"url":"https:\/\/cert.kalasag.com.ph\/news\/research\/cve-2019-7299-stored-xss-in-wp-support-plus-responsive-ticket-system\/","name":"https:\/\/cert.kalasag.com.ph\/news\/research\/cve-2019-7299-stored-xss-in-wp-support-plus-responsive-ticket-system\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9235","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9235","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:5;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18571";s:4:"slug";s:17:"search-everything";s:19:"versionEndExcluding";s:5:"8.1.7";s:11:"description";s:147:"The search-everything plugin before 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.";s:4:"refs";s:194:"[{"url":"https:\/\/wordpress.org\/plugins\/search-everything\/#developers","name":"https:\/\/wordpress.org\/plugins\/search-everything\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:6;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10917";s:4:"slug";s:17:"search-everything";s:19:"versionEndExcluding";s:5:"8.1.6";s:11:"description";s:152:"The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.";s:4:"refs";s:194:"[{"url":"https:\/\/wordpress.org\/plugins\/search-everything\/#developers","name":"https:\/\/wordpress.org\/plugins\/search-everything\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:7;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10917";s:4:"slug";s:17:"search-everything";s:19:"versionEndExcluding";s:5:"8.1.6";s:11:"description";s:152:"The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.";s:4:"refs";s:194:"[{"url":"https:\/\/wordpress.org\/plugins\/search-everything\/#developers","name":"https:\/\/wordpress.org\/plugins\/search-everything\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:8;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15650";s:4:"slug";s:35:"stops-core-theme-and-plugin-updates";s:19:"versionEndExcluding";s:5:"8.0.5";s:11:"description";s:198:"The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme updates) because of a nonce check error.";s:4:"refs";s:392:"[{"url":"https:\/\/wordpress.org\/plugins\/stops-core-theme-and-plugin-updates\/#developers","name":"https:\/\/wordpress.org\/plugins\/stops-core-theme-and-plugin-updates\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9837","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9837","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:9;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14950";s:4:"slug";s:20:"wp-live-chat-support";s:19:"versionEndExcluding";s:6:"8.0.27";s:11:"description";s:86:"The wp-live-chat-support plugin before 8.0.27 for WordPress has XSS via the GDPR page.";s:4:"refs";s:218:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-live-chat-support\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-live-chat-support\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:10;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9913";s:4:"slug";s:20:"wp-live-chat-support";s:19:"versionEndExcluding";s:6:"8.0.18";s:11:"description";s:123:"The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS.";s:4:"refs";s:665:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2019\/Mar\/42","name":"20190322 Re: WP Live Chat Support 8.0.17 - Reflected XSS (WordPress Plugin)","refsource":"FULLDISC","tags":["Third Party Advisory"]},{"url":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/14","name":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/14","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-wp-livechat-xss\/","name":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-wp-livechat-xss\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:11;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-12426";s:4:"slug";s:20:"wp-live-chat-support";s:19:"versionEndExcluding";s:6:"8.0.07";s:11:"description";s:271:"The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types, as demonstrated by a v1/remote_upload request with a .php filename and the image/jpeg content type.";s:4:"refs";s:593:"[{"url":"https:\/\/github.com\/CodeCabin\/wp-live-chat-support\/blob\/master\/readme.txt","name":"https:\/\/github.com\/CodeCabin\/wp-live-chat-support\/blob\/master\/readme.txt","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/github.com\/RiieCco\/write-ups\/tree\/master\/CVE-2018-12426","name":"https:\/\/github.com\/RiieCco\/write-ups\/tree\/master\/CVE-2018-12426","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9697","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9697","refsource":"MISC","tags":[]}]";}i:12;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2018-9864";s:4:"slug";s:11:"wp-livechat";s:19:"versionEndExcluding";s:6:"8.0.06";s:11:"description";s:94:"The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.";s:4:"refs";s:607:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-live-chat-support\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-live-chat-support\/#developers","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.gubello.me\/blog\/wp-live-chat-support-8-0-05-stored-xss\/","name":"https:\/\/www.gubello.me\/blog\/wp-live-chat-support-8-0-05-stored-xss\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/www.youtube.com\/watch?v=eHG1pWaez9w","name":"https:\/\/www.youtube.com\/watch?v=eHG1pWaez9w","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:13;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18519";s:4:"slug";s:13:"customer-area";s:19:"versionEndExcluding";s:5:"7.4.3";s:11:"description";s:76:"The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.";s:4:"refs";s:186:"[{"url":"https:\/\/wordpress.org\/plugins\/customer-area\/#developers","name":"https:\/\/wordpress.org\/plugins\/customer-area\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:14;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14800";s:4:"slug";s:23:"fv-wordpress-flowplayer";s:19:"versionEndExcluding";s:10:"7.3.15.727";s:11:"description";s:204:"The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI.";s:4:"refs";s:554:"[{"url":"https:\/\/wordpress.org\/plugins\/fv-wordpress-flowplayer\/#developers","name":"https:\/\/wordpress.org\/plugins\/fv-wordpress-flowplayer\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2019\/05\/15\/information-disclosure-vulnerability-in-fv-player-fv-flowplayer-video-player\/","name":"https:\/\/www.pluginvulnerabilities.com\/2019\/05\/15\/information-disclosure-vulnerability-in-fv-player-fv-flowplayer-video-player\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:15;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14801";s:4:"slug";s:23:"fv-wordpress-flowplayer";s:19:"versionEndExcluding";s:10:"7.3.15.727";s:11:"description";s:110:"The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection.";s:4:"refs";s:213:"[{"url":"https:\/\/wordpress.org\/plugins\/fv-wordpress-flowplayer\/#developers","name":"https:\/\/wordpress.org\/plugins\/fv-wordpress-flowplayer\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:16;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14799";s:4:"slug";s:23:"fv-wordpress-flowplayer";s:19:"versionEndExcluding";s:10:"7.3.14.727";s:11:"description";s:100:"The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.";s:4:"refs";s:701:"[{"url":"https:\/\/wordpress.org\/plugins\/fv-wordpress-flowplayer\/#developers","name":"https:\/\/wordpress.org\/plugins\/fv-wordpress-flowplayer\/#developers","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9278","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9278","refsource":"MISC","tags":[]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2019\/05\/15\/information-disclosure-vulnerability-in-fv-player-fv-flowplayer-video-player\/","name":"https:\/\/www.pluginvulnerabilities.com\/2019\/05\/15\/information-disclosure-vulnerability-in-fv-player-fv-flowplayer-video-player\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:17;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9669";s:4:"slug";s:9:"wordfence";s:19:"versionEndExcluding";s:5:"7.2.4";s:11:"description";s:79:"The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector.";s:4:"refs";s:261:"[{"url":"https:\/\/www.edgescan.com\/popular-wordpress-waf-bypass-zeroday-discovered-by-edgescan\/","name":"https:\/\/www.edgescan.com\/popular-wordpress-waf-bypass-zeroday-discovered-by-edgescan\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:18;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-11886";s:4:"slug";s:78:"WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer)";s:19:"versionEndExcluding";s:5:"7.2.1";s:11:"description";s:210:"The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.";s:4:"refs";s:1191:"[{"url":"https:\/\/wordpress.org\/plugins\/yellow-pencil-visual-theme-customizer\/#developers","name":"https:\/\/wordpress.org\/plugins\/yellow-pencil-visual-theme-customizer\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9256","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9256","refsource":"MISC","tags":[]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2019\/04\/09\/recently-closed-visual-css-style-editor-wordpress-plugin-contains-privilege-escalation-vulnerability-that-leads-to-option-update-vulnerability\/","name":"https:\/\/www.pluginvulnerabilities.com\/2019\/04\/09\/recently-closed-visual-css-style-editor-wordpress-plugin-contains-privilege-escalation-vulnerability-that-leads-to-option-update-vulnerability\/","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2019\/04\/zero-day-vulnerability-in-yellow-pencil-visual-theme-customizer-exploited-in-the-wild\/","name":"https:\/\/www.wordfence.com\/blog\/2019\/04\/zero-day-vulnerability-in-yellow-pencil-visual-theme-customizer-exploited-in-the-wild\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:19;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14792";s:4:"slug";s:14:"wp-google-maps";s:19:"versionEndExcluding";s:7:"7.11.35";s:11:"description";s:130:"The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.";s:4:"refs";s:779:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-google-maps\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-google-maps\/#developers","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9442","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9442","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2019\/07\/08\/recently-closed-wordpress-plugin-with-400000-installs-contains-another-authenticated-persistent-xss-vulnerability\/","name":"https:\/\/www.pluginvulnerabilities.com\/2019\/07\/08\/recently-closed-wordpress-plugin-with-400000-installs-contains-another-authenticated-persistent-xss-vulnerability\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:20;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-10692";s:4:"slug";s:14:"wp-google-maps";s:19:"versionEndExcluding";s:7:"7.11.18";s:11:"description";s:159:"In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.";s:4:"refs";s:829:"[{"url":"http:\/\/www.rapid7.com\/db\/modules\/auxiliary\/admin\/http\/wp_google_maps_sqli","name":"http:\/\/www.rapid7.com\/db\/modules\/auxiliary\/admin\/http\/wp_google_maps_sqli","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset?old_path=%2Fwp-google-maps&old=2061433&new_path=%2Fwp-google-maps&new=2061434&sfp_email=&sfph_mail=#file755","name":"https:\/\/plugins.trac.wordpress.org\/changeset?old_path=%2Fwp-google-maps&old=2061433&new_path=%2Fwp-google-maps&new=2061434&sfp_email=&sfph_mail=#file755","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-google-maps\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-google-maps\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:21;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9912";s:4:"slug";s:14:"wp-google-maps";s:19:"versionEndExcluding";s:7:"7.10.43";s:11:"description";s:100:"The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.";s:4:"refs";s:660:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2019\/Mar\/41","name":"20190322 Re: wpGoogleMaps 7.10.41 - Reflected XSS (WordPress Plugin)","refsource":"FULLDISC","tags":["Third Party Advisory"]},{"url":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/13","name":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/13","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-wpgooglemaps-xss\/","name":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-wpgooglemaps-xss\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:22;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18507";s:4:"slug";s:20:"wp-live-chat-support";s:19:"versionEndExcluding";s:6:"7.1.05";s:11:"description";s:68:"The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.";s:4:"refs";s:207:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-live-chat-support\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-live-chat-support\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:23;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18508";s:4:"slug";s:20:"wp-live-chat-support";s:19:"versionEndExcluding";s:6:"7.1.03";s:11:"description";s:68:"The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.";s:4:"refs";s:358:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-live-chat-support\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-live-chat-support\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9719","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9719","refsource":"MISC","tags":[]}]";}i:24;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10930";s:4:"slug";s:40:"wp-support-plus-responsive-ticket-system";s:19:"versionEndExcluding";s:5:"7.1.0";s:11:"description";s:136:"The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.";s:4:"refs";s:240:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:25;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10930";s:4:"slug";s:40:"wp-support-plus-responsive-ticket-system";s:19:"versionEndExcluding";s:5:"7.1.0";s:11:"description";s:136:"The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.";s:4:"refs";s:240:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:26;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-12636";s:4:"slug";s:18:"better-wp-security";s:19:"versionEndExcluding";s:5:"7.0.3";s:11:"description";s:152:"The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page.";s:4:"refs";s:358:"[{"url":"https:\/\/wordpress.org\/plugins\/better-wp-security\/#developers","name":"https:\/\/wordpress.org\/plugins\/better-wp-security\/#developers","refsource":"CONFIRM","tags":["Third Party Advisory"]},{"url":"https:\/\/www.exploit-db.com\/exploits\/44943\/","name":"44943","refsource":"EXPLOIT-DB","tags":["Exploit","Third Party Advisory","VDB Entry"]}]";}i:27;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2018-7433";s:4:"slug";s:18:"better-wp-security";s:19:"versionEndExcluding";s:5:"6.9.1";s:11:"description";s:113:"The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.";s:4:"refs";s:203:"[{"url":"https:\/\/wordpress.org\/plugins\/better-wp-security\/#developers","name":"https:\/\/wordpress.org\/plugins\/better-wp-security\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:28;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-25213";s:4:"slug";s:15:"wp-file-manager";s:19:"versionEndExcluding";s:3:"6.9";s:11:"description";s:456:"The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it renames an unsafe example elFinder connector file to have the .php extension. This, for example, allows attackers to run the elFinder upload (or mkfile and put) command to write PHP code into the wp-content/plugins/wp-file-manager/lib/files/ directory. This was exploited in the wild in August and September 2020.";s:4:"refs";s:1383:"[{"url":"https:\/\/hotforsecurity.bitdefender.com\/blog\/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html","name":"https:\/\/hotforsecurity.bitdefender.com\/blog\/wordpress-websites-attacked-via-file-manager-plugin-vulnerability-24048.html","refsource":"MISC","tags":[]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2373068","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2373068","refsource":"MISC","tags":[]},{"url":"https:\/\/seravo.com\/blog\/0-day-vulnerability-in-wp-file-manager\/","name":"https:\/\/seravo.com\/blog\/0-day-vulnerability-in-wp-file-manager\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordfence.com\/blog\/2020\/09\/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin\/","name":"https:\/\/wordfence.com\/blog\/2020\/09\/700000-wordpress-users-affected-by-zero-day-vulnerability-in-file-manager-plugin\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/wp-file-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-file-manager\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/zdnet.com\/article\/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug\/","name":"https:\/\/zdnet.com\/article\/millions-of-wordpress-sites-are-being-probed-attacked-with-recent-plugin-bug\/","refsource":"MISC","tags":[]}]";}i:29;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-35933";s:4:"slug";s:10:"newsletter";s:19:"versionEndExcluding";s:5:"6.8.3";s:11:"description";s:345:"A Reflected Authenticated Cross-Site Scripting (XSS) vulnerability in the Newsletter plugin before 6.8.2 for WordPress allows remote attackers to trick a victim into submitting a tnpc_render AJAX request containing either JavaScript in an options parameter, or a base64-encoded JSON string containing JavaScript in the encoded_options parameter.";s:4:"refs";s:261:"[{"url":"https:\/\/www.wordfence.com\/blog\/2020\/08\/newsletter-plugin-vulnerabilities-affect-over-300000-sites\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/08\/newsletter-plugin-vulnerabilities-affect-over-300000-sites\/","refsource":"MISC","tags":[]}]";}i:30;O:8:"stdClass":5:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:23:"advanced-access-manager";s:19:"versionEndExcluding";s:5:"6.6.2";s:11:"description";s:0:"";s:4:"refs";s:102:"https://www.wordfence.com/blog/2020/08/high-severity-vulnerability-patched-in-advanced-access-manager/";}i:31;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-35934";s:4:"slug";s:23:"advanced-access-manager";s:19:"versionEndExcluding";s:5:"6.6.2";s:11:"description";s:348:"The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/authenticate or aam/v2/authenticate). This is a security problem if this object stores information that the user is not supposed to have (e.g., custom metadata added by a different plugin).";s:4:"refs";s:269:"[{"url":"https:\/\/www.wordfence.com\/blog\/2020\/08\/high-severity-vulnerability-patched-in-advanced-access-manager\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/08\/high-severity-vulnerability-patched-in-advanced-access-manager\/","refsource":"MISC","tags":[]}]";}i:32;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15318";s:4:"slug";s:33:"yikes-inc-easy-mailchimp-extender";s:19:"versionEndExcluding";s:5:"6.5.3";s:11:"description";s:117:"The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.";s:4:"refs";s:388:"[{"url":"https:\/\/wordpress.org\/plugins\/yikes-inc-easy-mailchimp-extender\/#developers","name":"https:\/\/wordpress.org\/plugins\/yikes-inc-easy-mailchimp-extender\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9583","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9583","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:33;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17599";s:4:"slug";s:16:"quiz-master-next";s:19:"versionEndExcluding";s:5:"6.3.5";s:11:"description";s:437:"The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The component is: admin/quiz-options-page.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.";s:4:"refs";s:701:"[{"url":"https:\/\/github.com\/QuizandSurveyMaster\/quiz_master_next\/issues\/795","name":"https:\/\/github.com\/QuizandSurveyMaster\/quiz_master_next\/issues\/795","refsource":"MISC","tags":[]},{"url":"https:\/\/github.com\/QuizandSurveyMaster\/quiz_master_next\/pull\/796","name":"https:\/\/github.com\/QuizandSurveyMaster\/quiz_master_next\/pull\/796","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/quiz-master-next\/#developers","name":"https:\/\/wordpress.org\/plugins\/quiz-master-next\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9977","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9977","refsource":"MISC","tags":[]}]";}i:34;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10879";s:4:"slug";s:20:"wp-live-chat-support";s:19:"versionEndExcluding";s:6:"6.2.02";s:11:"description";s:68:"The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.";s:4:"refs";s:218:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-live-chat-support\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-live-chat-support\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:35;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10879";s:4:"slug";s:20:"wp-live-chat-support";s:19:"versionEndExcluding";s:6:"6.2.02";s:11:"description";s:68:"The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.";s:4:"refs";s:218:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-live-chat-support\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-live-chat-support\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:36;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9422";s:4:"slug";s:9:"plugnedit";s:19:"versionEndExcluding";s:5:"6.2.0";s:11:"description";s:271:"The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load plugnedit_width, pnemedcount, PlugneditBGColor, PlugneditEditorMargin, or plugneditcontent parameters.";s:4:"refs";s:606:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_b5405e735cb605b2fd1a300bb8be4860.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_b5405e735cb605b2fd1a300bb8be4860.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/plugnedit\/#developers","name":"https:\/\/wordpress.org\/plugins\/plugnedit\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8331","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8331","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:37;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9423";s:4:"slug";s:9:"plugnedit";s:19:"versionEndExcluding";s:5:"6.2.0";s:11:"description";s:251:"The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGColor, PlugneditEditorMargin, plugnedit_width, pnemedcount, or plugneditcontent parameters.";s:4:"refs";s:613:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_b5405e735cb605b2fd1a300bb8be4860.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_b5405e735cb605b2fd1a300bb8be4860.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/plugnedit\/#developers","name":"https:\/\/wordpress.org\/plugins\/plugnedit\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8331","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8331","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:38;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15646";s:4:"slug";s:9:"rsvpmaker";s:19:"versionEndExcluding";s:3:"6.2";s:11:"description";s:64:"The rsvpmaker plugin before 6.2 for WordPress has SQL injection.";s:4:"refs";s:538:"[{"url":"https:\/\/plugins.trac.wordpress.org\/log\/rsvpmaker\/tags\/6.2","name":"https:\/\/plugins.trac.wordpress.org\/log\/rsvpmaker\/tags\/6.2","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/rsvpmaker\/#developers","name":"https:\/\/wordpress.org\/plugins\/rsvpmaker\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9830","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9830","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:39;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9575";s:4:"slug";s:16:"quiz-master-next";s:19:"versionEndExcluding";s:5:"6.1.0";s:11:"description";s:114:"The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.";s:4:"refs";s:952:"[{"url":"https:\/\/github.com\/QuizandSurveyMaster\/quiz_master_next\/blob\/master\/CHANGELOG.md","name":"https:\/\/github.com\/QuizandSurveyMaster\/quiz_master_next\/blob\/master\/CHANGELOG.md","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/5","name":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/5","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-quiz-and-survey-master-xss\/","name":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-quiz-and-survey-master-xss\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/quiz-master-next\/#developers","name":"https:\/\/wordpress.org\/plugins\/quiz-master-next\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]}]";}i:40;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9914";s:4:"slug";s:8:"yop-poll";s:19:"versionEndExcluding";s:5:"6.0.3";s:11:"description";s:115:"The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS.";s:4:"refs";s:656:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2019\/Mar\/43","name":"20190322 Re: YOP Poll 6.0.2 - Reflected XSS (WordPress Plugin)","refsource":"FULLDISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/15","name":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/15","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-yop-poll-xss\/","name":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-yop-poll-xss\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:41;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9303";s:4:"slug";s:26:"simple-share-buttons-adder";s:19:"versionEndExcluding";s:5:"6.0.0";s:11:"description";s:73:"The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.";s:4:"refs";s:230:"[{"url":"https:\/\/wordpress.org\/plugins\/simple-share-buttons-adder\/#developers","name":"https:\/\/wordpress.org\/plugins\/simple-share-buttons-adder\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:42;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15771";s:4:"slug";s:13:"nd-shortcodes";s:19:"versionEndExcluding";s:3:"6.0";s:11:"description";s:124:"The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.";s:4:"refs";s:644:"[{"url":"https:\/\/threatpost.com\/wordpress-plugins-exploited-in-ongoing-attack-researchers-warn\/147671\/","name":"https:\/\/threatpost.com\/wordpress-plugins-exploited-in-ongoing-attack-researchers-warn\/147671\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/nd-shortcodes\/#developers","name":"https:\/\/wordpress.org\/plugins\/nd-shortcodes\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9485","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9485","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:43;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16523";s:4:"slug";s:14:"events-manager";s:19:"versionEndExcluding";s:5:"5.9.6";s:11:"description";s:255:"The events-manager plugin through 5.9.5 for WordPress (aka Events Manager) is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute map_style of shortcodes (locations_map and events_map) provided by the plugin.";s:4:"refs";s:963:"[{"url":"http:\/\/www.openwall.com\/lists\/oss-security\/2019\/10\/16\/4","name":"[oss-security] 20191016 [SBA-ADV-20190913-03] CVE-2019-16523: WordPress Plugin - Events Manager <= 5.9.5 - Stored XSS","refsource":"MLIST","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/github.com\/sbaresearch\/advisories\/tree\/public\/2019\/SBA-ADV-20190913-03_WordPress_Plugin_Events_Manager","name":"https:\/\/github.com\/sbaresearch\/advisories\/tree\/public\/2019\/SBA-ADV-20190913-03_WordPress_Plugin_Events_Manager","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9916","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9916","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:44;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17550";s:4:"slug";s:11:"blog2social";s:19:"versionEndExcluding";s:5:"5.9.0";s:11:"description";s:366:"The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the b2s_id parameter. The component is: views/b2s/post.calendar.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.";s:4:"refs";s:491:"[{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2186043","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2186043","refsource":"MISC","tags":[]},{"url":"https:\/\/plugins.trac.wordpress.org\/log\/blog2social\/","name":"https:\/\/plugins.trac.wordpress.org\/log\/blog2social\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/blog2social\/#developers","name":"https:\/\/wordpress.org\/plugins\/blog2social\/#developers","refsource":"MISC","tags":[]}]";}i:45;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-16842";s:4:"slug";s:13:"wordpress-seo";s:19:"versionEndExcluding";s:5:"5.8.0";s:11:"description";s:206:"Cross-site scripting (XSS) vulnerability in admin/google_search_console/class-gsc-table.php in the Yoast SEO plugin before 5.8.0 for WordPress allows remote attackers to inject arbitrary web script or HTML.";s:4:"refs";s:823:"[{"url":"https:\/\/packetstormsecurity.com\/files\/145080\/WordPress-Yoast-SEO-Cross-Site-Scripting.html","name":"https:\/\/packetstormsecurity.com\/files\/145080\/WordPress-Yoast-SEO-Cross-Site-Scripting.html","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/1766831\/wordpress-seo\/trunk\/admin\/google_search_console\/class-gsc-table.php","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/1766831\/wordpress-seo\/trunk\/admin\/google_search_console\/class-gsc-table.php","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wordpress-seo\/#developers","name":"https:\/\/wordpress.org\/plugins\/wordpress-seo\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:46;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20986";s:4:"slug";s:22:"advanced-custom-fields";s:19:"versionEndExcluding";s:5:"5.7.8";s:11:"description";s:123:"The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.";s:4:"refs";s:762:"[{"url":"https:\/\/wordpress.org\/plugins\/advanced-custom-fields\/#developers","name":"https:\/\/wordpress.org\/plugins\/advanced-custom-fields\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/www.advancedcustomfields.com\/blog\/acf-5-7-8-release\/","name":"https:\/\/www.advancedcustomfields.com\/blog\/acf-5-7-8-release\/","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/www.advancedcustomfields.com\/changelog\/","name":"https:\/\/www.advancedcustomfields.com\/changelog\/","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/www2.deloitte.com\/de\/de\/pages\/risk\/articles\/wordpress-plugin-xss.html","name":"https:\/\/www2.deloitte.com\/de\/de\/pages\/risk\/articles\/wordpress-plugin-xss.html","refsource":"MISC","tags":[]}]";}i:47;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-21004";s:4:"slug";s:9:"rsvpmaker";s:19:"versionEndExcluding";s:5:"5.6.4";s:11:"description";s:66:"The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection.";s:4:"refs";s:542:"[{"url":"https:\/\/plugins.trac.wordpress.org\/log\/rsvpmaker\/tags\/5.6.4","name":"https:\/\/plugins.trac.wordpress.org\/log\/rsvpmaker\/tags\/5.6.4","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/rsvpmaker\/#developers","name":"https:\/\/wordpress.org\/plugins\/rsvpmaker\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9831","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9831","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:48;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20967";s:4:"slug";s:24:"wp-ultimate-csv-importer";s:19:"versionEndExcluding";s:5:"5.6.1";s:11:"description";s:72:"The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.";s:4:"refs";s:232:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-ultimate-csv-importer\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-ultimate-csv-importer\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:49;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9297";s:4:"slug";s:14:"events-manager";s:19:"versionEndExcluding";s:3:"5.6";s:11:"description";s:59:"The events-manager plugin before 5.6 for WordPress has XSS.";s:4:"refs";s:211:"[{"url":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:50;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9298";s:4:"slug";s:14:"events-manager";s:19:"versionEndExcluding";s:3:"5.6";s:11:"description";s:70:"The events-manager plugin before 5.6 for WordPress has code injection.";s:4:"refs";s:211:"[{"url":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:51;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9299";s:4:"slug";s:14:"events-manager";s:19:"versionEndExcluding";s:7:"5.5.7.1";s:11:"description";s:67:"The events-manager plugin before 5.5.7.1 for WordPress has DOM XSS.";s:4:"refs";s:211:"[{"url":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:52;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9300";s:4:"slug";s:14:"events-manager";s:19:"versionEndExcluding";s:5:"5.5.7";s:11:"description";s:77:"The events-manager plugin before 5.5.7 for WordPress has multiple XSS issues.";s:4:"refs";s:211:"[{"url":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:53;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2013-7477";s:4:"slug";s:14:"events-manager";s:19:"versionEndExcluding";s:5:"5.5.2";s:11:"description";s:81:"The events-manager plugin before 5.5.2 for WordPress has XSS in the booking form.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:54;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2013-7478";s:4:"slug";s:14:"events-manager";s:19:"versionEndExcluding";s:3:"5.5";s:11:"description";s:83:"The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:55;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18520";s:4:"slug";s:14:"democracy-poll";s:19:"versionEndExcluding";s:3:"5.4";s:11:"description";s:107:"The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.";s:4:"refs";s:539:"[{"url":"https:\/\/wordpress.org\/plugins\/democracy-poll\/#developers","name":"https:\/\/wordpress.org\/plugins\/democracy-poll\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2017\/02\/22\/cross-site-request-forgery-csrfcross-site-scripting-xss-vulnerability-in-democracy-poll\/","name":"https:\/\/www.pluginvulnerabilities.com\/2017\/02\/22\/cross-site-request-forgery-csrfcross-site-scripting-xss-vulnerability-in-democracy-poll\/","refsource":"MISC","tags":["Broken Link"]}]";}i:56;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18521";s:4:"slug";s:14:"democracy-poll";s:19:"versionEndExcluding";s:3:"5.4";s:11:"description";s:126:"The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.";s:4:"refs";s:558:"[{"url":"https:\/\/wordpress.org\/plugins\/democracy-poll\/#developers","name":"https:\/\/wordpress.org\/plugins\/democracy-poll\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2017\/02\/22\/cross-site-request-forgery-csrfcross-site-scripting-xss-vulnerability-in-democracy-poll\/","name":"https:\/\/www.pluginvulnerabilities.com\/2017\/02\/22\/cross-site-request-forgery-csrfcross-site-scripting-xss-vulnerability-in-democracy-poll\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:57;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2013-7479";s:4:"slug";s:14:"events-manager";s:19:"versionEndExcluding";s:5:"5.3.9";s:11:"description";s:86:"The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:58;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2013-7480";s:4:"slug";s:14:"events-manager";s:19:"versionEndExcluding";s:7:"5.3.6.1";s:11:"description";s:100:"The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:59;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-13640";s:4:"slug";s:8:"wpdiscuz";s:19:"versionEndExcluding";s:5:"5.3.6";s:11:"description";s:226:"A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. (No 7.x versions are affected.)";s:4:"refs";s:745:"[{"url":"https:\/\/plugins.trac.wordpress.org\/browser\/wpdiscuz\/tags\/5.3.6","name":"https:\/\/plugins.trac.wordpress.org\/browser\/wpdiscuz\/tags\/5.3.6","refsource":"MISC","tags":[]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2323200","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2323200","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/wpdiscuz\/#developers","name":"https:\/\/wordpress.org\/plugins\/wpdiscuz\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpdiscuz.com\/community\/news\/security-vulnerability-issue-in-5-3-5-please-udate\/","name":"https:\/\/wpdiscuz.com\/community\/news\/security-vulnerability-issue-in-5-3-5-please-udate\/","refsource":"MISC","tags":[]}]";}i:60;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-35489";s:4:"slug";s:14:"contact-form-7";s:19:"versionEndExcluding";s:5:"5.3.2";s:11:"description";s:182:"The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.";s:4:"refs";s:929:"[{"url":"https:\/\/contactform7.com\/2020\/12\/17\/contact-form-7-532\/","name":"https:\/\/contactform7.com\/2020\/12\/17\/contact-form-7-532\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/contact-form-7\/#developers","name":"https:\/\/wordpress.org\/plugins\/contact-form-7\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpscan.com\/vulnerability\/10508","name":"https:\/\/wpscan.com\/vulnerability\/10508","refsource":"MISC","tags":[]},{"url":"https:\/\/www.getastra.com\/blog\/911\/plugin-exploit\/contact-form-7-unrestricted-file-upload\/","name":"https:\/\/www.getastra.com\/blog\/911\/plugin-exploit\/contact-form-7-unrestricted-file-upload\/","refsource":"MISC","tags":[]},{"url":"https:\/\/www.jinsonvarghese.com\/unrestricted-file-upload-in-contact-form-7\/","name":"https:\/\/www.jinsonvarghese.com\/unrestricted-file-upload-in-contact-form-7\/","refsource":"MISC","tags":[]}]";}i:61;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-13570";s:4:"slug";s:13:"AJdG AdRotate";s:19:"versionEndExcluding";s:3:"5.3";s:11:"description";s:71:"The AJdG AdRotate plugin before 5.3 for WordPress allows SQL Injection.";s:4:"refs";s:411:"[{"url":"https:\/\/ajdg.solutions\/2019\/07\/11\/adrotate-pro-5-3-important-update-for-security-and-ads-txt\/","name":"https:\/\/ajdg.solutions\/2019\/07\/11\/adrotate-pro-5-3-important-update-for-security-and-ads-txt\/","refsource":"CONFIRM","tags":["Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9475","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9475","refsource":"MISC","tags":[]}]";}i:62;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20983";s:4:"slug";s:12:"wp-retina-2x";s:19:"versionEndExcluding";s:5:"5.2.3";s:11:"description";s:59:"The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.";s:4:"refs";s:184:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-retina-2x\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-retina-2x\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:63;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2009-5158";s:4:"slug";s:19:"google-analyticator";s:19:"versionEndExcluding";s:5:"5.2.1";s:11:"description";s:123:"The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.";s:4:"refs";s:221:"[{"url":"https:\/\/wordpress.org\/plugins\/google-analyticator\/#developers","name":"https:\/\/wordpress.org\/plugins\/google-analyticator\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:64;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17515";s:4:"slug";s:22:"cleantalk-spam-protect";s:19:"versionEndExcluding";s:7:"5.127.4";s:11:"description";s:422:"The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter. The component is: inc/cleantalk-users.php and inc/cleantalk-comments.php. The attack vector is: When the Administrator is logged in, a reflected XSS may execute upon a click on a malicious URL.";s:4:"refs";s:351:"[{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2172333","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2172333","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/cleantalk-spam-protect\/#developers","name":"https:\/\/wordpress.org\/plugins\/cleantalk-spam-protect\/#developers","refsource":"MISC","tags":[]}]";}i:65;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-12826";s:4:"slug";s:12:"widget-logic";s:19:"versionEndExcluding";s:6:"5.10.2";s:11:"description";s:365:"A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers to execute PHP code via snippets (that are attached to widgets and then eval'd to dynamically determine their visibility) by crafting a malicious POST request that tricks administrators into adding the code.";s:4:"refs";s:694:"[{"url":"https:\/\/dannewitz.ninja\/posts\/widget-logic-csrf-to-rce","name":"https:\/\/dannewitz.ninja\/posts\/widget-logic-csrf-to-rce","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2112753\/widget-logic","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2112753\/widget-logic","refsource":"CONFIRM","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9403","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9403","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9413","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9413","refsource":"MISC","tags":[]}]";}i:66;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2012-6716";s:4:"slug";s:14:"events-manager";s:19:"versionEndExcluding";s:5:"5.1.7";s:11:"description";s:81:"The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/events-manager\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:67;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-9459";s:4:"slug";s:27:"modern-events-calendar-lite";s:19:"versionEndExcluding";s:5:"5.1.7";s:11:"description";s:316:"Multiple Stored Cross-site scripting (XSS) vulnerabilities in the Webnus Modern Events Calendar Lite plugin through 5.1.6 for WordPress allows remote authenticated users (with minimal permissions) to inject arbitrary JavaScript, HTML, or CSS via Ajax actions. This affects mec_save_notifications and import_settings.";s:4:"refs";s:417:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10100","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10100","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/02\/site-takeover-campaign-exploits-multiple-zero-day-vulnerabilities\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/02\/site-takeover-campaign-exploits-multiple-zero-day-vulnerabilities\/","refsource":"MISC","tags":[]}]";}i:68;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-9174";s:4:"slug";s:13:"wordpress-seo";s:19:"versionEndExcluding";s:5:"5.1.4";s:11:"description";s:295:"Cross-site scripting (XSS) vulnerability in the Google Analytics by Yoast (google-analytics-for-wordpress) plugin before 5.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "Manually enter your UA code" (manual_ua_code_field) field in the General Settings.";s:4:"refs";s:772:"[{"url":"http:\/\/www.securityfocus.com\/bid\/71330","name":"71330","refsource":"BID","tags":[]},{"url":"https:\/\/exchange.xforce.ibmcloud.com\/vulnerabilities\/99053","name":"wp-googleanalyticsbyyoast-xss(99053)","refsource":"XF","tags":[]},{"url":"https:\/\/twitter.com\/yoast\/status\/537569224307511296","name":"https:\/\/twitter.com\/yoast\/status\/537569224307511296","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/google-analytics-for-wordpress\/changelog\/","name":"https:\/\/wordpress.org\/plugins\/google-analytics-for-wordpress\/changelog\/","refsource":"CONFIRM","tags":["Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/7692","name":"https:\/\/wpvulndb.com\/vulnerabilities\/7692","refsource":"MISC","tags":[]}]";}i:69;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-15038";s:4:"slug";s:11:"coming-soon";s:19:"versionEndExcluding";s:5:"5.1.2";s:11:"description";s:70:"The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS.";s:4:"refs";s:667:"[{"url":"https:\/\/wordpress.org\/plugins\/coming-soon\/#developers","name":"https:\/\/wordpress.org\/plugins\/coming-soon\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.getastra.com\/blog\/911\/plugin-exploit\/stored-xss-coming-soon-page-maintenance-mode-plugin\/","name":"https:\/\/www.getastra.com\/blog\/911\/plugin-exploit\/stored-xss-coming-soon-page-maintenance-mode-plugin\/","refsource":"MISC","tags":[]},{"url":"https:\/\/www.jinsonvarghese.com\/stored-xss-coming-soon-maintenance-mode-wordpress-plugin\/","name":"https:\/\/www.jinsonvarghese.com\/stored-xss-coming-soon-maintenance-mode-wordpress-plugin\/","refsource":"MISC","tags":[]}]";}i:70;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14949";s:4:"slug";s:18:"wp-database-backup";s:19:"versionEndExcluding";s:5:"5.1.2";s:11:"description";s:65:"The wp-database-backup plugin before 5.1.2 for WordPress has XSS.";s:4:"refs";s:354:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9548","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9548","refsource":"MISC","tags":[]}]";}i:71;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19979";s:4:"slug";s:14:"wp-maintenance";s:19:"versionEndExcluding";s:5:"5.0.6";s:11:"description";s:211:"A flaw in the WordPress plugin, WP Maintenance before 5.0.6, allowed attackers to enable a vulnerable site's maintenance mode and inject malicious code affecting site visitors. There was CSRF with resultant XSS.";s:4:"refs";s:405:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9954","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9954","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2019\/11\/high-severity-vulnerability-patched-in-wp-maintenance-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2019\/11\/high-severity-vulnerability-patched-in-wp-maintenance-plugin\/","refsource":"MISC","tags":[]}]";}i:72;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20979";s:4:"slug";s:14:"contact-form-7";s:19:"versionEndExcluding";s:5:"5.0.4";s:11:"description";s:139:"The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in register_post_type.";s:4:"refs";s:211:"[{"url":"https:\/\/wordpress.org\/plugins\/contact-form-7\/#developers","name":"https:\/\/wordpress.org\/plugins\/contact-form-7\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:73;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9576";s:4:"slug";s:11:"blog2social";s:19:"versionEndExcluding";s:5:"5.0.3";s:11:"description";s:102:"The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS.";s:4:"refs";s:658:"[{"url":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/6","name":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/6","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-blog2social-xss\/","name":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-blog2social-xss\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/blog2social\/#developers","name":"https:\/\/wordpress.org\/plugins\/blog2social\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]}]";}i:74;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9439";s:4:"slug";s:7:"addthis";s:19:"versionEndExcluding";s:6:"5.0.13";s:11:"description";s:155:"The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.";s:4:"refs";s:602:"[{"url":"http:\/\/blog.cinu.pl\/2015\/11\/php-static-code-analysis-vs-top-1000-wordpress-plugins.html","name":"http:\/\/blog.cinu.pl\/2015\/11\/php-static-code-analysis-vs-top-1000-wordpress-plugins.html","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/addthis\/#developers","name":"https:\/\/wordpress.org\/plugins\/addthis\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8246","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8246","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:75;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18580";s:4:"slug";s:19:"shortcodes-ultimate";s:19:"versionEndExcluding";s:5:"5.0.1";s:11:"description";s:132:"The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.";s:4:"refs";s:198:"[{"url":"https:\/\/wordpress.org\/plugins\/shortcodes-ultimate\/#developers","name":"https:\/\/wordpress.org\/plugins\/shortcodes-ultimate\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:76;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10870";s:4:"slug";s:26:"google-language-translator";s:19:"versionEndExcluding";s:6:"5.0.06";s:11:"description";s:74:"The google-language-translator plugin before 5.0.06 for WordPress has XSS.";s:4:"refs";s:235:"[{"url":"https:\/\/wordpress.org\/plugins\/google-language-translator\/#developers","name":"https:\/\/wordpress.org\/plugins\/google-language-translator\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:77;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-16562";s:4:"slug";s:7:"UserPro";s:19:"versionEndExcluding";s:8:"4.9.17.1";s:11:"description";s:267:"The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the up_auto_log parameter in the QUERY_STRING to the default URI.";s:4:"refs";s:596:"[{"url":"https:\/\/codecanyon.net\/item\/userpro-user-profiles-with-social-login\/5958681?s_rank=9","name":"https:\/\/codecanyon.net\/item\/userpro-user-profiles-with-social-login\/5958681?s_rank=9","refsource":"CONFIRM","tags":["Issue Tracking"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8950","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8950","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https:\/\/www.exploit-db.com\/exploits\/43117\/","name":"43117","refsource":"EXPLOIT-DB","tags":["Exploit","Issue Tracking","Third Party Advisory","VDB Entry"]}]";}i:78;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9418";s:4:"slug";s:8:"Watu Pro";s:19:"versionEndExcluding";s:7:"4.9.0.8";s:11:"description";s:100:"The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.";s:4:"refs";s:666:"[{"url":"https:\/\/advisories.dxw.com\/advisories\/csrf-in-watu-pro-allows-unauthenticated-attackers-to-delete-quizzes\/","name":"https:\/\/advisories.dxw.com\/advisories\/csrf-in-watu-pro-allows-unauthenticated-attackers-to-delete-quizzes\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/calendarscripts.info\/watupro\/","name":"https:\/\/calendarscripts.info\/watupro\/","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/watupro\/#developers","name":"https:\/\/wordpress.org\/plugins\/watupro\/#developers","refsource":"MISC","tags":["Not Applicable","Third Party Advisory"]}]";}i:79;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-6850";s:4:"slug";s:33:"miniorange-saml-20-single-sign-on";s:19:"versionEndExcluding";s:6:"4.8.84";s:11:"description";s:276:"Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element.";s:4:"refs";s:695:"[{"url":"https:\/\/wordpress.org\/plugins\/miniorange-saml-20-single-sign-on\/#developers","name":"https:\/\/wordpress.org\/plugins\/miniorange-saml-20-single-sign-on\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/zeroauth.ltd\/blog\/","name":"https:\/\/zeroauth.ltd\/blog\/","refsource":"MISC","tags":[]},{"url":"https:\/\/zeroauth.ltd\/blog\/2020\/01\/28\/cve-2020-6850-miniorange-saml-wp-plugin-before-4-8-84-is-vulnerable-to-xss-via-a-specially-crafted-saml-xml-response\/","name":"https:\/\/zeroauth.ltd\/blog\/2020\/01\/28\/cve-2020-6850-miniorange-saml-wp-plugin-before-4-8-84-is-vulnerable-to-xss-via-a-specially-crafted-saml-xml-response\/","refsource":"MISC","tags":[]}]";}i:80;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15109";s:4:"slug";s:19:"the-events-calendar";s:19:"versionEndExcluding";s:5:"4.8.2";s:11:"description";s:100:"The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.";s:4:"refs";s:360:"[{"url":"https:\/\/wordpress.org\/plugins\/the-events-calendar\/#developers","name":"https:\/\/wordpress.org\/plugins\/the-events-calendar\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9554","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9554","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:81;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15112";s:4:"slug";s:11:"wp-slimstat";s:19:"versionEndExcluding";s:5:"4.8.1";s:11:"description";s:58:"The wp-slimstat plugin before 4.8.1 for WordPress has XSS.";s:4:"refs";s:322:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-slimstat\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-slimstat\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9285","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9285","refsource":"MISC","tags":[]}]";}i:82;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15775";s:4:"slug";s:11:"nd-learning";s:19:"versionEndExcluding";s:3:"4.8";s:11:"description";s:122:"The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.";s:4:"refs";s:639:"[{"url":"https:\/\/threatpost.com\/wordpress-plugins-exploited-in-ongoing-attack-researchers-warn\/147671\/","name":"https:\/\/threatpost.com\/wordpress-plugins-exploited-in-ongoing-attack-researchers-warn\/147671\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/nd-learning\/#developers","name":"https:\/\/wordpress.org\/plugins\/nd-learning\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9496","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9496","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:83;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11085";s:4:"slug";s:16:"quiz-master-next";s:19:"versionEndExcluding";s:5:"4.7.9";s:11:"description";s:239:"php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the question_name parameter because js/admin_question.js mishandles parsing inside of a SCRIPT element.";s:4:"refs";s:403:"[{"url":"https:\/\/security.dxw.com\/advisories\/csrfstored-xss-in-quiz-and-survey-master-formerly-quiz-master-next-allows-unauthenticated-attackers-to-do-almost-anything-an-admin-can\/","name":"https:\/\/security.dxw.com\/advisories\/csrfstored-xss-in-quiz-and-survey-master-formerly-quiz-master-next-allows-unauthenticated-attackers-to-do-almost-anything-an-admin-can\/","refsource":"MISC","tags":[]}]";}i:84;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20987";s:4:"slug";s:16:"newsletters-lite";s:19:"versionEndExcluding";s:7:"4.6.8.6";s:11:"description";s:82:"The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.";s:4:"refs";s:354:"[{"url":"https:\/\/wordpress.org\/plugins\/newsletters-lite\/#developers","name":"https:\/\/wordpress.org\/plugins\/newsletters-lite\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9627","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9627","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:85;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18547";s:4:"slug";s:16:"nelio-ab-testing";s:19:"versionEndExcluding";s:5:"4.6.4";s:11:"description";s:84:"The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.";s:4:"refs";s:216:"[{"url":"https:\/\/wordpress.org\/plugins\/nelio-ab-testing\/#developers","name":"https:\/\/wordpress.org\/plugins\/nelio-ab-testing\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:86;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18522";s:4:"slug";s:15:"eelv-newsletter";s:19:"versionEndExcluding";s:5:"4.6.1";s:11:"description";s:82:"The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/eelv-newsletter\/#developers","name":"https:\/\/wordpress.org\/plugins\/eelv-newsletter\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:87;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18523";s:4:"slug";s:15:"eelv-newsletter";s:19:"versionEndExcluding";s:5:"4.6.1";s:11:"description";s:83:"The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/eelv-newsletter\/#developers","name":"https:\/\/wordpress.org\/plugins\/eelv-newsletter\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:88;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9452";s:4:"slug";s:33:"nex-forms-express-wp-form-builder";s:19:"versionEndExcluding";s:5:"4.6.1";s:11:"description";s:160:"The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.";s:4:"refs";s:654:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_cb24b6204803e8e94943b198edc37af7.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_cb24b6204803e8e94943b198edc37af7.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/nex-forms-express-wp-form-builder\/#developers","name":"https:\/\/wordpress.org\/plugins\/nex-forms-express-wp-form-builder\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8336","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8336","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:89;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-9454";s:4:"slug";s:56:"custom-registration-form-builder-with-submission-manager";s:19:"versionEndExcluding";s:7:"4.6.0.4";s:11:"description";s:310:"A CSRF vulnerability in the RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote attackers to forge requests on behalf of a site administrator to change all settings for the plugin, including deleting users, creating new roles with escalated privileges, and allowing PHP file uploads via forms.";s:4:"refs";s:663:"[{"url":"https:\/\/wordpress.org\/plugins\/custom-registration-form-builder-with-submission-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/custom-registration-form-builder-with-submission-manager\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10116","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10116","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/03\/multiple-vulnerabilities-patched-in-registrationmagic-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/03\/multiple-vulnerabilities-patched-in-registrationmagic-plugin\/","refsource":"MISC","tags":[]}]";}i:90;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-9455";s:4:"slug";s:56:"custom-registration-form-builder-with-submission-manager";s:19:"versionEndExcluding";s:7:"4.6.0.4";s:11:"description";s:218:"The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to send arbitrary emails on behalf of the site via class_rm_user_services.php send_email_user_view.";s:4:"refs";s:663:"[{"url":"https:\/\/wordpress.org\/plugins\/custom-registration-form-builder-with-submission-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/custom-registration-form-builder-with-submission-manager\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10116","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10116","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/03\/multiple-vulnerabilities-patched-in-registrationmagic-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/03\/multiple-vulnerabilities-patched-in-registrationmagic-plugin\/","refsource":"MISC","tags":[]}]";}i:91;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-9456";s:4:"slug";s:56:"custom-registration-form-builder-with-submission-manager";s:19:"versionEndExcluding";s:7:"4.6.0.4";s:11:"description";s:234:"In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the user controller allows remote authenticated users (with minimal privileges) to elevate their privileges to administrator via class_rm_user_controller.php rm_user_edit.";s:4:"refs";s:663:"[{"url":"https:\/\/wordpress.org\/plugins\/custom-registration-form-builder-with-submission-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/custom-registration-form-builder-with-submission-manager\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10116","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10116","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/03\/multiple-vulnerabilities-patched-in-registrationmagic-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/03\/multiple-vulnerabilities-patched-in-registrationmagic-plugin\/","refsource":"MISC","tags":[]}]";}i:92;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-9457";s:4:"slug";s:56:"custom-registration-form-builder-with-submission-manager";s:19:"versionEndExcluding";s:7:"4.6.0.4";s:11:"description";s:255:"The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) to import custom vulnerable forms and change form settings via class_rm_form_settings_controller.php, resulting in privilege escalation.";s:4:"refs";s:663:"[{"url":"https:\/\/wordpress.org\/plugins\/custom-registration-form-builder-with-submission-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/custom-registration-form-builder-with-submission-manager\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10116","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10116","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/03\/multiple-vulnerabilities-patched-in-registrationmagic-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/03\/multiple-vulnerabilities-patched-in-registrationmagic-plugin\/","refsource":"MISC","tags":[]}]";}i:93;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-9458";s:4:"slug";s:56:"custom-registration-form-builder-with-submission-manager";s:19:"versionEndExcluding";s:7:"4.6.0.4";s:11:"description";s:234:"In the RegistrationMagic plugin through 4.6.0.3 for WordPress, the export function allows remote authenticated users (with minimal privileges) to export submitted form data and settings via class_rm_form_controller.php rm_form_export.";s:4:"refs";s:663:"[{"url":"https:\/\/wordpress.org\/plugins\/custom-registration-form-builder-with-submission-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/custom-registration-form-builder-with-submission-manager\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10116","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10116","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/03\/multiple-vulnerabilities-patched-in-registrationmagic-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/03\/multiple-vulnerabilities-patched-in-registrationmagic-plugin\/","refsource":"MISC","tags":[]}]";}i:94;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-8435";s:4:"slug";s:56:"custom-registration-form-builder-with-submission-manager";s:19:"versionEndExcluding";s:7:"4.6.0.4";s:11:"description";s:154:"An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. There is SQL injection via the rm_analytics_show_form rm_form_id parameter.";s:4:"refs";s:521:"[{"url":"https:\/\/Spider-security.co.uk","name":"https:\/\/Spider-security.co.uk","refsource":"MISC","tags":[]},{"url":"https:\/\/spider-security.co.uk\/blog-cve-2020-8435","name":"https:\/\/spider-security.co.uk\/blog-cve-2020-8435","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/custom-registration-form-builder-with-submission-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/custom-registration-form-builder-with-submission-manager\/#developers","refsource":"MISC","tags":[]}]";}i:95;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-8436";s:4:"slug";s:56:"custom-registration-form-builder-with-submission-manager";s:19:"versionEndExcluding";s:7:"4.6.0.4";s:11:"description";s:123:"XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter.";s:4:"refs";s:521:"[{"url":"https:\/\/Spider-security.co.uk","name":"https:\/\/Spider-security.co.uk","refsource":"MISC","tags":[]},{"url":"https:\/\/spider-security.co.uk\/blog-cve-2020-8436","name":"https:\/\/spider-security.co.uk\/blog-cve-2020-8436","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/custom-registration-form-builder-with-submission-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/custom-registration-form-builder-with-submission-manager\/#developers","refsource":"MISC","tags":[]}]";}i:96;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10926";s:4:"slug";s:16:"nelio-ab-testing";s:19:"versionEndExcluding";s:5:"4.5.9";s:11:"description";s:86:"The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.";s:4:"refs";s:192:"[{"url":"https:\/\/wordpress.org\/plugins\/nelio-ab-testing\/#developers","name":"https:\/\/wordpress.org\/plugins\/nelio-ab-testing\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:97;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10926";s:4:"slug";s:16:"nelio-ab-testing";s:19:"versionEndExcluding";s:5:"4.5.9";s:11:"description";s:86:"The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.";s:4:"refs";s:192:"[{"url":"https:\/\/wordpress.org\/plugins\/nelio-ab-testing\/#developers","name":"https:\/\/wordpress.org\/plugins\/nelio-ab-testing\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:98;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9349";s:4:"slug";s:22:"ckeditor-for-wordpress";s:19:"versionEndExcluding";s:7:"4.5.3.1";s:11:"description";s:118:"The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.";s:4:"refs";s:204:"[{"url":"https:\/\/wordpress.org\/plugins\/ckeditor-for-wordpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/ckeditor-for-wordpress\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:99;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10927";s:4:"slug";s:16:"nelio-ab-testing";s:19:"versionEndExcluding";s:6:"4.5.11";s:11:"description";s:87:"The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.";s:4:"refs";s:192:"[{"url":"https:\/\/wordpress.org\/plugins\/nelio-ab-testing\/#developers","name":"https:\/\/wordpress.org\/plugins\/nelio-ab-testing\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:100;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10927";s:4:"slug";s:16:"nelio-ab-testing";s:19:"versionEndExcluding";s:6:"4.5.11";s:11:"description";s:87:"The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.";s:4:"refs";s:192:"[{"url":"https:\/\/wordpress.org\/plugins\/nelio-ab-testing\/#developers","name":"https:\/\/wordpress.org\/plugins\/nelio-ab-testing\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:101;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-5767";s:4:"slug";s:17:"email-subscribers";s:19:"versionEndExcluding";s:5:"4.5.1";s:11:"description";s:203:"Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link.";s:4:"refs";s:174:"[{"url":"https:\/\/www.tenable.com\/security\/research\/tra-2020-44-0","name":"https:\/\/www.tenable.com\/security\/research\/tra-2020-44-0","refsource":"CONFIRM","tags":[]}]";}i:102;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10977";s:4:"slug";s:16:"nelio-ab-testing";s:19:"versionEndExcluding";s:5:"4.5.0";s:11:"description";s:94:"The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.";s:4:"refs";s:579:"[{"url":"https:\/\/wordpress.org\/plugins\/nelio-ab-testing\/#developers","name":"https:\/\/wordpress.org\/plugins\/nelio-ab-testing\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8491","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8491","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/05\/10\/1","name":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/05\/10\/1","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]}]";}i:103;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10977";s:4:"slug";s:16:"nelio-ab-testing";s:19:"versionEndExcluding";s:5:"4.5.0";s:11:"description";s:94:"The nelio-ab-testing plugin before 4.5.0 for WordPress has filename=..%2f directory traversal.";s:4:"refs";s:579:"[{"url":"https:\/\/wordpress.org\/plugins\/nelio-ab-testing\/#developers","name":"https:\/\/wordpress.org\/plugins\/nelio-ab-testing\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8491","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8491","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/05\/10\/1","name":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/05\/10\/1","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]}]";}i:104;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-12696";s:4:"slug";s:6:"iframe";s:19:"versionEndExcluding";s:3:"4.5";s:11:"description";s:67:"The iframe plugin before 4.5 for WordPress does not sanitize a URL.";s:4:"refs";s:157:"[{"url":"https:\/\/wordpress.org\/plugins\/iframe\/#developers","name":"https:\/\/wordpress.org\/plugins\/iframe\/#developers","refsource":"MISC","tags":[]}]";}i:105;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19589";s:4:"slug";s:12:"pdf-embedder";s:19:"versionEndExcluding";s:3:"4.5";s:11:"description";s:134:"The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives.";s:4:"refs";s:371:"[{"url":"https:\/\/sejalivre.org\/usando-arquivos-polyglot-para-distribuir-malwares\/","name":"https:\/\/sejalivre.org\/usando-arquivos-polyglot-para-distribuir-malwares\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/pdf-embedder\/#developers","name":"https:\/\/wordpress.org\/plugins\/pdf-embedder\/#developers","refsource":"MISC","tags":[]}]";}i:106;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-5992";s:4:"slug";s:36:"wp-ultra-simple-paypal-shopping-cart";s:19:"versionEndExcluding";s:5:"4.4.1";s:11:"description";s:207:"Cross-site request forgery (CSRF) vulnerability in WordPress Ultra Simple Paypal Shopping Cart v4.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.";s:4:"refs";s:169:"[{"url":"http:\/\/jvn.jp\/en\/jp\/JVN48981892\/index.html","name":"http:\/\/jvn.jp\/en\/jp\/JVN48981892\/index.html","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:107;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2018-9844";s:4:"slug";s:14:"wp-file-upload";s:19:"versionEndExcluding";s:5:"4.3.4";s:11:"description";s:115:"The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS.";s:4:"refs";s:576:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-file-upload\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-file-upload\/#developers","refsource":"CONFIRM","tags":["Third Party Advisory"]},{"url":"https:\/\/www.exploit-db.com\/exploits\/44444\/","name":"44444","refsource":"EXPLOIT-DB","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/www.iptanus.com\/new-version-4-3-4-of-wordpress-file-upload-plugin\/","name":"https:\/\/www.iptanus.com\/new-version-4-3-4-of-wordpress-file-upload-plugin\/","refsource":"CONFIRM","tags":["Vendor Advisory"]}]";}i:108;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10873";s:4:"slug";s:18:"wp-database-backup";s:19:"versionEndExcluding";s:5:"4.3.3";s:11:"description";s:65:"The wp-database-backup plugin before 4.3.3 for WordPress has XSS.";s:4:"refs";s:354:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9739","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9739","refsource":"MISC","tags":[]}]";}i:109;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10873";s:4:"slug";s:18:"wp-database-backup";s:19:"versionEndExcluding";s:5:"4.3.3";s:11:"description";s:65:"The wp-database-backup plugin before 4.3.3 for WordPress has XSS.";s:4:"refs";s:354:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9739","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9739","refsource":"MISC","tags":[]}]";}i:110;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10874";s:4:"slug";s:18:"wp-database-backup";s:19:"versionEndExcluding";s:5:"4.3.3";s:11:"description";s:66:"The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.";s:4:"refs";s:354:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9739","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9739","refsource":"MISC","tags":[]}]";}i:111;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10874";s:4:"slug";s:18:"wp-database-backup";s:19:"versionEndExcluding";s:5:"4.3.3";s:11:"description";s:66:"The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.";s:4:"refs";s:354:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9739","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9739","refsource":"MISC","tags":[]}]";}i:112;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2018-9172";s:4:"slug";s:14:"wp-file-upload";s:19:"versionEndExcluding";s:5:"4.3.3";s:11:"description";s:100:"The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.";s:4:"refs";s:576:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-file-upload\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-file-upload\/#developers","refsource":"CONFIRM","tags":["Third Party Advisory"]},{"url":"https:\/\/www.exploit-db.com\/exploits\/44443\/","name":"44443","refsource":"EXPLOIT-DB","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/www.iptanus.com\/new-version-4-3-3-of-wordpress-file-upload-plugin\/","name":"https:\/\/www.iptanus.com\/new-version-4-3-3-of-wordpress-file-upload-plugin\/","refsource":"CONFIRM","tags":["Vendor Advisory"]}]";}i:113;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10875";s:4:"slug";s:18:"wp-database-backup";s:19:"versionEndExcluding";s:5:"4.3.1";s:11:"description";s:65:"The wp-database-backup plugin before 4.3.1 for WordPress has XSS.";s:4:"refs";s:354:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9740","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9740","refsource":"MISC","tags":[]}]";}i:114;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10875";s:4:"slug";s:18:"wp-database-backup";s:19:"versionEndExcluding";s:5:"4.3.1";s:11:"description";s:65:"The wp-database-backup plugin before 4.3.1 for WordPress has XSS.";s:4:"refs";s:354:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9740","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9740","refsource":"MISC","tags":[]}]";}i:115;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10876";s:4:"slug";s:18:"wp-database-backup";s:19:"versionEndExcluding";s:5:"4.3.1";s:11:"description";s:66:"The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.";s:4:"refs";s:214:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:116;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10876";s:4:"slug";s:18:"wp-database-backup";s:19:"versionEndExcluding";s:5:"4.3.1";s:11:"description";s:66:"The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.";s:4:"refs";s:214:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-database-backup\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:117;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-20361";s:4:"slug";s:17:"email-subscribers";s:19:"versionEndExcluding";s:5:"4.3.1";s:11:"description";s:205:"There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter (a blind SQL injection vulnerability).";s:4:"refs";s:429:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9947","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9947","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2019\/11\/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2019\/11\/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin\/","refsource":"MISC","tags":[]}]";}i:118;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10896";s:4:"slug";s:15:"seo-redirection";s:19:"versionEndExcluding";s:3:"4.3";s:11:"description";s:67:"The seo-redirection plugin before 4.3 for WordPress has stored XSS.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/seo-redirection\/#developers","name":"https:\/\/wordpress.org\/plugins\/seo-redirection\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:119;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10896";s:4:"slug";s:15:"seo-redirection";s:19:"versionEndExcluding";s:3:"4.3";s:11:"description";s:67:"The seo-redirection plugin before 4.3 for WordPress has stored XSS.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/seo-redirection\/#developers","name":"https:\/\/wordpress.org\/plugins\/seo-redirection\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:120;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15648";s:4:"slug";s:49:"insert-or-embed-articulate-content-into-wordpress";s:19:"versionEndExcluding";s:7:"4.29991";s:11:"description";s:160:"The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.";s:4:"refs";s:438:"[{"url":"https:\/\/wordpress.org\/plugins\/insert-or-embed-articulate-content-into-wordpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/insert-or-embed-articulate-content-into-wordpress\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9416","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9416","refsource":"MISC","tags":["Exploit","Patch","Third Party Advisory"]}]";}i:121;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15649";s:4:"slug";s:49:"insert-or-embed-articulate-content-into-wordpress";s:19:"versionEndExcluding";s:6:"4.2999";s:11:"description";s:134:"The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.";s:4:"refs";s:420:"[{"url":"https:\/\/wordpress.org\/plugins\/insert-or-embed-articulate-content-into-wordpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/insert-or-embed-articulate-content-into-wordpress\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9415","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9415","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:122;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-8491";s:4:"slug";s:16:"Grand Flagallery";s:19:"versionEndExcluding";s:4:"4.25";s:11:"description";s:249:"The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a request to (1) flagallery-skins/banner_widget_default/gallery.php or (2) flash-album-gallery/skins/banner_widget_default/gallery.php.";s:4:"refs";s:323:"[{"url":"https:\/\/g0blin.co.uk\/cve-2014-8491\/","name":"https:\/\/g0blin.co.uk\/cve-2014-8491\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8238","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8238","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:123;O:8:"stdClass":6:{s:6:"CVE_ID";s:14:"CVE-2020-12832";s:4:"slug";s:16:"simple-file-list";s:19:"versionEndExcluding";s:5:"4.2.8";s:11:"description";s:171:"The simple-file-list plugin before 4.2.8 for WordPress mishandles a .. sequence within a pathname in cases where front-side file management occurs on a non-Linux platform.";s:14:"recommendation";s:131:"This plugin has been closed as of May 11, 2020 and is not available for download. This closure is temporary, pending a full review.";s:4:"refs";s:339:"[{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2302759","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2302759","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/simple-file-list\/#developers","name":"https:\/\/wordpress.org\/plugins\/simple-file-list\/#developers","refsource":"MISC","tags":[]}]";}i:124;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9911";s:4:"slug";s:46:"social-networks-auto-poster-facebook-twitter-g";s:19:"versionEndExcluding";s:5:"4.2.8";s:11:"description";s:151:"The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS.";s:4:"refs";s:731:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2019\/Mar\/40","name":"20190322 Re: NextScripts: Social Networks Auto-Poster 4.2.7 - Reflected XSS (WordPress Plugin)","refsource":"FULLDISC","tags":["Mailing List","Third Party Advisory"]},{"url":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/12","name":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/12","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-social-networks-auto-poster-xss\/","name":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-social-networks-auto-poster-xss\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:125;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9425";s:4:"slug";s:13:"social-locker";s:19:"versionEndExcluding";s:5:"4.2.5";s:11:"description";s:188:"The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter.";s:4:"refs";s:621:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_9e26c6f71bf8467e4a5017b15d5acddc.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_9e26c6f71bf8467e4a5017b15d5acddc.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/social-locker\/#developers","name":"https:\/\/wordpress.org\/plugins\/social-locker\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8327","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8327","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:126;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19980";s:4:"slug";s:17:"email-subscribers";s:19:"versionEndExcluding";s:5:"4.2.3";s:11:"description";s:324:"The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber or greater access) to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wp_ajax function to send_test_email.";s:4:"refs";s:429:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9946","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9946","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2019\/11\/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2019\/11\/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin\/","refsource":"MISC","tags":[]}]";}i:127;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19981";s:4:"slug";s:17:"email-subscribers";s:19:"versionEndExcluding";s:5:"4.2.3";s:11:"description";s:140:"The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings.";s:4:"refs";s:429:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9946","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9946","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2019\/11\/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2019\/11\/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin\/","refsource":"MISC","tags":[]}]";}i:128;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19982";s:4:"slug";s:17:"email-subscribers";s:19:"versionEndExcluding";s:5:"4.2.3";s:11:"description";s:258:"The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?es_skip=1&option_name= request.";s:4:"refs";s:429:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9946","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9946","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2019\/11\/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2019\/11\/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin\/","refsource":"MISC","tags":[]}]";}i:129;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19984";s:4:"slug";s:17:"email-subscribers";s:19:"versionEndExcluding";s:5:"4.2.3";s:11:"description";s:172:"The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and email campaigns.";s:4:"refs";s:429:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9946","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9946","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2019\/11\/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2019\/11\/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin\/","refsource":"MISC","tags":[]}]";}i:130;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19985";s:4:"slug";s:17:"email-subscribers";s:19:"versionEndExcluding";s:5:"4.2.3";s:11:"description";s:155:"The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.";s:4:"refs";s:429:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9946","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9946","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2019\/11\/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2019\/11\/multiple-vulnerabilities-patched-in-email-subscribers-newsletters-plugin\/","refsource":"MISC","tags":[]}]";}i:131;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10866";s:4:"slug";s:35:"all-in-one-wp-security-and-firewall";s:19:"versionEndExcluding";s:5:"4.2.0";s:11:"description";s:98:"The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.";s:4:"refs";s:237:"[{"url":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","name":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:132;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10866";s:4:"slug";s:35:"all-in-one-wp-security-and-firewall";s:19:"versionEndExcluding";s:5:"4.2.0";s:11:"description";s:98:"The all-in-one-wp-security-and-firewall plugin before 4.2.0 for WordPress has multiple XSS issues.";s:4:"refs";s:237:"[{"url":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","name":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:133;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10387";s:4:"slug";s:40:"wp-support-plus-responsive-ticket-system";s:19:"versionEndExcluding";s:3:"4.2";s:11:"description";s:95:"The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection.";s:4:"refs";s:240:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:134;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10388";s:4:"slug";s:40:"wp-support-plus-responsive-ticket-system";s:19:"versionEndExcluding";s:3:"4.2";s:11:"description";s:102:"The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure.";s:4:"refs";s:240:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:135;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10389";s:4:"slug";s:40:"wp-support-plus-responsive-ticket-system";s:19:"versionEndExcluding";s:3:"4.2";s:11:"description";s:106:"The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.";s:4:"refs";s:240:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:136;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10390";s:4:"slug";s:40:"wp-support-plus-responsive-ticket-system";s:19:"versionEndExcluding";s:3:"4.2";s:11:"description";s:101:"The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.";s:4:"refs";s:240:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:137;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14793";s:4:"slug";s:8:"Meta Box";s:19:"versionEndExcluding";s:6:"4.16.3";s:11:"description";s:160:"The Meta Box plugin before 4.16.3 for WordPress allows file deletion via ajax, with the wp-admin/admin-ajax.php?action=rwmb_delete_file attachment_id parameter.";s:4:"refs";s:552:"[{"url":"https:\/\/metabox.io\/changelog\/","name":"https:\/\/metabox.io\/changelog\/","refsource":"MISC","tags":["Vendor Advisory"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2019\/02\/01\/full-disclosure-of-authenticated-arbitrary-file-deletion-vulnerability-in-wordpress-plugin-with-300000-installs\/","name":"https:\/\/www.pluginvulnerabilities.com\/2019\/02\/01\/full-disclosure-of-authenticated-arbitrary-file-deletion-vulnerability-in-wordpress-plugin-with-300000-installs\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:138;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14794";s:4:"slug";s:8:"Meta Box";s:19:"versionEndExcluding";s:6:"4.16.2";s:11:"description";s:100:"The Meta Box plugin before 4.16.2 for WordPress mishandles the uploading of files to custom folders.";s:4:"refs";s:134:"[{"url":"https:\/\/metabox.io\/changelog\/","name":"https:\/\/metabox.io\/changelog\/","refsource":"MISC","tags":["Vendor Advisory"]}]";}i:139;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16120";s:4:"slug";s:13:"event-tickets";s:19:"versionEndExcluding";s:8:"4.10.7.2";s:11:"description";s:161:"CSV injection in the event-tickets (Event Tickets) plugin before 4.10.7.2 for WordPress exists via the "All Post> Ticketed > Attendees" Export Attendees feature.";s:4:"refs";s:527:"[{"url":"https:\/\/wordpress.org\/plugins\/event-tickets\/#developers","name":"https:\/\/wordpress.org\/plugins\/event-tickets\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9858","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9858","refsource":"MISC","tags":[]},{"url":"https:\/\/www.exploit-db.com\/exploits\/47335","name":"https:\/\/www.exploit-db.com\/exploits\/47335","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]}]";}i:140;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18577";s:4:"slug";s:16:"mailchimp-for-wp";s:19:"versionEndExcluding";s:5:"4.1.8";s:11:"description";s:101:"The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.";s:4:"refs";s:192:"[{"url":"https:\/\/wordpress.org\/plugins\/mailchimp-for-wp\/#developers","name":"https:\/\/wordpress.org\/plugins\/mailchimp-for-wp\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:141;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9273";s:4:"slug";s:11:"wp-slimstat";s:19:"versionEndExcluding";s:7:"4.1.6.1";s:11:"description";s:178:"The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header, or via a field associated with JavaScript-based Referer tracking.";s:4:"refs";s:656:"[{"url":"http:\/\/plugins.svn.wordpress.org\/\/wp-slimstat\/tags\/4.1.6.1\/readme.txt","name":"http:\/\/plugins.svn.wordpress.org\/\/wp-slimstat\/tags\/4.1.6.1\/readme.txt","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/1204104","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/1204104","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/www.openwall.com\/lists\/oss-security\/2015\/07\/30\/1","name":"https:\/\/www.openwall.com\/lists\/oss-security\/2015\/07\/30\/1","refsource":"MISC","tags":["Mailing List","Third Party Advisory"]}]";}i:142;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18597";s:4:"slug";s:22:"jtrt-responsive-tables";s:19:"versionEndExcluding";s:5:"4.1.2";s:11:"description";s:150:"The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-tables-admin.php tableId parameter.";s:4:"refs";s:660:"[{"url":"http:\/\/lenonleite.com.br\/en\/2017\/09\/11\/jtrt-responsive-tables-wordpress-plugin-sql-injection\/","name":"http:\/\/lenonleite.com.br\/en\/2017\/09\/11\/jtrt-responsive-tables-wordpress-plugin-sql-injection\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/jtrt-responsive-tables\/#developers","name":"https:\/\/wordpress.org\/plugins\/jtrt-responsive-tables\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8953","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8953","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:143;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11006";s:4:"slug";s:10:"wp-invoice";s:19:"versionEndExcluding";s:5:"4.1.1";s:11:"description";s:110:"The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.";s:4:"refs";s:593:"[{"url":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","name":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:144;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11006";s:4:"slug";s:10:"wp-invoice";s:19:"versionEndExcluding";s:5:"4.1.1";s:11:"description";s:110:"The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.";s:4:"refs";s:593:"[{"url":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","name":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:145;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11007";s:4:"slug";s:10:"wp-invoice";s:19:"versionEndExcluding";s:5:"4.1.1";s:11:"description";s:117:"The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.";s:4:"refs";s:593:"[{"url":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","name":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:146;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11007";s:4:"slug";s:10:"wp-invoice";s:19:"versionEndExcluding";s:5:"4.1.1";s:11:"description";s:117:"The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.";s:4:"refs";s:593:"[{"url":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","name":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:147;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11008";s:4:"slug";s:10:"wp-invoice";s:19:"versionEndExcluding";s:5:"4.1.1";s:11:"description";s:117:"The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.";s:4:"refs";s:593:"[{"url":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","name":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:148;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11008";s:4:"slug";s:10:"wp-invoice";s:19:"versionEndExcluding";s:5:"4.1.1";s:11:"description";s:117:"The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.";s:4:"refs";s:593:"[{"url":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","name":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:149;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11009";s:4:"slug";s:10:"wp-invoice";s:19:"versionEndExcluding";s:5:"4.1.1";s:11:"description";s:121:"The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.";s:4:"refs";s:593:"[{"url":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","name":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:150;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11009";s:4:"slug";s:10:"wp-invoice";s:19:"versionEndExcluding";s:5:"4.1.1";s:11:"description";s:121:"The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.";s:4:"refs";s:593:"[{"url":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","name":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:151;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11010";s:4:"slug";s:10:"wp-invoice";s:19:"versionEndExcluding";s:5:"4.1.1";s:11:"description";s:122:"The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.";s:4:"refs";s:593:"[{"url":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","name":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:152;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11010";s:4:"slug";s:10:"wp-invoice";s:19:"versionEndExcluding";s:5:"4.1.1";s:11:"description";s:122:"The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.";s:4:"refs";s:593:"[{"url":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","name":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:153;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11011";s:4:"slug";s:10:"wp-invoice";s:19:"versionEndExcluding";s:5:"4.1.1";s:11:"description";s:97:"The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.";s:4:"refs";s:593:"[{"url":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","name":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:154;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11011";s:4:"slug";s:10:"wp-invoice";s:19:"versionEndExcluding";s:5:"4.1.1";s:11:"description";s:97:"The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.";s:4:"refs";s:593:"[{"url":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","name":"http:\/\/www.pritect.net\/blog\/wp-invoice-4-1-1-security-vulnerabilities","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-invoice\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8378","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:155;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10386";s:4:"slug";s:20:"wp-live-chat-support";s:19:"versionEndExcluding";s:5:"4.1.0";s:11:"description";s:85:"The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.";s:4:"refs";s:200:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-live-chat-support\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-live-chat-support\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:156;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10391";s:4:"slug";s:40:"wp-support-plus-responsive-ticket-system";s:19:"versionEndExcluding";s:3:"4.1";s:11:"description";s:102:"The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.";s:4:"refs";s:240:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-support-plus-responsive-ticket-system\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:157;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15780";s:4:"slug";s:10:"formidable";s:19:"versionEndExcluding";s:7:"4.02.01";s:11:"description";s:78:"The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.";s:4:"refs";s:197:"[{"url":"https:\/\/wordpress.org\/plugins\/formidable\/#developers","name":"https:\/\/wordpress.org\/plugins\/formidable\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]}]";}i:158;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10887";s:4:"slug";s:35:"all-in-one-wp-security-and-firewall";s:19:"versionEndExcluding";s:5:"4.0.9";s:11:"description";s:108:"The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.";s:4:"refs";s:253:"[{"url":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","name":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:159;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10887";s:4:"slug";s:35:"all-in-one-wp-security-and-firewall";s:19:"versionEndExcluding";s:5:"4.0.9";s:11:"description";s:108:"The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.";s:4:"refs";s:253:"[{"url":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","name":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:160;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-9283";s:4:"slug";s:19:"BestWebSoft Captcha";s:19:"versionEndExcluding";s:5:"4.0.7";s:11:"description";s:182:"The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.";s:4:"refs";s:420:"[{"url":"http:\/\/jvn.jp\/en\/jp\/JVN93727681\/index.html","name":"JVN#93727681","refsource":"JVN","tags":["Vendor Advisory"]},{"url":"http:\/\/jvndb.jvn.jp\/jvndb\/JVNDB-2015-000029","name":"JVNDB-2015-000029","refsource":"JVNDB","tags":["Vendor Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/captcha\/changelog\/","name":"https:\/\/wordpress.org\/plugins\/captcha\/changelog\/","refsource":"CONFIRM","tags":[]}]";}i:161;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10888";s:4:"slug";s:35:"all-in-one-wp-security-and-firewall";s:19:"versionEndExcluding";s:5:"4.0.7";s:11:"description";s:108:"The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.";s:4:"refs";s:253:"[{"url":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","name":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:162;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10888";s:4:"slug";s:35:"all-in-one-wp-security-and-firewall";s:19:"versionEndExcluding";s:5:"4.0.7";s:11:"description";s:108:"The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.";s:4:"refs";s:253:"[{"url":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","name":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:163;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10867";s:4:"slug";s:35:"all-in-one-wp-security-and-firewall";s:19:"versionEndExcluding";s:5:"4.0.6";s:11:"description";s:100:"The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.";s:4:"refs";s:237:"[{"url":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","name":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:164;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10867";s:4:"slug";s:35:"all-in-one-wp-security-and-firewall";s:19:"versionEndExcluding";s:5:"4.0.6";s:11:"description";s:100:"The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages.";s:4:"refs";s:237:"[{"url":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","name":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:165;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18491";s:4:"slug";s:19:"contact-form-plugin";s:19:"versionEndExcluding";s:5:"4.0.6";s:11:"description";s:82:"The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.";s:4:"refs";s:221:"[{"url":"https:\/\/wordpress.org\/plugins\/contact-form-plugin\/#developers","name":"https:\/\/wordpress.org\/plugins\/contact-form-plugin\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:166;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10868";s:4:"slug";s:35:"all-in-one-wp-security-and-firewall";s:19:"versionEndExcluding";s:5:"4.0.5";s:11:"description";s:154:"The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.";s:4:"refs";s:253:"[{"url":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","name":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:167;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10868";s:4:"slug";s:35:"all-in-one-wp-security-and-firewall";s:19:"versionEndExcluding";s:5:"4.0.5";s:11:"description";s:154:"The all-in-one-wp-security-and-firewall plugin before 4.0.5 for WordPress has XSS in the blacklist, file system, and file change detection settings pages.";s:4:"refs";s:253:"[{"url":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","name":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:168;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10705";s:4:"slug";s:7:"Jetpack";s:19:"versionEndExcluding";s:5:"4.0.4";s:11:"description";s:75:"The Jetpack plugin before 4.0.4 for WordPress has XSS via the Likes module.";s:4:"refs";s:359:"[{"url":"https:\/\/jetpack.com\/2016\/06\/20\/jetpack-4-0-4-bug-fixes\/","name":"https:\/\/jetpack.com\/2016\/06\/20\/jetpack-4-0-4-bug-fixes\/","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8517","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8517","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:169;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18608";s:4:"slug";s:15:"spotim-comments";s:19:"versionEndExcluding";s:5:"4.0.4";s:11:"description";s:78:"The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.";s:4:"refs";s:375:"[{"url":"https:\/\/wordpress.org\/plugins\/spotim-comments\/#developers","name":"https:\/\/wordpress.org\/plugins\/spotim-comments\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9360","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9360","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:170;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9539";s:4:"slug";s:15:"si-contact-form";s:19:"versionEndExcluding";s:6:"4.0.38";s:11:"description";s:101:"The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fs_contact_form1[welcome] XSS.";s:4:"refs";s:517:"[{"url":"https:\/\/github.com\/amansaini\/fast-secure-contact-form","name":"https:\/\/github.com\/amansaini\/fast-secure-contact-form","refsource":"MISC","tags":[]},{"url":"https:\/\/github.com\/cybersecurityworks\/Disclosed\/issues\/4","name":"https:\/\/github.com\/cybersecurityworks\/Disclosed\/issues\/4","refsource":"MISC","tags":[]},{"url":"https:\/\/www.openwall.com\/lists\/oss-security\/2015\/10\/27\/2","name":"https:\/\/www.openwall.com\/lists\/oss-security\/2015\/10\/27\/2","refsource":"MISC","tags":[]}]";}i:171;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10706";s:4:"slug";s:7:"Jetpack";s:19:"versionEndExcluding";s:5:"4.0.3";s:11:"description";s:79:"The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link.";s:4:"refs";s:435:"[{"url":"https:\/\/jetpack.com\/2016\/05\/27\/jetpack-4-0-3-critical-security-update\/","name":"https:\/\/jetpack.com\/2016\/05\/27\/jetpack-4-0-3-critical-security-update\/","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.wordfence.com\/blog\/2016\/05\/jetpack-vulnerability\/","name":"https:\/\/www.wordfence.com\/blog\/2016\/05\/jetpack-vulnerability\/","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:172;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-13641";s:4:"slug";s:26:"real-time-find-and-replace";s:19:"versionEndExcluding";s:5:"4.0.2";s:11:"description";s:354:"An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The find and replace rules could be updated with malicious JavaScript, allowing for that be executed later in the victims browser.";s:4:"refs";s:485:"[{"url":"https:\/\/wordpress.org\/plugins\/real-time-find-and-replace\/#developers","name":"https:\/\/wordpress.org\/plugins\/real-time-find-and-replace\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/04\/high-severity-vulnerability-patched-in-real-time-find-and-replace-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/04\/high-severity-vulnerability-patched-in-real-time-find-and-replace-plugin\/","refsource":"MISC","tags":[]}]";}i:173;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10869";s:4:"slug";s:19:"contact-form-plugin";s:19:"versionEndExcluding";s:5:"4.0.2";s:11:"description";s:66:"The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.";s:4:"refs";s:221:"[{"url":"https:\/\/wordpress.org\/plugins\/contact-form-plugin\/#developers","name":"https:\/\/wordpress.org\/plugins\/contact-form-plugin\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:174;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10869";s:4:"slug";s:19:"contact-form-plugin";s:19:"versionEndExcluding";s:5:"4.0.2";s:11:"description";s:66:"The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.";s:4:"refs";s:221:"[{"url":"https:\/\/wordpress.org\/plugins\/contact-form-plugin\/#developers","name":"https:\/\/wordpress.org\/plugins\/contact-form-plugin\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:175;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10871";s:4:"slug";s:16:"mailchimp-for-wp";s:19:"versionEndExcluding";s:6:"4.0.11";s:11:"description";s:97:"The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.";s:4:"refs";s:215:"[{"url":"https:\/\/wordpress.org\/plugins\/mailchimp-for-wp\/#developers","name":"https:\/\/wordpress.org\/plugins\/mailchimp-for-wp\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:176;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10871";s:4:"slug";s:16:"mailchimp-for-wp";s:19:"versionEndExcluding";s:6:"4.0.11";s:11:"description";s:97:"The mailchimp-for-wp plugin before 4.0.11 for WordPress has XSS on the integration settings page.";s:4:"refs";s:215:"[{"url":"https:\/\/wordpress.org\/plugins\/mailchimp-for-wp\/#developers","name":"https:\/\/wordpress.org\/plugins\/mailchimp-for-wp\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:177;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-7948";s:4:"slug";s:5:"auth0";s:19:"versionEndExcluding";s:3:"4.0";s:11:"description";s:136:"An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference.";s:4:"refs";s:685:"[{"url":"https:\/\/auth0.com\/docs\/cms\/wordpress","name":"https:\/\/auth0.com\/docs\/cms\/wordpress","refsource":"MISC","tags":[]},{"url":"https:\/\/auth0.com\/docs\/security\/bulletins\/2020-03-31_wpauth0","name":"https:\/\/auth0.com\/docs\/security\/bulletins\/2020-03-31_wpauth0","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/github.com\/auth0\/wp-auth0\/security\/advisories\/GHSA-59vf-cgfw-6h6v","name":"https:\/\/github.com\/auth0\/wp-auth0\/security\/advisories\/GHSA-59vf-cgfw-6h6v","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/auth0\/#developers","name":"https:\/\/wordpress.org\/plugins\/auth0\/#developers","refsource":"MISC","tags":[]}]";}i:178;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-5391";s:4:"slug";s:5:"auth0";s:19:"versionEndExcluding";s:3:"4.0";s:11:"description";s:124:"Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field.";s:4:"refs";s:543:"[{"url":"https:\/\/auth0.com\/docs\/security\/bulletins\/2020-03-31_wpauth0","name":"https:\/\/auth0.com\/docs\/security\/bulletins\/2020-03-31_wpauth0","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/github.com\/auth0\/wp-auth0\/releases","name":"https:\/\/github.com\/auth0\/wp-auth0\/releases","refsource":"MISC","tags":[]},{"url":"https:\/\/github.com\/auth0\/wp-auth0\/security\/advisories\/GHSA-59vf-cgfw-6h6v","name":"https:\/\/github.com\/auth0\/wp-auth0\/security\/advisories\/GHSA-59vf-cgfw-6h6v","refsource":"CONFIRM","tags":[]}]";}i:179;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-5392";s:4:"slug";s:5:"auth0";s:19:"versionEndExcluding";s:3:"4.0";s:11:"description";s:126:"A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page.";s:4:"refs";s:543:"[{"url":"https:\/\/auth0.com\/docs\/security\/bulletins\/2020-03-31_wpauth0","name":"https:\/\/auth0.com\/docs\/security\/bulletins\/2020-03-31_wpauth0","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/github.com\/auth0\/wp-auth0\/releases","name":"https:\/\/github.com\/auth0\/wp-auth0\/releases","refsource":"MISC","tags":[]},{"url":"https:\/\/github.com\/auth0\/wp-auth0\/security\/advisories\/GHSA-59vf-cgfw-6h6v","name":"https:\/\/github.com\/auth0\/wp-auth0\/security\/advisories\/GHSA-59vf-cgfw-6h6v","refsource":"CONFIRM","tags":[]}]";}i:180;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-6753";s:4:"slug";s:5:"auth0";s:19:"versionEndExcluding";s:3:"4.0";s:11:"description";s:127:"The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392.";s:4:"refs";s:543:"[{"url":"https:\/\/auth0.com\/docs\/security\/bulletins\/2020-03-31_wpauth0","name":"https:\/\/auth0.com\/docs\/security\/bulletins\/2020-03-31_wpauth0","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/github.com\/auth0\/wp-auth0\/releases","name":"https:\/\/github.com\/auth0\/wp-auth0\/releases","refsource":"MISC","tags":[]},{"url":"https:\/\/github.com\/auth0\/wp-auth0\/security\/advisories\/GHSA-59vf-cgfw-6h6v","name":"https:\/\/github.com\/auth0\/wp-auth0\/security\/advisories\/GHSA-59vf-cgfw-6h6v","refsource":"CONFIRM","tags":[]}]";}i:181;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-7947";s:4:"slug";s:5:"auth0";s:19:"versionEndExcluding";s:3:"4.0";s:11:"description";s:378:"An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data. This can lead to (at least) CSV injection if a crafted Excel document is uploaded.";s:4:"refs";s:685:"[{"url":"https:\/\/auth0.com\/docs\/cms\/wordpress","name":"https:\/\/auth0.com\/docs\/cms\/wordpress","refsource":"MISC","tags":[]},{"url":"https:\/\/auth0.com\/docs\/security\/bulletins\/2020-03-31_wpauth0","name":"https:\/\/auth0.com\/docs\/security\/bulletins\/2020-03-31_wpauth0","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/github.com\/auth0\/wp-auth0\/security\/advisories\/GHSA-59vf-cgfw-6h6v","name":"https:\/\/github.com\/auth0\/wp-auth0\/security\/advisories\/GHSA-59vf-cgfw-6h6v","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/auth0\/#developers","name":"https:\/\/wordpress.org\/plugins\/auth0\/#developers","refsource":"MISC","tags":[]}]";}i:182;O:8:"stdClass":6:{s:6:"CVE_ID";s:14:"CVE-2020-24315";s:4:"slug";s:22:"cardoza-wordpress-poll";s:19:"versionEndExcluding";s:2:"37";s:11:"description";s:239:"Vinoj Cardoza WordPress Poll Plugin v36 and lower executes SQL statement passed in via the pollid POST parameter due to a lack of user input escaping. This allows users who craft specific SQL statements to dump the entire targets database.";s:14:"recommendation";s:106:"This plugin has been closed as of June 23, 2020 and is not available for download. Reason: Security Issue.";s:4:"refs";s:371:"[{"url":"https:\/\/wordpress.org\/plugins\/cardoza-wordpress-poll\/","name":"https:\/\/wordpress.org\/plugins\/cardoza-wordpress-poll\/","refsource":"MISC","tags":[]},{"url":"https:\/\/zeroaptitude.com\/zerodetail\/wordpress-plugin-bug-hunting-part-1\/","name":"https:\/\/zeroaptitude.com\/zerodetail\/wordpress-plugin-bug-hunting-part-1\/","refsource":"MISC","tags":[]}]";}i:183;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2013-1401";s:4:"slug";s:22:"cardoza-wordpress-poll";s:19:"versionEndExcluding";s:2:"35";s:11:"description";s:231:"Multiple security bypass vulnerabilities in the editAnswer, deleteAnswer, addAnswer, and deletePoll functions in WordPress Poll Plugin 34.5 for WordPress allow a remote attacker to add, edit, and delete an answer and delete a poll.";s:4:"refs";s:396:"[{"url":"http:\/\/www.securityfocus.com\/bid\/57479","name":"57479","refsource":"BID","tags":[]},{"url":"https:\/\/exchange.xforce.ibmcloud.com\/vulnerabilities\/81467","name":"81467","refsource":"XF","tags":[]},{"url":"https:\/\/www.securityfocus.com\/archive\/1\/525370","name":"20130121 Multiple SQL injection vulnerabilities in Cardoza Wordpress poll plugin","refsource":"BUGTRAQ","tags":[]}]";}i:184;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9295";s:4:"slug";s:19:"contact-form-plugin";s:19:"versionEndExcluding";s:4:"3.96";s:11:"description";s:65:"The contact-form-plugin plugin before 3.96 for WordPress has XSS.";s:4:"refs";s:221:"[{"url":"https:\/\/wordpress.org\/plugins\/contact-form-plugin\/#developers","name":"https:\/\/wordpress.org\/plugins\/contact-form-plugin\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:185;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9293";s:4:"slug";s:35:"all-in-one-wp-security-and-firewall";s:19:"versionEndExcluding";s:5:"3.9.8";s:11:"description";s:112:"The all-in-one-wp-security-and-firewall plugin before 3.9.8 for WordPress has XSS in the unlock request feature.";s:4:"refs";s:253:"[{"url":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","name":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:186;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9294";s:4:"slug";s:35:"all-in-one-wp-security-and-firewall";s:19:"versionEndExcluding";s:5:"3.9.5";s:11:"description";s:139:"The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in add_query_arg and remove_query_arg function instances.";s:4:"refs";s:253:"[{"url":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","name":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:187;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9310";s:4:"slug";s:35:"all-in-one-wp-security-and-firewall";s:19:"versionEndExcluding";s:5:"3.9.1";s:11:"description";s:108:"The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.";s:4:"refs";s:253:"[{"url":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","name":"https:\/\/wordpress.org\/plugins\/all-in-one-wp-security-and-firewall\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:188;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-3848";s:4:"slug";s:10:"iMember360";s:19:"versionEndExcluding";s:7:"3.9.001";s:11:"description";s:176:"The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database credentials via the i4w_dbinfo parameter.";s:4:"refs";s:783:"[{"url":"http:\/\/packetstormsecurity.com\/files\/126324\/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html","name":"http:\/\/packetstormsecurity.com\/files\/126324\/WordPress-iMember360is-3.9.001-XSS-Disclosure-Code-Execution.html","refsource":"MISC","tags":["Exploit"]},{"url":"http:\/\/releases.imember360.com\/","name":"http:\/\/releases.imember360.com\/","refsource":"CONFIRM","tags":[]},{"url":"http:\/\/seclists.org\/fulldisclosure\/2014\/Apr\/265","name":"20140424 Multiple Vulnerabilities in iMember360 (Wordpress plugin)","refsource":"FULLDISC","tags":[]},{"url":"http:\/\/www.exploit-db.com\/exploits\/33076","name":"33076","refsource":"EXPLOIT-DB","tags":["Exploit"]},{"url":"http:\/\/www.osvdb.org\/106298","name":"106298","refsource":"OSVDB","tags":[]}]";}i:189;O:8:"stdClass":5:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:15:"sliced-invoices";s:19:"versionEndExcluding";s:5:"3.8.3";s:11:"description";s:230:"The WordPress Sliced Invoices plugin, which has 6,000+ active installations, was prone to multiple vulnerabilities in version 3.8.2 and below that could lead to information disclosure and SQL injection.

ref: blog.nintechnet.com";s:4:"refs";s:138:"https://wordpress.org/plugins/sliced-invoices/#developers
https://blog.nintechnet.com/multiple-vulnerabilities-in-sliced-invoices-plugin/";}i:190;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9306";s:4:"slug";s:24:"wp-ultimate-csv-importer";s:19:"versionEndExcluding";s:5:"3.8.1";s:11:"description";s:71:"The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.";s:4:"refs";s:226:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-ultimate-csv-importer\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-ultimate-csv-importer\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:191;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20966";s:4:"slug";s:19:"woocommerce-jetpack";s:19:"versionEndExcluding";s:5:"3.8.0";s:11:"description";s:99:"The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature.";s:4:"refs";s:216:"[{"url":"https:\/\/wordpress.org\/plugins\/woocommerce-jetpack\/#developers","name":"https:\/\/wordpress.org\/plugins\/woocommerce-jetpack\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:192;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10913";s:4:"slug";s:15:"wp-latest-posts";s:19:"versionEndExcluding";s:5:"3.7.5";s:11:"description";s:62:"The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-latest-posts\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-latest-posts\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:193;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10913";s:4:"slug";s:15:"wp-latest-posts";s:19:"versionEndExcluding";s:5:"3.7.5";s:11:"description";s:62:"The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-latest-posts\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-latest-posts\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:194;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10376";s:4:"slug";s:16:"i-recommend-this";s:19:"versionEndExcluding";s:5:"3.7.3";s:11:"description";s:73:"The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.";s:4:"refs";s:216:"[{"url":"https:\/\/wordpress.org\/plugins\/i-recommend-this\/#developers","name":"https:\/\/wordpress.org\/plugins\/i-recommend-this\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:195;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16902";s:4:"slug";s:7:"arforms";s:19:"versionEndExcluding";s:5:"3.7.2";s:11:"description";s:167:"In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.";s:4:"refs";s:358:"[{"url":"http:\/\/almorabea.net\/cve-2019-16902.txt","name":"http:\/\/almorabea.net\/cve-2019-16902.txt","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.arformsplugin.com\/documentation\/changelog\/","name":"https:\/\/www.arformsplugin.com\/documentation\/changelog\/","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:196;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15113";s:4:"slug";s:27:"companion-sitemap-generator";s:19:"versionEndExcluding";s:5:"3.7.0";s:11:"description";s:75:"The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.";s:4:"refs";s:238:"[{"url":"https:\/\/wordpress.org\/plugins\/companion-sitemap-generator\/#developers","name":"https:\/\/wordpress.org\/plugins\/companion-sitemap-generator\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:197;O:8:"stdClass":5:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:19:"all-in-one-seo-pack";s:19:"versionEndExcluding";s:5:"3.6.2";s:11:"description";s:108:"Detected and reported by Wordfence team - "2 Million Users Affected by Vulnerability in All in One SEO Pack"";s:4:"refs";s:104:"https://www.wordfence.com/blog/2020/07/2-million-users-affected-by-vulnerability-in-all-in-one-seo-pack/";}i:198;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-14959";s:4:"slug";s:17:"easy-testimonials";s:19:"versionEndExcluding";s:3:"3.6";s:11:"description";s:289:"Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-admin/post.php Client Name, Position, Web Address, Other, Location Reviewed, Product Reviewed, Item Reviewed, or Rating parameter.";s:4:"refs";s:143:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10223","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10223","refsource":"MISC","tags":[]}]";}i:199;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2013-7475";s:4:"slug";s:19:"contact-form-plugin";s:19:"versionEndExcluding";s:4:"3.52";s:11:"description";s:65:"The contact-form-plugin plugin before 3.52 for WordPress has XSS.";s:4:"refs";s:221:"[{"url":"https:\/\/wordpress.org\/plugins\/contact-form-plugin\/#developers","name":"https:\/\/wordpress.org\/plugins\/contact-form-plugin\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:200;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18499";s:4:"slug";s:17:"simple-membership";s:19:"versionEndExcluding";s:5:"3.5.7";s:11:"description";s:64:"The simple-membership plugin before 3.5.7 for WordPress has XSS.";s:4:"refs";s:352:"[{"url":"https:\/\/wordpress.org\/plugins\/simple-membership\/#developers","name":"https:\/\/wordpress.org\/plugins\/simple-membership\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9718","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9718","refsource":"MISC","tags":[]}]";}i:201;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9978";s:4:"slug";s:14:"social-warfare";s:19:"versionEndExcluding";s:5:"3.5.3";s:11:"description";s:233:"The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.";s:4:"refs";s:2161:"[{"url":"http:\/\/packetstormsecurity.com\/files\/152722\/Wordpress-Social-Warfare-Remote-Code-Execution.html","name":"http:\/\/packetstormsecurity.com\/files\/152722\/Wordpress-Social-Warfare-Remote-Code-Execution.html","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/blog.sucuri.net\/2019\/03\/zero-day-stored-xss-in-social-warfare.html","name":"https:\/\/blog.sucuri.net\/2019\/03\/zero-day-stored-xss-in-social-warfare.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/twitter.com\/warfareplugins\/status\/1108852747099652099","name":"https:\/\/twitter.com\/warfareplugins\/status\/1108852747099652099","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/social-warfare\/#developers","name":"https:\/\/wordpress.org\/plugins\/social-warfare\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9238","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9238","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.cybersecurity-help.cz\/vdb\/SB2019032105","name":"https:\/\/www.cybersecurity-help.cz\/vdb\/SB2019032105","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/www.exploit-db.com\/exploits\/46794\/","name":"46794","refsource":"EXPLOIT-DB","tags":["Third Party Advisory","VDB Entry"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2019\/03\/21\/full-disclosure-of-settings-change-persistent-cross-site-scripting-xss-vulnerability-in-social-warfare\/","name":"https:\/\/www.pluginvulnerabilities.com\/2019\/03\/21\/full-disclosure-of-settings-change-persistent-cross-site-scripting-xss-vulnerability-in-social-warfare\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/www.wordfence.com\/blog\/2019\/03\/unpatched-zero-day-vulnerability-in-social-warfare-plugin-exploited-in-the-wild\/","name":"https:\/\/www.wordfence.com\/blog\/2019\/03\/unpatched-zero-day-vulnerability-in-social-warfare-plugin-exploited-in-the-wild\/","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:202;O:8:"stdClass":5:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:17:"syntaxhighlighter";s:19:"versionEndExcluding";s:5:"3.5.1";s:11:"description";s:37:"Stored XSS vulnerability in comments.";s:4:"refs";s:97:"https://hackerone.com/reports/707720
https://wordpress.org/plugins/syntaxhighlighter/#developers";}i:203;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18615";s:4:"slug";s:17:"kama-clic-counter";s:19:"versionEndExcluding";s:5:"3.5.0";s:11:"description";s:64:"The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.";s:4:"refs";s:212:"[{"url":"https:\/\/wordpress.org\/plugins\/kama-clic-counter\/#developers","name":"https:\/\/wordpress.org\/plugins\/kama-clic-counter\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:204;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9322";s:4:"slug";s:34:"erident-custom-login-and-dashboard";s:19:"versionEndExcluding";s:3:"3.5";s:11:"description";s:80:"The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.";s:4:"refs";s:252:"[{"url":"https:\/\/wordpress.org\/plugins\/erident-custom-login-and-dashboard\/#developers","name":"https:\/\/wordpress.org\/plugins\/erident-custom-login-and-dashboard\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:205;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18540";s:4:"slug";s:12:"weblibrarian";s:19:"versionEndExcluding";s:7:"3.4.8.7";s:11:"description";s:87:"The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.";s:4:"refs";s:324:"[{"url":"https:\/\/wordpress.org\/plugins\/weblibrarian\/#developers","name":"https:\/\/wordpress.org\/plugins\/weblibrarian\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9725","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9725","refsource":"MISC","tags":[]}]";}i:206;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18539";s:4:"slug";s:12:"weblibrarian";s:19:"versionEndExcluding";s:7:"3.4.8.6";s:11:"description";s:87:"The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.";s:4:"refs";s:324:"[{"url":"https:\/\/wordpress.org\/plugins\/weblibrarian\/#developers","name":"https:\/\/wordpress.org\/plugins\/weblibrarian\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9724","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9724","refsource":"MISC","tags":[]}]";}i:207;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18538";s:4:"slug";s:12:"weblibrarian";s:19:"versionEndExcluding";s:7:"3.4.8.5";s:11:"description";s:87:"The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.";s:4:"refs";s:184:"[{"url":"https:\/\/wordpress.org\/plugins\/weblibrarian\/#developers","name":"https:\/\/wordpress.org\/plugins\/weblibrarian\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:208;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10973";s:4:"slug";s:7:"Brafton";s:19:"versionEndExcluding";s:5:"3.4.8";s:11:"description";s:145:"The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.";s:4:"refs";s:398:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8614","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8614","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/05\/20\/5","name":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/05\/20\/5","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]}]";}i:209;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10973";s:4:"slug";s:7:"Brafton";s:19:"versionEndExcluding";s:5:"3.4.8";s:11:"description";s:145:"The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.";s:4:"refs";s:398:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8614","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8614","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/05\/20\/5","name":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/05\/20\/5","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]}]";}i:210;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20978";s:4:"slug";s:13:"wp-all-import";s:19:"versionEndExcluding";s:5:"3.4.7";s:11:"description";s:60:"The wp-all-import plugin before 3.4.7 for WordPress has XSS.";s:4:"refs";s:186:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-all-import\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-all-import\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:211;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18567";s:4:"slug";s:13:"wp-all-import";s:19:"versionEndExcluding";s:5:"3.4.6";s:11:"description";s:60:"The wp-all-import plugin before 3.4.6 for WordPress has XSS.";s:4:"refs";s:186:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-all-import\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-all-import\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:212;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15863";s:4:"slug";s:11:"ConvertPlus";s:19:"versionEndExcluding";s:5:"3.4.5";s:11:"description";s:133:"The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.";s:4:"refs";s:164:"[{"url":"https:\/\/www.convertplug.com\/plus\/changelog\/","name":"https:\/\/www.convertplug.com\/plus\/changelog\/","refsource":"MISC","tags":["Vendor Advisory"]}]";}i:213;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9431";s:4:"slug";s:12:"qtranslate-x";s:19:"versionEndExcluding";s:5:"3.4.4";s:11:"description";s:189:"The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config parameter.";s:4:"refs";s:619:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_1a40d7e7a2c29847b939f2c7472c335e.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_1a40d7e7a2c29847b939f2c7472c335e.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/qtranslate-x\/#developers","name":"https:\/\/wordpress.org\/plugins\/qtranslate-x\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8279","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8279","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:214;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9359";s:4:"slug";s:7:"Jetpack";s:19:"versionEndExcluding";s:5:"3.4.3";s:11:"description";s:97:"The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().";s:4:"refs";s:528:"[{"url":"https:\/\/blog.sucuri.net\/2015\/04\/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html","name":"https:\/\/blog.sucuri.net\/2015\/04\/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/jetpack.com\/2015\/04\/20\/jetpack-3-4-3-coordinated-security-update\/","name":"https:\/\/jetpack.com\/2015\/04\/20\/jetpack-3-4-3-coordinated-security-update\/","refsource":"MISC","tags":["Vendor Advisory"]}]";}i:215;O:8:"stdClass":6:{s:6:"CVE_ID";s:14:"CVE-2020-12462";s:4:"slug";s:11:"ninja-forms";s:19:"versionEndExcluding";s:8:"3.4.24.2";s:11:"description";s:84:"The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.";s:14:"recommendation";s:90:"https://www.wordfence.com/blog/2020/04/high-severity-vulnerability-patched-in-ninja-forms/";s:4:"refs";s:167:"[{"url":"https:\/\/wordpress.org\/plugins\/ninja-forms\/#developers","name":"https:\/\/wordpress.org\/plugins\/ninja-forms\/#developers","refsource":"MISC","tags":[]}]";}i:216;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-8594";s:4:"slug";s:11:"ninja-forms";s:19:"versionEndExcluding";s:6:"3.4.23";s:11:"description";s:213:"The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_forms[date_format].";s:4:"refs";s:472:"[{"url":"https:\/\/spider-security.co.uk\/blog-cve-cve-2020-8594","name":"https:\/\/spider-security.co.uk\/blog-cve-cve-2020-8594","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/ninja-forms\/#developers","name":"https:\/\/wordpress.org\/plugins\/ninja-forms\/#developers","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10070","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10070","refsource":"MISC","tags":[]}]";}i:217;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-14962";s:4:"slug";s:29:"final-tiles-grid-gallery-lite";s:19:"versionEndExcluding";s:6:"3.4.19";s:11:"description";s:258:"Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title (aka imageTitle) or Caption (aka description) field of an image to wp-admin/admin-ajax.php.";s:4:"refs";s:143:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10241","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10241","refsource":"MISC","tags":[]}]";}i:218;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:32:"yith-woocommerce-product-vendors";s:19:"versionEndExcluding";s:5:"3.4.1";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:219;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17234";s:4:"slug";s:8:"igniteup";s:19:"versionEndExcluding";s:5:"3.4.1";s:11:"description";s:135:"includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.";s:4:"refs";s:514:"[{"url":"https:\/\/blog.nintechnet.com\/multiple-vulnerabilities-in-wordpress-igniteup-coming-soon-and-maintenance-mode-plugin\/","name":"https:\/\/blog.nintechnet.com\/multiple-vulnerabilities-in-wordpress-igniteup-coming-soon-and-maintenance-mode-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/igniteup\/#developers","name":"https:\/\/wordpress.org\/plugins\/igniteup\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:220;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17235";s:4:"slug";s:8:"igniteup";s:19:"versionEndExcluding";s:5:"3.4.1";s:11:"description";s:118:"includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure.";s:4:"refs";s:514:"[{"url":"https:\/\/blog.nintechnet.com\/multiple-vulnerabilities-in-wordpress-igniteup-coming-soon-and-maintenance-mode-plugin\/","name":"https:\/\/blog.nintechnet.com\/multiple-vulnerabilities-in-wordpress-igniteup-coming-soon-and-maintenance-mode-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/igniteup\/#developers","name":"https:\/\/wordpress.org\/plugins\/igniteup\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:221;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17236";s:4:"slug";s:8:"igniteup";s:19:"versionEndExcluding";s:5:"3.4.1";s:11:"description";s:116:"includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS.";s:4:"refs";s:514:"[{"url":"https:\/\/blog.nintechnet.com\/multiple-vulnerabilities-in-wordpress-igniteup-coming-soon-and-maintenance-mode-plugin\/","name":"https:\/\/blog.nintechnet.com\/multiple-vulnerabilities-in-wordpress-igniteup-coming-soon-and-maintenance-mode-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/igniteup\/#developers","name":"https:\/\/wordpress.org\/plugins\/igniteup\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:222;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17237";s:4:"slug";s:8:"igniteup";s:19:"versionEndExcluding";s:5:"3.4.1";s:11:"description";s:100:"includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF.";s:4:"refs";s:514:"[{"url":"https:\/\/blog.nintechnet.com\/multiple-vulnerabilities-in-wordpress-igniteup-coming-soon-and-maintenance-mode-plugin\/","name":"https:\/\/blog.nintechnet.com\/multiple-vulnerabilities-in-wordpress-igniteup-coming-soon-and-maintenance-mode-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/igniteup\/#developers","name":"https:\/\/wordpress.org\/plugins\/igniteup\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:223;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9341";s:4:"slug";s:14:"wp-file-upload";s:19:"versionEndExcluding";s:5:"3.4.1";s:11:"description";s:110:"The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-file-upload\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-file-upload\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:224;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10898";s:4:"slug";s:14:"total-security";s:19:"versionEndExcluding";s:5:"3.4.1";s:11:"description";s:61:"The total-security plugin before 3.4.1 for WordPress has XSS.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/total-security\/#developers","name":"https:\/\/wordpress.org\/plugins\/total-security\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:225;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10898";s:4:"slug";s:14:"total-security";s:19:"versionEndExcluding";s:5:"3.4.1";s:11:"description";s:61:"The total-security plugin before 3.4.1 for WordPress has XSS.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/total-security\/#developers","name":"https:\/\/wordpress.org\/plugins\/total-security\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:226;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10899";s:4:"slug";s:14:"total-security";s:19:"versionEndExcluding";s:5:"3.4.1";s:11:"description";s:89:"The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/total-security\/#developers","name":"https:\/\/wordpress.org\/plugins\/total-security\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:227;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10899";s:4:"slug";s:14:"total-security";s:19:"versionEndExcluding";s:5:"3.4.1";s:11:"description";s:89:"The total-security plugin before 3.4.1 for WordPress has a settings-change vulnerability.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/total-security\/#developers","name":"https:\/\/wordpress.org\/plugins\/total-security\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:228;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9327";s:4:"slug";s:24:"flickr-justified-gallery";s:19:"versionEndExcluding";s:5:"3.4.0";s:11:"description";s:71:"The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS.";s:4:"refs";s:208:"[{"url":"https:\/\/wordpress.org\/plugins\/flickr-justified-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/flickr-justified-gallery\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:229;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18497";s:4:"slug";s:9:"liveforms";s:19:"versionEndExcluding";s:5:"3.4.0";s:11:"description";s:56:"The liveforms plugin before 3.4.0 for WordPress has XSS.";s:4:"refs";s:185:"[{"url":"https:\/\/wordpress.org\/plugins\/liveforms\/#developers","name":"https:\/\/wordpress.org\/plugins\/liveforms\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:230;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18600";s:4:"slug";s:10:"formcraft3";s:19:"versionEndExcluding";s:3:"3.4";s:11:"description";s:112:"The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field.";s:4:"refs";s:163:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8877","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8877","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:231;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15817";s:4:"slug";s:22:"easy-property-listings";s:19:"versionEndExcluding";s:3:"3.4";s:11:"description";s:67:"The easy-property-listings plugin before 3.4 for WordPress has XSS.";s:4:"refs";s:383:"[{"url":"https:\/\/wordpress.org\/plugins\/easy-property-listings\/#developers","name":"https:\/\/wordpress.org\/plugins\/easy-property-listings\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9511","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9511","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:232;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15896";s:4:"slug";s:9:"lifterlms";s:19:"versionEndExcluding";s:6:"3.35.0";s:11:"description";s:317:"An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation (administrator account creation), website redirection, and stored XSS.";s:4:"refs";s:604:"[{"url":"https:\/\/blog.nintechnet.com\/critical-vulnerability-fixed-in-wordpress-lifterlms-plugin\/","name":"https:\/\/blog.nintechnet.com\/critical-vulnerability-fixed-in-wordpress-lifterlms-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/lifterlms\/#developers","name":"https:\/\/wordpress.org\/plugins\/lifterlms\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9871","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9871","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:233;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20981";s:4:"slug";s:11:"ninja-forms";s:19:"versionEndExcluding";s:5:"3.3.9";s:11:"description";s:146:"The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.";s:4:"refs";s:205:"[{"url":"https:\/\/wordpress.org\/plugins\/ninja-forms\/#developers","name":"https:\/\/wordpress.org\/plugins\/ninja-forms\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:234;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2013-7481";s:4:"slug";s:19:"contact-form-plugin";s:19:"versionEndExcluding";s:5:"3.3.5";s:11:"description";s:66:"The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.";s:4:"refs";s:221:"[{"url":"https:\/\/wordpress.org\/plugins\/contact-form-plugin\/#developers","name":"https:\/\/wordpress.org\/plugins\/contact-form-plugin\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:235;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10987";s:4:"slug";s:23:"persian-woocommerce-sms";s:19:"versionEndExcluding";s:5:"3.3.4";s:11:"description";s:85:"The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.";s:4:"refs";s:636:"[{"url":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/persian-woocommerce-sms-xss-vulnerability\/","name":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/persian-woocommerce-sms-xss-vulnerability\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/persian-woocommerce-sms\/#developers","name":"https:\/\/wordpress.org\/plugins\/persian-woocommerce-sms\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8463","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8463","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:236;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10987";s:4:"slug";s:23:"persian-woocommerce-sms";s:19:"versionEndExcluding";s:5:"3.3.4";s:11:"description";s:85:"The persian-woocommerce-sms plugin before 3.3.4 for WordPress has ps_sms_numbers XSS.";s:4:"refs";s:636:"[{"url":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/persian-woocommerce-sms-xss-vulnerability\/","name":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/persian-woocommerce-sms-xss-vulnerability\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/persian-woocommerce-sms\/#developers","name":"https:\/\/wordpress.org\/plugins\/persian-woocommerce-sms\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8463","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8463","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:237;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10884";s:4:"slug";s:17:"simple-membership";s:19:"versionEndExcluding";s:5:"3.3.3";s:11:"description";s:81:"The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.";s:4:"refs";s:358:"[{"url":"https:\/\/wordpress.org\/plugins\/simple-membership\/#developers","name":"https:\/\/wordpress.org\/plugins\/simple-membership\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9744","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9744","refsource":"MISC","tags":[]}]";}i:238;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15025";s:4:"slug";s:11:"ninja-forms";s:19:"versionEndExcluding";s:8:"3.3.21.2";s:11:"description";s:116:"The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.";s:4:"refs";s:206:"[{"url":"https:\/\/wordpress.org\/plugins\/ninja-forms\/#developers","name":"https:\/\/wordpress.org\/plugins\/ninja-forms\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:239;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10914";s:4:"slug";s:15:"add-from-server";s:19:"versionEndExcluding";s:5:"3.3.2";s:11:"description";s:90:"The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/add-from-server\/#developers","name":"https:\/\/wordpress.org\/plugins\/add-from-server\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:240;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10914";s:4:"slug";s:15:"add-from-server";s:19:"versionEndExcluding";s:5:"3.3.2";s:11:"description";s:90:"The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/add-from-server\/#developers","name":"https:\/\/wordpress.org\/plugins\/add-from-server\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:241;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14682";s:4:"slug";s:17:"acf-better-search";s:19:"versionEndExcluding";s:5:"3.3.1";s:11:"description";s:144:"The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.";s:4:"refs";s:723:"[{"url":"https:\/\/wordpress.org\/plugins\/acf-better-search\/#developers","name":"https:\/\/wordpress.org\/plugins\/acf-better-search\/#developers","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9399","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9399","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2019\/06\/26\/cross-site-request-forgery-csrf-settings-change-vulnerability-in-acf-better-search\/","name":"https:\/\/www.pluginvulnerabilities.com\/2019\/06\/26\/cross-site-request-forgery-csrf-settings-change-vulnerability-in-acf-better-search\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:242;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16931";s:4:"slug";s:10:"visualizer";s:19:"versionEndExcluding";s:5:"3.3.1";s:11:"description";s:417:"A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control, and classes/Visualizer/Render/Page/Data.php lacks output sanitization.";s:4:"refs";s:594:"[{"url":"https:\/\/nathandavison.com\/blog\/wordpress-visualizer-plugin-xss-and-ssrf","name":"https:\/\/nathandavison.com\/blog\/wordpress-visualizer-plugin-xss-and-ssrf","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/visualizer\/#developers","name":"https:\/\/wordpress.org\/plugins\/visualizer\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9893","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9893","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:243;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16932";s:4:"slug";s:10:"visualizer";s:19:"versionEndExcluding";s:5:"3.3.1";s:11:"description";s:124:"A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via wp-json/visualizer/v1/upload-data.";s:4:"refs";s:591:"[{"url":"https:\/\/nathandavison.com\/blog\/wordpress-visualizer-plugin-xss-and-ssrf","name":"https:\/\/nathandavison.com\/blog\/wordpress-visualizer-plugin-xss-and-ssrf","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/visualizer\/#developers","name":"https:\/\/wordpress.org\/plugins\/visualizer\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9892","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9892","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:244;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-13700";s:4:"slug";s:15:"acf-to-rest-api";s:19:"versionEndExcluding";s:5:"3.3.0";s:11:"description";s:303:"An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that reads sensitive information in the wp_options table, such as the login and pass values.";s:4:"refs";s:521:"[{"url":"https:\/\/gist.github.com\/mariuszpoplwski\/4fbaab7f271bea99c733e3f2a4bafbb5","name":"https:\/\/gist.github.com\/mariuszpoplwski\/4fbaab7f271bea99c733e3f2a4bafbb5","refsource":"MISC","tags":[]},{"url":"https:\/\/github.com\/airesvsg\/acf-to-rest-api","name":"https:\/\/github.com\/airesvsg\/acf-to-rest-api","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/acf-to-rest-api\/#developers","name":"https:\/\/wordpress.org\/plugins\/acf-to-rest-api\/#developers","refsource":"MISC","tags":[]}]";}i:245;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-11843";s:4:"slug";s:8:"mailpoet";s:19:"versionEndExcluding";s:6:"3.23.2";s:11:"description";s:174:"The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS).";s:4:"refs";s:619:"[{"url":"https:\/\/github.com\/mailpoet\/mailpoet\/releases\/tag\/3.23.2","name":"https:\/\/github.com\/mailpoet\/mailpoet\/releases\/tag\/3.23.2","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/pluginarchive.com\/wordpress\/mailpoet\/v\/3-23-2","name":"https:\/\/pluginarchive.com\/wordpress\/mailpoet\/v\/3-23-2","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/mailpoet\/#developers","name":"https:\/\/wordpress.org\/plugins\/mailpoet\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:246;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15660";s:4:"slug";s:10:"wp-members";s:19:"versionEndExcluding";s:5:"3.2.8";s:11:"description";s:58:"The wp-members plugin before 3.2.8 for WordPress has CSRF.";s:4:"refs";s:180:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-members\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-members\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:247;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15838";s:4:"slug";s:14:"custom-404-pro";s:19:"versionEndExcluding";s:5:"3.2.8";s:11:"description";s:118:"The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789.";s:4:"refs";s:368:"[{"url":"https:\/\/wordpress.org\/plugins\/custom-404-pro\/#developers","name":"https:\/\/wordpress.org\/plugins\/custom-404-pro\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9857","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9857","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:248;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9412";s:4:"slug";s:12:"Royal-Slider";s:19:"versionEndExcluding";s:5:"3.2.7";s:11:"description";s:84:"The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.";s:4:"refs";s:380:"[{"url":"https:\/\/wordpress.org\/plugins\/royal-slider\/#developers","name":"https:\/\/wordpress.org\/plugins\/royal-slider\/#developers","refsource":"MISC","tags":["Not Applicable","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8182","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8182","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:249;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16520";s:4:"slug";s:19:"all-in-one-seo-pack";s:19:"versionEndExcluding";s:5:"3.2.7";s:11:"description";s:238:"The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of the SEO-specific description for posts provided by the plugin via unsafe placeholder replacement.";s:4:"refs";s:1419:"[{"url":"http:\/\/www.openwall.com\/lists\/oss-security\/2019\/10\/16\/5","name":"[oss-security] 20191016 [SBA-ADV-20190913-04] CVE-2019-16520: WordPress Plugin - All in One SEO Pack <= 3.2.6 - Stored XSS","refsource":"MLIST","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/github.com\/sbaresearch\/advisories\/tree\/public\/2019\/SBA-ADV-20190913-04_WordPress_Plugin_All_in_One_SEO_Pack","name":"https:\/\/github.com\/sbaresearch\/advisories\/tree\/public\/2019\/SBA-ADV-20190913-04_WordPress_Plugin_All_in_One_SEO_Pack","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/github.com\/semperfiwebdesign\/all-in-one-seo-pack\/issues\/2888","name":"https:\/\/github.com\/semperfiwebdesign\/all-in-one-seo-pack\/issues\/2888","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/semperplugins.com\/all-in-one-seo-pack-changelog\/","name":"https:\/\/semperplugins.com\/all-in-one-seo-pack-changelog\/","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/all-in-one-seo-pack\/#developers","name":"https:\/\/wordpress.org\/plugins\/all-in-one-seo-pack\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9915","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9915","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:250;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2013-7472";s:4:"slug";s:15:""Count per Day"";s:19:"versionEndExcluding";s:5:"3.2.6";s:11:"description";s:122:"The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.";s:4:"refs";s:410:"[{"url":"https:\/\/lists.openwall.net\/full-disclosure\/2013\/03\/05\/2","name":"https:\/\/lists.openwall.net\/full-disclosure\/2013\/03\/05\/2","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/count-per-day\/#developers","name":"https:\/\/wordpress.org\/plugins\/count-per-day\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:251;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2018-6357";s:4:"slug";s:86:"acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget";s:19:"versionEndExcluding";s:5:"3.2.6";s:11:"description";s:243:"The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php, with resultant social_widget_icon_array_order XSS.";s:4:"refs";s:423:"[{"url":"http:\/\/lists.openwall.net\/full-disclosure\/2018\/01\/10\/8","name":"http:\/\/lists.openwall.net\/full-disclosure\/2018\/01\/10\/8","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/acurax-social-media-widget\/#developers","name":"https:\/\/wordpress.org\/plugins\/acurax-social-media-widget\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:252;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9329";s:4:"slug";s:13:"wp-all-import";s:19:"versionEndExcluding";s:5:"3.2.5";s:11:"description";s:70:"The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.";s:4:"refs";s:186:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-all-import\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-all-import\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:253;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9330";s:4:"slug";s:13:"wp-all-import";s:19:"versionEndExcluding";s:5:"3.2.5";s:11:"description";s:76:"The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.";s:4:"refs";s:186:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-all-import\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-all-import\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:254;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18586";s:4:"slug";s:12:"insert-pages";s:19:"versionEndExcluding";s:5:"3.2.4";s:11:"description";s:101:"The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.";s:4:"refs";s:184:"[{"url":"https:\/\/wordpress.org\/plugins\/insert-pages\/#developers","name":"https:\/\/wordpress.org\/plugins\/insert-pages\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:255;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9331";s:4:"slug";s:13:"wp-all-import";s:19:"versionEndExcluding";s:5:"3.2.4";s:11:"description";s:111:"The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.";s:4:"refs";s:186:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-all-import\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-all-import\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:256;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2012-6714";s:4:"slug";s:13:"count-per-day";s:19:"versionEndExcluding";s:5:"3.2.3";s:11:"description";s:77:"The count-per-day plugin before 3.2.3 for WordPress has XSS via search words.";s:4:"refs";s:186:"[{"url":"https:\/\/wordpress.org\/plugins\/count-per-day\/#developers","name":"https:\/\/wordpress.org\/plugins\/count-per-day\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:257;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20980";s:4:"slug";s:11:"ninja-forms";s:19:"versionEndExcluding";s:6:"3.2.15";s:11:"description";s:75:"The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.";s:4:"refs";s:205:"[{"url":"https:\/\/wordpress.org\/plugins\/ninja-forms\/#developers","name":"https:\/\/wordpress.org\/plugins\/ninja-forms\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:258;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20972";s:4:"slug";s:21:"companion-auto-update";s:19:"versionEndExcluding";s:5:"3.2.1";s:11:"description";s:69:"The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.";s:4:"refs";s:226:"[{"url":"https:\/\/wordpress.org\/plugins\/companion-auto-update\/#developers","name":"https:\/\/wordpress.org\/plugins\/companion-auto-update\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:259;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20973";s:4:"slug";s:21:"companion-auto-update";s:19:"versionEndExcluding";s:5:"3.2.1";s:11:"description";s:85:"The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion.";s:4:"refs";s:226:"[{"url":"https:\/\/wordpress.org\/plugins\/companion-auto-update\/#developers","name":"https:\/\/wordpress.org\/plugins\/companion-auto-update\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:260;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-21007";s:4:"slug";s:22:"woo-confirmation-email";s:19:"versionEndExcluding";s:5:"3.2.0";s:11:"description";s:134:"The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads.";s:4:"refs";s:344:"[{"url":"https:\/\/wordpress.org\/plugins\/woo-confirmation-email\/#developers","name":"https:\/\/wordpress.org\/plugins\/woo-confirmation-email\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9847","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9847","refsource":"MISC","tags":[]}]";}i:261;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9301";s:4:"slug";s:9:"liveforms";s:19:"versionEndExcluding";s:5:"3.2.0";s:11:"description";s:66:"The liveforms plugin before 3.2.0 for WordPress has SQL injection.";s:4:"refs";s:201:"[{"url":"https:\/\/wordpress.org\/plugins\/liveforms\/#developers","name":"https:\/\/wordpress.org\/plugins\/liveforms\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:262;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11012";s:4:"slug";s:20:"sola-support-tickets";s:19:"versionEndExcluding";s:4:"3.13";s:11:"description";s:120:"The sola-support-tickets plugin before 3.13 for WordPress has incorrect access control for /wp-admin with resultant XSS.";s:4:"refs";s:405:"[{"url":"https:\/\/wordpress.org\/plugins\/sola-support-tickets\/#developers","name":"https:\/\/wordpress.org\/plugins\/sola-support-tickets\/#developers","refsource":"MISC","tags":["Product","Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8389","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8389","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:263;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15836";s:4:"slug";s:18:"wp-ultimate-recipe";s:19:"versionEndExcluding";s:6:"3.12.7";s:11:"description";s:73:"The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS.";s:4:"refs";s:384:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-ultimate-recipe\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-ultimate-recipe\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9394","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9394","refsource":"MISC","tags":["Patch","Third Party Advisory"]}]";}i:264;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-20173";s:4:"slug";s:5:"auth0";s:19:"versionEndExcluding";s:6:"3.11.3";s:11:"description";s:121:"The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.";s:4:"refs";s:493:"[{"url":"https:\/\/auth0.com\/docs\/security\/bulletins\/cve-2019-20173","name":"https:\/\/auth0.com\/docs\/security\/bulletins\/cve-2019-20173","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/github.com\/auth0\/wp-auth0\/releases\/tag\/3.11.3","name":"https:\/\/github.com\/auth0\/wp-auth0\/releases\/tag\/3.11.3","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10059","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10059","refsource":"MISC","tags":[]}]";}i:265;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-2791";s:4:"slug";s:32:""menu sync" function in the WPML";s:19:"versionEndExcluding";s:5:"3.1.9";s:11:"description";s:211:"The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/menus-sync.php.";s:4:"refs";s:911:"[{"url":"http:\/\/klikki.fi\/adv\/wpml.html","name":"http:\/\/klikki.fi\/adv\/wpml.html","refsource":"MISC","tags":["Exploit"]},{"url":"http:\/\/packetstormsecurity.com\/files\/130810\/WordPress-WPML-XSS-Deletion-SQL-Injection.html","name":"http:\/\/packetstormsecurity.com\/files\/130810\/WordPress-WPML-XSS-Deletion-SQL-Injection.html","refsource":"MISC","tags":["Exploit"]},{"url":"http:\/\/seclists.org\/fulldisclosure\/2015\/Mar\/71","name":"20150312 WPML WordPress plug-in SQL injection etc.","refsource":"FULLDISC","tags":["Exploit"]},{"url":"http:\/\/www.securityfocus.com\/archive\/1\/534862\/100\/0\/threaded","name":"20150312 WPML WordPress plug-in SQL injection etc.","refsource":"BUGTRAQ","tags":[]},{"url":"https:\/\/wpml.org\/2015\/03\/wpml-security-update-bug-and-fix\/","name":"https:\/\/wpml.org\/2015\/03\/wpml-security-update-bug-and-fix\/","refsource":"CONFIRM","tags":["Vendor Advisory"]}]";}i:266;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-2792";s:4:"slug";s:4:"WPML";s:19:"versionEndExcluding";s:5:"3.1.9";s:11:"description";s:305:"The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass nonce checks and perform arbitrary actions via a request containing an action POST parameter, an action GET parameter, and a valid nonce for the action GET parameter.";s:4:"refs";s:734:"[{"url":"http:\/\/klikki.fi\/adv\/wpml.html","name":"http:\/\/klikki.fi\/adv\/wpml.html","refsource":"MISC","tags":["Exploit"]},{"url":"http:\/\/packetstormsecurity.com\/files\/130839\/WordPress-WPML-Missing-Authentication.html","name":"http:\/\/packetstormsecurity.com\/files\/130839\/WordPress-WPML-Missing-Authentication.html","refsource":"MISC","tags":["Exploit"]},{"url":"http:\/\/seclists.org\/fulldisclosure\/2015\/Mar\/79","name":"20150316 Re: WPML WordPress plug-in SQL injection etc.","refsource":"FULLDISC","tags":["Exploit"]},{"url":"http:\/\/wpml.org\/2015\/03\/wpml-security-update-bug-and-fix\/","name":"http:\/\/wpml.org\/2015\/03\/wpml-security-update-bug-and-fix\/","refsource":"CONFIRM","tags":["Vendor Advisory"]}]";}i:267;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9317";s:4:"slug";s:15:"awesome-support";s:19:"versionEndExcluding";s:5:"3.1.7";s:11:"description";s:94:"The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/awesome-support\/#developers","name":"https:\/\/wordpress.org\/plugins\/awesome-support\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:268;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9318";s:4:"slug";s:15:"awesome-support";s:19:"versionEndExcluding";s:5:"3.1.7";s:11:"description";s:118:"The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/awesome-support\/#developers","name":"https:\/\/wordpress.org\/plugins\/awesome-support\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:269;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9357";s:4:"slug";s:7:"akismet";s:19:"versionEndExcluding";s:5:"3.1.5";s:11:"description";s:54:"The akismet plugin before 3.1.5 for WordPress has XSS.";s:4:"refs";s:197:"[{"url":"https:\/\/wordpress.org\/plugins\/akismet\/#developers","name":"https:\/\/wordpress.org\/plugins\/akismet\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:270;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-7047";s:4:"slug";s:24:"wordpress-database-reset";s:19:"versionEndExcluding";s:5:"3.1.5";s:11:"description";s:300:"The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-admin/admin.php?db-reset-tables[]=users request) to escalate their privileges to administrator while dropping all other users from the table.";s:4:"refs";s:619:"[{"url":"https:\/\/wordpress.org\/plugins\/wordpress-database-reset\/#developers","name":"https:\/\/wordpress.org\/plugins\/wordpress-database-reset\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10028","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10028","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/01\/easily-exploitable-vulnerabilities-patched-in-wp-database-reset-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/01\/easily-exploitable-vulnerabilities-patched-in-wp-database-reset-plugin\/","refsource":"MISC","tags":[]}]";}i:271;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-7048";s:4:"slug";s:24:"wordpress-database-reset";s:19:"versionEndExcluding";s:5:"3.1.5";s:11:"description";s:306:"The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial WordPress set-up state (deleting all site content stored in that table), as demonstrated by a wp-admin/admin-post.php?db-reset-tables[]=comments URI.";s:4:"refs";s:619:"[{"url":"https:\/\/wordpress.org\/plugins\/wordpress-database-reset\/#developers","name":"https:\/\/wordpress.org\/plugins\/wordpress-database-reset\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10027","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10027","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/01\/easily-exploitable-vulnerabilities-patched-in-wp-database-reset-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/01\/easily-exploitable-vulnerabilities-patched-in-wp-database-reset-plugin\/","refsource":"MISC","tags":[]}]";}i:272;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9435";s:4:"slug";s:15:"oauth2-provider";s:19:"versionEndExcluding";s:5:"3.1.5";s:11:"description";s:97:"The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.";s:4:"refs";s:588:"[{"url":"https:\/\/security.dxw.com\/advisories\/the-oauth2-complete-plugin-for-wordpress-uses-a-pseudorandom-number-generator-which-is-non-cryptographically-secure\/","name":"https:\/\/security.dxw.com\/advisories\/the-oauth2-complete-plugin-for-wordpress-uses-a-pseudorandom-number-generator-which-is-non-cryptographically-secure\/","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/oauth2-provider\/#developers","name":"https:\/\/wordpress.org\/plugins\/oauth2-provider\/#developers","refsource":"MISC","tags":["Product","Vendor Advisory"]}]";}i:273;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-11727";s:4:"slug";s:21:"woo-order-export-lite";s:19:"versionEndExcluding";s:5:"3.1.4";s:11:"description";s:243:"A cross-site scripting (XSS) vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woe_post_type parameter.";s:4:"refs";s:927:"[{"url":"http:\/\/packetstormsecurity.com\/files\/157557\/WordPress-WooCommerce-Advanced-Order-Export-3.1.3-Cross-Site-Scripting.html","name":"http:\/\/packetstormsecurity.com\/files\/157557\/WordPress-WooCommerce-Advanced-Order-Export-3.1.3-Cross-Site-Scripting.html","refsource":"MISC","tags":[]},{"url":"https:\/\/plugins.trac.wordpress.org\/browser\/woo-order-export-lite\/trunk\/view\/settings-form.php","name":"https:\/\/plugins.trac.wordpress.org\/browser\/woo-order-export-lite\/trunk\/view\/settings-form.php","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/woo-order-export-lite\/#developers","name":"https:\/\/wordpress.org\/plugins\/woo-order-export-lite\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.themissinglink.com.au\/security-advisories-cve-2020-11727","name":"https:\/\/www.themissinglink.com.au\/security-advisories-cve-2020-11727","refsource":"MISC","tags":[]}]";}i:274;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18513";s:4:"slug";s:15:"responsive-menu";s:19:"versionEndExcluding";s:5:"3.1.4";s:11:"description";s:111:"The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.";s:4:"refs";s:214:"[{"url":"https:\/\/wordpress.org\/plugins\/responsive-menu\/#developers","name":"https:\/\/wordpress.org\/plugins\/responsive-menu\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:275;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-13413";s:4:"slug";s:9:"Rencontre";s:19:"versionEndExcluding";s:5:"3.1.3";s:11:"description";s:98:"The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php.";s:4:"refs";s:527:"[{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2119248","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2119248","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/rencontre\/#developers","name":"https:\/\/wordpress.org\/plugins\/rencontre\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9430","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9430","refsource":"MISC","tags":[]}]";}i:276;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-13414";s:4:"slug";s:9:"Rencontre";s:19:"versionEndExcluding";s:5:"3.1.3";s:11:"description";s:88:"The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php.";s:4:"refs";s:527:"[{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2119248","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2119248","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/rencontre\/#developers","name":"https:\/\/wordpress.org\/plugins\/rencontre\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9430","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9430","refsource":"MISC","tags":[]}]";}i:277;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9386";s:4:"slug";s:11:"mtouch-quiz";s:19:"versionEndExcluding";s:5:"3.1.3";s:11:"description";s:112:"The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.";s:4:"refs";s:453:"[{"url":"https:\/\/wordpress.org\/plugins\/mtouch-quiz\/#developers","name":"https:\/\/wordpress.org\/plugins\/mtouch-quiz\/#developers","refsource":"MISC","tags":["Product","Release Notes","Third Party Advisory"]},{"url":"https:\/\/www.davidsopas.com\/multiple-vulns-on-mtouch-quiz-wordpress-plugin\/","name":"https:\/\/www.davidsopas.com\/multiple-vulns-on-mtouch-quiz-wordpress-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:278;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9387";s:4:"slug";s:11:"mtouch-quiz";s:19:"versionEndExcluding";s:5:"3.1.3";s:11:"description";s:88:"The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF.";s:4:"refs";s:443:"[{"url":"https:\/\/wordpress.org\/plugins\/mtouch-quiz\/#developers","name":"https:\/\/wordpress.org\/plugins\/mtouch-quiz\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/www.davidsopas.com\/multiple-vulns-on-mtouch-quiz-wordpress-plugin\/","name":"https:\/\/www.davidsopas.com\/multiple-vulns-on-mtouch-quiz-wordpress-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:279;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9388";s:4:"slug";s:11:"mtouch-quiz";s:19:"versionEndExcluding";s:5:"3.1.3";s:11:"description";s:96:"The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.";s:4:"refs";s:443:"[{"url":"https:\/\/wordpress.org\/plugins\/mtouch-quiz\/#developers","name":"https:\/\/wordpress.org\/plugins\/mtouch-quiz\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/www.davidsopas.com\/multiple-vulns-on-mtouch-quiz-wordpress-plugin\/","name":"https:\/\/www.davidsopas.com\/multiple-vulns-on-mtouch-quiz-wordpress-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:280;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9389";s:4:"slug";s:11:"mtouch-quiz";s:19:"versionEndExcluding";s:5:"3.1.3";s:11:"description";s:74:"The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name.";s:4:"refs";s:443:"[{"url":"https:\/\/wordpress.org\/plugins\/mtouch-quiz\/#developers","name":"https:\/\/wordpress.org\/plugins\/mtouch-quiz\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/www.davidsopas.com\/multiple-vulns-on-mtouch-quiz-wordpress-plugin\/","name":"https:\/\/www.davidsopas.com\/multiple-vulns-on-mtouch-quiz-wordpress-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:281;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-5014";s:4:"slug";s:24:"WordPress Flash Uploader";s:19:"versionEndExcluding";s:5:"3.1.3";s:11:"description";s:179:"The WordPress Flash Uploader plugin before 3.1.3 for WordPress allows remote attackers to execute arbitrary commands via vectors related to invalid characters in image_magic_path.";s:4:"refs";s:418:"[{"url":"https:\/\/wordpress.org\/plugins\/wordpress-flash-uploader\/changelog\/","name":"https:\/\/wordpress.org\/plugins\/wordpress-flash-uploader\/changelog\/","refsource":"CONFIRM","tags":["Release Notes"]},{"url":"https:\/\/wordpress.org\/support\/topic\/vulnerability-discovered-2\/","name":"https:\/\/wordpress.org\/support\/topic\/vulnerability-discovered-2\/","refsource":"CONFIRM","tags":["Issue Tracking"]}]";}i:282;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10878";s:4:"slug";s:20:"wp-google-map-plugin";s:19:"versionEndExcluding";s:5:"3.1.2";s:11:"description";s:67:"The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.";s:4:"refs";s:212:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-google-map-plugin\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-google-map-plugin\/#developers","refsource":"MISC","tags":["Exploit","Vendor Advisory"]}]";}i:283;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10878";s:4:"slug";s:20:"wp-google-map-plugin";s:19:"versionEndExcluding";s:5:"3.1.2";s:11:"description";s:67:"The wp-google-map-plugin plugin before 3.1.2 for WordPress has XSS.";s:4:"refs";s:212:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-google-map-plugin\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-google-map-plugin\/#developers","refsource":"MISC","tags":["Exploit","Vendor Advisory"]}]";}i:284;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15659";s:4:"slug";s:12:"pie-register";s:19:"versionEndExcluding";s:5:"3.1.2";s:11:"description";s:108:"The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.";s:4:"refs";s:346:"[{"url":"https:\/\/wordpress.org\/plugins\/pie-register\/#developers","name":"https:\/\/wordpress.org\/plugins\/pie-register\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9835","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9835","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:285;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15713";s:4:"slug";s:11:"my-calendar";s:19:"versionEndExcluding";s:6:"3.1.10";s:11:"description";s:59:"The my-calendar plugin before 3.1.10 for WordPress has XSS.";s:4:"refs";s:189:"[{"url":"https:\/\/wordpress.org\/plugins\/my-calendar\/#developers","name":"https:\/\/wordpress.org\/plugins\/my-calendar\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:286;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18592";s:4:"slug";s:27:"woocommerce-catalog-enquiry";s:19:"versionEndExcluding";s:5:"3.1.0";s:11:"description";s:120:"The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.";s:4:"refs";s:214:"[{"url":"https:\/\/wordpress.org\/plugins\/woocommerce-catalog-enquiry\/#developers","name":"https:\/\/wordpress.org\/plugins\/woocommerce-catalog-enquiry\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:287;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18510";s:4:"slug";s:15:"custom-sidebars";s:19:"versionEndExcluding";s:5:"3.1.0";s:11:"description";s:123:"The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.";s:4:"refs";s:214:"[{"url":"https:\/\/wordpress.org\/plugins\/custom-sidebars\/#developers","name":"https:\/\/wordpress.org\/plugins\/custom-sidebars\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:288;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16522";s:4:"slug";s:13:"eu-cookie-law";s:19:"versionEndExcluding";s:3:"3.1";s:11:"description";s:355:"The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color, Background Color, and the Disable Cookie text. An attacker with high privileges can attack other users.";s:4:"refs";s:681:"[{"url":"https:\/\/github.com\/sbaresearch\/advisories\/tree\/public\/2019\/SBA-ADV-20190913-01_WordPress_Plugin_EU_Cookie_Law","name":"https:\/\/github.com\/sbaresearch\/advisories\/tree\/public\/2019\/SBA-ADV-20190913-01_WordPress_Plugin_EU_Cookie_Law","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/eu-cookie-law\/#developers","name":"https:\/\/wordpress.org\/plugins\/eu-cookie-law\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9918","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9918","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:289;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-9735";s:4:"slug";s:40:"ThemePunch Slider Revolution (revslider)";s:19:"versionEndExcluding";s:6:"3.0.96";s:11:"description";s:460:"The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.";s:4:"refs";s:1426:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2014\/Nov\/78","name":"20151125 Slider Revolution\/Showbiz Pro shell upload exploit","refsource":"FULLDISC","tags":["Exploit"]},{"url":"http:\/\/www.securityfocus.com\/bid\/71306","name":"71306","refsource":"BID","tags":[]},{"url":"http:\/\/www.themepunch.com\/products\/old-revolution-slider-pre-4-2-vulnerabilty-explained\/","name":"http:\/\/www.themepunch.com\/products\/old-revolution-slider-pre-4-2-vulnerabilty-explained\/","refsource":"CONFIRM","tags":["Vendor Advisory"]},{"url":"https:\/\/blog.sucuri.net\/2014\/12\/revslider-vulnerability-leads-to-massive-wordpress-soaksoak-compromise.html","name":"https:\/\/blog.sucuri.net\/2014\/12\/revslider-vulnerability-leads-to-massive-wordpress-soaksoak-compromise.html","refsource":"MISC","tags":["Exploit"]},{"url":"https:\/\/plugins.trac.wordpress.org\/browser\/patch-for-revolution-slider\/trunk\/revsliderpatch.php","name":"https:\/\/plugins.trac.wordpress.org\/browser\/patch-for-revolution-slider\/trunk\/revsliderpatch.php","refsource":"MISC","tags":[]},{"url":"https:\/\/whatisgon.wordpress.com\/2014\/11\/30\/another-revslider-vulnerability\/","name":"https:\/\/whatisgon.wordpress.com\/2014\/11\/30\/another-revslider-vulnerability\/","refsource":"MISC","tags":["Exploit"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/7954","name":"https:\/\/wpvulndb.com\/vulnerabilities\/7954","refsource":"MISC","tags":[]}]";}i:290;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10901";s:4:"slug";s:19:"wp-customer-reviews";s:19:"versionEndExcluding";s:5:"3.0.9";s:11:"description";s:85:"The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.";s:4:"refs";s:198:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-customer-reviews\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-customer-reviews\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:291;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10901";s:4:"slug";s:19:"wp-customer-reviews";s:19:"versionEndExcluding";s:5:"3.0.9";s:11:"description";s:85:"The wp-customer-reviews plugin before 3.0.9 for WordPress has XSS in the admin tools.";s:4:"refs";s:198:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-customer-reviews\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-customer-reviews\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:292;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10902";s:4:"slug";s:19:"wp-customer-reviews";s:19:"versionEndExcluding";s:5:"3.0.9";s:11:"description";s:86:"The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.";s:4:"refs";s:198:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-customer-reviews\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-customer-reviews\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:293;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10902";s:4:"slug";s:19:"wp-customer-reviews";s:19:"versionEndExcluding";s:5:"3.0.9";s:11:"description";s:86:"The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.";s:4:"refs";s:198:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-customer-reviews\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-customer-reviews\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:294;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18511";s:4:"slug";s:15:"custom-sidebars";s:19:"versionEndExcluding";s:7:"3.0.8.1";s:11:"description";s:65:"The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.";s:4:"refs";s:214:"[{"url":"https:\/\/wordpress.org\/plugins\/custom-sidebars\/#developers","name":"https:\/\/wordpress.org\/plugins\/custom-sidebars\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:295;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10947";s:4:"slug";s:12:"Post Indexer";s:19:"versionEndExcluding";s:7:"3.0.6.2";s:11:"description";s:113:"The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.";s:4:"refs";s:343:"[{"url":"https:\/\/advisories.dxw.com\/advisories\/sql-injection-in-post-indexer-allows-super-admins-to-read-the-contents-of-the-database\/","name":"https:\/\/advisories.dxw.com\/advisories\/sql-injection-in-post-indexer-allows-super-admins-to-read-the-contents-of-the-database\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:296;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10947";s:4:"slug";s:12:"Post Indexer";s:19:"versionEndExcluding";s:7:"3.0.6.2";s:11:"description";s:113:"The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.";s:4:"refs";s:343:"[{"url":"https:\/\/advisories.dxw.com\/advisories\/sql-injection-in-post-indexer-allows-super-admins-to-read-the-contents-of-the-database\/","name":"https:\/\/advisories.dxw.com\/advisories\/sql-injection-in-post-indexer-allows-super-admins-to-read-the-contents-of-the-database\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:297;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10948";s:4:"slug";s:12:"Post Indexer";s:19:"versionEndExcluding";s:7:"3.0.6.2";s:11:"description";s:119:"The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function.";s:4:"refs";s:389:"[{"url":"https:\/\/advisories.dxw.com\/advisories\/unserialisation-in-post-indexer-could-allow-man-in-the-middle-to-execute-arbitrary-code-in-some-circumstances\/","name":"https:\/\/advisories.dxw.com\/advisories\/unserialisation-in-post-indexer-could-allow-man-in-the-middle-to-execute-arbitrary-code-in-some-circumstances\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:298;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10948";s:4:"slug";s:12:"Post Indexer";s:19:"versionEndExcluding";s:7:"3.0.6.2";s:11:"description";s:119:"The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function.";s:4:"refs";s:389:"[{"url":"https:\/\/advisories.dxw.com\/advisories\/unserialisation-in-post-indexer-could-allow-man-in-the-middle-to-execute-arbitrary-code-in-some-circumstances\/","name":"https:\/\/advisories.dxw.com\/advisories\/unserialisation-in-post-indexer-could-allow-man-in-the-middle-to-execute-arbitrary-code-in-some-circumstances\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:299;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-26596";s:4:"slug";s:9:"elementor";s:19:"versionEndExcluding";s:5:"3.0.5";s:11:"description";s:353:"The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting availability of the Editor role.";s:4:"refs";s:355:"[{"url":"https:\/\/elementor.com\/pro\/changelog\/","name":"https:\/\/elementor.com\/pro\/changelog\/","refsource":"MISC","tags":[]},{"url":"https:\/\/ww2.compunet.cl\/dia-cero-en-plugin-de-wordpres-detectada-compunet-redteam\/","name":"https:\/\/ww2.compunet.cl\/dia-cero-en-plugin-de-wordpres-detectada-compunet-redteam\/","refsource":"MISC","tags":[]}]";}i:300;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15835";s:4:"slug";s:20:"wp-better-permalinks";s:19:"versionEndExcluding";s:5:"3.0.5";s:11:"description";s:68:"The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF.";s:4:"refs";s:388:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-better-permalinks\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-better-permalinks\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9398","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9398","refsource":"MISC","tags":["Patch","Third Party Advisory"]}]";}i:301;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18574";s:4:"slug";s:11:"ninja-forms";s:19:"versionEndExcluding";s:6:"3.0.31";s:11:"description";s:97:"The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.";s:4:"refs";s:205:"[{"url":"https:\/\/wordpress.org\/plugins\/ninja-forms\/#developers","name":"https:\/\/wordpress.org\/plugins\/ninja-forms\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:302;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-26672";s:4:"slug";s:19:"testimonial-rotator";s:19:"versionEndExcluding";s:5:"3.0.3";s:11:"description";s:225:"Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request and inserts a payload in "cite" parameter, the payload will be stored in the database.";s:4:"refs";s:143:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10272","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10272","refsource":"MISC","tags":[]}]";}i:303;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-1494";s:4:"slug";s:22:"FancyBox for WordPress";s:19:"versionEndExcluding";s:5:"3.0.3";s:11:"description";s:337:"The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw[*] parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfw[padding] parameter and exploited in the wild in February 2015.";s:4:"refs";s:1268:"[{"url":"http:\/\/blog.sucuri.net\/2015\/02\/zero-day-in-the-fancybox-for-wordpress-plugin.html","name":"http:\/\/blog.sucuri.net\/2015\/02\/zero-day-in-the-fancybox-for-wordpress-plugin.html","refsource":"MISC","tags":[]},{"url":"http:\/\/osvdb.org\/show\/osvdb\/118543","name":"118543","refsource":"OSVDB","tags":[]},{"url":"http:\/\/www.exploit-db.com\/exploits\/36087","name":"36087","refsource":"EXPLOIT-DB","tags":["Exploit"]},{"url":"http:\/\/www.openwall.com\/lists\/oss-security\/2015\/02\/05\/10","name":"[oss-security] 20150205 Re: CVE request for Zero-day in the Fancybox-for-WordPress Plugin","refsource":"MLIST","tags":[]},{"url":"http:\/\/www.securityfocus.com\/bid\/72506","name":"72506","refsource":"BID","tags":[]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/1082625\/","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/1082625\/","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/fancybox-for-wordpress\/changelog\/","name":"https:\/\/wordpress.org\/plugins\/fancybox-for-wordpress\/changelog\/","refsource":"CONFIRM","tags":["Patch"]},{"url":"https:\/\/wordpress.org\/support\/topic\/possible-malware-2","name":"https:\/\/wordpress.org\/support\/topic\/possible-malware-2","refsource":"MISC","tags":[]}]";}i:304;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-8498";s:4:"slug";s:9:"gistpress";s:19:"versionEndExcluding";s:5:"3.0.2";s:11:"description";s:392:"XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability).

https://github.com/bradyvercher/gistpress/releases/tag/v3.0.2";s:4:"refs";s:427:"[{"url":"https:\/\/github.com\/bradyvercher\/gistpress\/commit\/e3f260edb6673227b0471c74b7ab13c094411ef7","name":"https:\/\/github.com\/bradyvercher\/gistpress\/commit\/e3f260edb6673227b0471c74b7ab13c094411ef7","refsource":"MISC","tags":[]},{"url":"https:\/\/github.com\/bradyvercher\/gistpress\/releases\/tag\/v3.0.2","name":"https:\/\/github.com\/bradyvercher\/gistpress\/releases\/tag\/v3.0.2","refsource":"MISC","tags":[]}]";}i:305;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9340";s:4:"slug";s:14:"wp-file-upload";s:19:"versionEndExcluding";s:5:"3.0.0";s:11:"description";s:165:"The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-file-upload\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-file-upload\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:306;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10383";s:4:"slug";s:25:"memphis-documents-library";s:19:"versionEndExcluding";s:3:"3.0";s:11:"description";s:88:"The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.";s:4:"refs";s:210:"[{"url":"https:\/\/wordpress.org\/plugins\/memphis-documents-library\/#developers","name":"https:\/\/wordpress.org\/plugins\/memphis-documents-library\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:307;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10384";s:4:"slug";s:25:"memphis-documents-library";s:19:"versionEndExcluding";s:3:"3.0";s:11:"description";s:87:"The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.";s:4:"refs";s:233:"[{"url":"https:\/\/wordpress.org\/plugins\/memphis-documents-library\/#developers","name":"https:\/\/wordpress.org\/plugins\/memphis-documents-library\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:308;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10385";s:4:"slug";s:25:"memphis-documents-library";s:19:"versionEndExcluding";s:3:"3.0";s:11:"description";s:84:"The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.";s:4:"refs";s:233:"[{"url":"https:\/\/wordpress.org\/plugins\/memphis-documents-library\/#developers","name":"https:\/\/wordpress.org\/plugins\/memphis-documents-library\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:309;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9424";s:4:"slug";s:9:"multicons";s:19:"versionEndExcluding";s:3:"3.0";s:11:"description";s:176:"The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter.";s:4:"refs";s:613:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_aea47a98ad3088dbb33528ded8e1b124.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_aea47a98ad3088dbb33528ded8e1b124.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/multicons\/#developers","name":"https:\/\/wordpress.org\/plugins\/multicons\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8330","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8330","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:310;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-9006";s:4:"slug";s:13:"popup-builder";s:19:"versionEndExcluding";s:3:"3.0";s:11:"description";s:475:"The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.)";s:4:"refs";s:861:"[{"url":"https:\/\/plugins.trac.wordpress.org\/browser\/popup-builder\/tags\/2.2.8\/files\/sg_popup_ajax.php#L69","name":"https:\/\/plugins.trac.wordpress.org\/browser\/popup-builder\/tags\/2.2.8\/files\/sg_popup_ajax.php#L69","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/popup-builder\/#developers","name":"https:\/\/wordpress.org\/plugins\/popup-builder\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10073","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10073","refsource":"MISC","tags":[]},{"url":"https:\/\/zeroauth.ltd\/blog\/2020\/02\/16\/cve-2020-9006-popup-builder-wp-plugin-sql-injection-via-php-deserialization\/","name":"https:\/\/zeroauth.ltd\/blog\/2020\/02\/16\/cve-2020-9006-popup-builder-wp-plugin-sql-injection-via-php-deserialization\/","refsource":"MISC","tags":[]}]";}i:311;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11001";s:4:"slug";s:20:"user-submitted-posts";s:19:"versionEndExcluding";s:8:"20160215";s:11:"description";s:107:"The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field.";s:4:"refs";s:447:"[{"url":"https:\/\/wordpress.org\/plugins\/user-submitted-posts\/#developers","name":"https:\/\/wordpress.org\/plugins\/user-submitted-posts\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/www.securityfocus.com\/archive\/1\/537616\/30\/0\/threaded","name":"https:\/\/www.securityfocus.com\/archive\/1\/537616\/30\/0\/threaded","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]}]";}i:312;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11001";s:4:"slug";s:20:"user-submitted-posts";s:19:"versionEndExcluding";s:8:"20160215";s:11:"description";s:107:"The user-submitted-posts plugin before 20160215 for WordPress has XSS via the user-submitted-content field.";s:4:"refs";s:447:"[{"url":"https:\/\/wordpress.org\/plugins\/user-submitted-posts\/#developers","name":"https:\/\/wordpress.org\/plugins\/user-submitted-posts\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/www.securityfocus.com\/archive\/1\/537616\/30\/0\/threaded","name":"https:\/\/www.securityfocus.com\/archive\/1\/537616\/30\/0\/threaded","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]}]";}i:313;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9358";s:4:"slug";s:13:"feedwordpress";s:19:"versionEndExcluding";s:9:"2015.0514";s:11:"description";s:107:"The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().";s:4:"refs";s:209:"[{"url":"https:\/\/wordpress.org\/plugins\/feedwordpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/feedwordpress\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:314;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20985";s:4:"slug";s:14:"wp-payeezy-pay";s:19:"versionEndExcluding";s:4:"2.98";s:11:"description";s:125:"The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-payeezy-pay\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-payeezy-pay\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:315;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15889";s:4:"slug";s:16:"download-manager";s:19:"versionEndExcluding";s:6:"2.9.94";s:11:"description";s:165:"The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.";s:4:"refs";s:1679:"[{"url":"http:\/\/packetstormsecurity.com\/files\/154356\/WordPress-Download-Manager-2.9.93-Cross-Site-Scripting.html","name":"http:\/\/packetstormsecurity.com\/files\/154356\/WordPress-Download-Manager-2.9.93-Cross-Site-Scripting.html","refsource":"MISC","tags":[]},{"url":"https:\/\/packetstormsecurity.com\/files\/152511\/WordPress-Download-Manager-2.9.92-Cross-Site-Scripting.html","name":"https:\/\/packetstormsecurity.com\/files\/152511\/WordPress-Download-Manager-2.9.92-Cross-Site-Scripting.html","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/packetstormsecurity.com\/files\/152552\/WordPress-Download-Manager-2.9.93-Cross-Site-Scripting.html","name":"https:\/\/packetstormsecurity.com\/files\/152552\/WordPress-Download-Manager-2.9.93-Cross-Site-Scripting.html","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2070388\/download-manager","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2070388\/download-manager","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/download-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/download-manager\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9257","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9257","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/www.cybersecurity-help.cz\/vdb\/SB2019041819","name":"https:\/\/www.cybersecurity-help.cz\/vdb\/SB2019041819","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:316;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-13864";s:4:"slug";s:9:"elementor";s:19:"versionEndExcluding";s:5:"2.9.9";s:11:"description";s:205:"The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.";s:4:"refs";s:191:"[{"url":"https:\/\/www.softwaresecured.com\/elementor-page-builder-stored-xss\/","name":"https:\/\/www.softwaresecured.com\/elementor-page-builder-stored-xss\/","refsource":"MISC","tags":[]}]";}i:317;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18032";s:4:"slug";s:16:"download-manager";s:19:"versionEndExcluding";s:6:"2.9.52";s:11:"description";s:147:"The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php.";s:4:"refs";s:408:"[{"url":"https:\/\/security.dxw.com\/advisories\/xss-download-manager\/","name":"https:\/\/security.dxw.com\/advisories\/xss-download-manager\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/download-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/download-manager\/#developers","refsource":"MISC","tags":["Product","Release Notes"]}]";}i:318;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-15299";s:4:"slug";s:12:"kingcomposer";s:19:"versionEndExcluding";s:5:"2.9.5";s:11:"description";s:328:"A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base64-encoded JavaScript (in the kc-online-preset-data POST parameter) that is executed in the victim's browser.";s:4:"refs";s:255:"[{"url":"https:\/\/www.wordfence.com\/blog\/2020\/07\/xss-flaw-impacting-100000-sites-patched-in-kingcomposer\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/07\/xss-flaw-impacting-100000-sites-patched-in-kingcomposer\/","refsource":"MISC","tags":[]}]";}i:319;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2016-1209";s:4:"slug";s:11:"Ninja Forms";s:19:"versionEndExcluding";s:8:"2.9.42.1";s:11:"description";s:165:"The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.";s:4:"refs";s:1519:"[{"url":"http:\/\/jvn.jp\/en\/jp\/JVN44657371\/index.html","name":"JVN#44657371","refsource":"JVN","tags":["Vendor Advisory"]},{"url":"http:\/\/jvndb.jvn.jp\/jvndb\/JVNDB-2016-000064","name":"JVNDB-2016-000064","refsource":"JVNDB","tags":["Vendor Advisory"]},{"url":"http:\/\/packetstormsecurity.com\/files\/137211\/WordPress-Ninja-Forms-Unauthenticated-File-Upload.html","name":"http:\/\/packetstormsecurity.com\/files\/137211\/WordPress-Ninja-Forms-Unauthenticated-File-Upload.html","refsource":"MISC","tags":["Exploit"]},{"url":"http:\/\/www.pritect.net\/blog\/ninja-forms-2-9-42-critical-security-vulnerabilities","name":"http:\/\/www.pritect.net\/blog\/ninja-forms-2-9-42-critical-security-vulnerabilities","refsource":"MISC","tags":[]},{"url":"http:\/\/www.rapid7.com\/db\/modules\/exploit\/unix\/webapp\/wp_ninja_forms_unauthenticated_file_upload","name":"http:\/\/www.rapid7.com\/db\/modules\/exploit\/unix\/webapp\/wp_ninja_forms_unauthenticated_file_upload","refsource":"MISC","tags":["Exploit"]},{"url":"https:\/\/ninjaforms.com\/important-security-update-always-hurt-ones-love\/","name":"https:\/\/ninjaforms.com\/important-security-update-always-hurt-ones-love\/","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/ninja-forms\/changelog\/","name":"https:\/\/wordpress.org\/plugins\/ninja-forms\/changelog\/","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8485","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8485","refsource":"MISC","tags":[]}]";}i:320;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-13126";s:4:"slug";s:13:"elementor-pro";s:19:"versionEndExcluding";s:5:"2.9.4";s:11:"description";s:308:"An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve remote code execution. NOTE: the free Elementor plugin is unaffected.";s:4:"refs";s:477:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10214","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10214","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/05\/combined-attack-on-elementor-pro-and-ultimate-addons-for-elementor-puts-1-million-sites-at-risk\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/05\/combined-attack-on-elementor-pro-and-ultimate-addons-for-elementor-puts-1-million-sites-at-risk\/","refsource":"MISC","tags":[]}]";}i:321;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15115";s:4:"slug";s:21:"peters-login-redirect";s:19:"versionEndExcluding";s:5:"2.9.2";s:11:"description";s:69:"The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.";s:4:"refs";s:226:"[{"url":"https:\/\/wordpress.org\/plugins\/peters-login-redirect\/#developers","name":"https:\/\/wordpress.org\/plugins\/peters-login-redirect\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:322;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15116";s:4:"slug";s:22:"easy-digital-downloads";s:19:"versionEndExcluding";s:6:"2.9.16";s:11:"description";s:100:"The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.";s:4:"refs";s:368:"[{"url":"https:\/\/wordpress.org\/plugins\/easy-digital-downloads\/#developers","name":"https:\/\/wordpress.org\/plugins\/easy-digital-downloads\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9334","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9334","refsource":"MISC","tags":[]}]";}i:323;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-15020";s:4:"slug";s:9:"elementor";s:19:"versionEndExcluding";s:6:"2.9.14";s:11:"description";s:160:"An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field.";s:4:"refs";s:407:"[{"url":"http:\/\/hidden-one.co.in\/2020\/07\/07\/cve-2020-1020-stored-xss-on-elementor-wordpress-plugin\/","name":"http:\/\/hidden-one.co.in\/2020\/07\/07\/cve-2020-1020-stored-xss-on-elementor-wordpress-plugin\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/elementor\/#developers","name":"https:\/\/wordpress.org\/plugins\/elementor\/#developers","refsource":"MISC","tags":[]}]";}i:324;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-13865";s:4:"slug";s:9:"elementor";s:19:"versionEndExcluding";s:6:"2.9.10";s:11:"description";s:261:"The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.";s:4:"refs";s:191:"[{"url":"https:\/\/www.softwaresecured.com\/elementor-page-builder-stored-xss\/","name":"https:\/\/www.softwaresecured.com\/elementor-page-builder-stored-xss\/","refsource":"MISC","tags":[]}]";}i:325;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10925";s:4:"slug";s:21:"peters-login-redirect";s:19:"versionEndExcluding";s:5:"2.9.1";s:11:"description";s:104:"The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.";s:4:"refs";s:225:"[{"url":"https:\/\/wordpress.org\/plugins\/peters-login-redirect\/#developers","name":"https:\/\/wordpress.org\/plugins\/peters-login-redirect\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:326;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10925";s:4:"slug";s:21:"peters-login-redirect";s:19:"versionEndExcluding";s:5:"2.9.1";s:11:"description";s:104:"The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.";s:4:"refs";s:225:"[{"url":"https:\/\/wordpress.org\/plugins\/peters-login-redirect\/#developers","name":"https:\/\/wordpress.org\/plugins\/peters-login-redirect\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:327;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-11732";s:4:"slug";s:23:"media-library-assistant";s:19:"versionEndExcluding";s:4:"2.82";s:11:"description";s:140:"The Media Library Assistant plugin before 2.82 for Wordpress suffers from a Local File Inclusion vulnerability in mla_gallery link=download.";s:4:"refs";s:191:"[{"url":"https:\/\/wordpress.org\/plugins\/media-library-assistant\/#developers","name":"https:\/\/wordpress.org\/plugins\/media-library-assistant\/#developers","refsource":"MISC","tags":[]}]";}i:328;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-11928";s:4:"slug";s:23:"media-library-assistant";s:19:"versionEndExcluding";s:4:"2.82";s:11:"description";s:180:"In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gallery via an admin.";s:4:"refs";s:191:"[{"url":"https:\/\/wordpress.org\/plugins\/media-library-assistant\/#developers","name":"https:\/\/wordpress.org\/plugins\/media-library-assistant\/#developers","refsource":"MISC","tags":[]}]";}i:329;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15873";s:4:"slug";s:48:"profilegrid-user-profiles-groups-and-communities";s:19:"versionEndExcluding";s:5:"2.8.6";s:11:"description";s:230:"The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?php substring followed by PHP code.";s:4:"refs";s:451:"[{"url":"https:\/\/wordpress.org\/plugins\/profilegrid-user-profiles-groups-and-communities\/#developers","name":"https:\/\/wordpress.org\/plugins\/profilegrid-user-profiles-groups-and-communities\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9086","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9086","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:330;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-11930";s:4:"slug";s:10:"gtranslate";s:19:"versionEndExcluding";s:6:"2.8.52";s:11:"description";s:184:"The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option.";s:4:"refs";s:537:"[{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2245581\/gtranslate","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2245581\/gtranslate","refsource":"MISC","tags":[]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2245591\/gtranslate","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2245591\/gtranslate","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/gtranslate\/#developers","name":"https:\/\/wordpress.org\/plugins\/gtranslate\/#developers","refsource":"MISC","tags":[]}]";}i:331;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15781";s:4:"slug";s:20:"facebook-by-weblizar";s:19:"versionEndExcluding";s:5:"2.8.5";s:11:"description";s:68:"The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.";s:4:"refs";s:372:"[{"url":"https:\/\/wordpress.org\/plugins\/facebook-by-weblizar\/#developers","name":"https:\/\/wordpress.org\/plugins\/facebook-by-weblizar\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9851","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9851","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:332;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-8426";s:4:"slug";s:9:"elementor";s:19:"versionEndExcluding";s:5:"2.8.5";s:11:"description";s:184:"The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authenticated user.";s:4:"refs";s:347:"[{"url":"https:\/\/blog.impenetrable.tech\/xss-in-wordpress-elementor-plugin","name":"https:\/\/blog.impenetrable.tech\/xss-in-wordpress-elementor-plugin","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/elementor\/#developers","name":"https:\/\/wordpress.org\/plugins\/elementor\/#developers","refsource":"MISC","tags":[]}]";}i:333;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10893";s:4:"slug";s:25:"crayon-syntax-highlighter";s:19:"versionEndExcluding";s:5:"2.8.4";s:11:"description";s:106:"The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.";s:4:"refs";s:210:"[{"url":"https:\/\/wordpress.org\/plugins\/crayon-syntax-highlighter\/#developers","name":"https:\/\/wordpress.org\/plugins\/crayon-syntax-highlighter\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:334;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-7109";s:4:"slug";s:9:"elementor";s:19:"versionEndExcluding";s:5:"2.8.4";s:11:"description";s:118:"The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template.";s:4:"refs";s:163:"[{"url":"https:\/\/wordpress.org\/plugins\/elementor\/#developers","name":"https:\/\/wordpress.org\/plugins\/elementor\/#developers","refsource":"MISC","tags":[]}]";}i:335;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20853";s:4:"slug";s:18:"wysija-newsletters";s:19:"versionEndExcluding";s:5:"2.8.2";s:11:"description";s:153:"An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress. The plugin is vulnerable to SPAM attacks.";s:4:"refs";s:184:"[{"url":"https:\/\/wordpress.org\/plugins\/wysija-newsletters\/#developers","name":"https:\/\/wordpress.org\/plugins\/wysija-newsletters\/#developers","refsource":"CONFIRM","tags":[]}]";}i:336;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-6059";s:4:"slug";s:23:"advanced-access-manager";s:19:"versionEndExcluding";s:5:"2.8.2";s:11:"description";s:99:"WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability";s:4:"refs";s:597:"[{"url":"http:\/\/packetstormsecurity.com\/files\/128137\/WordPress-Advanced-Access-Manager-2.8.2-File-Write-Code-Execution.html","name":"http:\/\/packetstormsecurity.com\/files\/128137\/WordPress-Advanced-Access-Manager-2.8.2-File-Write-Code-Execution.html","refsource":"MISC","tags":[]},{"url":"http:\/\/www.securityfocus.com\/bid\/69549","name":"http:\/\/www.securityfocus.com\/bid\/69549","refsource":"MISC","tags":[]},{"url":"https:\/\/exchange.xforce.ibmcloud.com\/vulnerabilities\/95694","name":"https:\/\/exchange.xforce.ibmcloud.com\/vulnerabilities\/95694","refsource":"MISC","tags":[]}]";}i:337;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-27344";s:4:"slug";s:19:"cm-download-manager";s:19:"versionEndExcluding";s:5:"2.8.0";s:11:"description";s:69:"The cm-download-manager plugin before 2.8.0 for WordPress allows XSS.";s:4:"refs";s:367:"[{"url":"https:\/\/gist.github.com\/qwebee\/da79c6a9fa982c3c40988a1e0598c0d9","name":"https:\/\/gist.github.com\/qwebee\/da79c6a9fa982c3c40988a1e0598c0d9","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/cm-download-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/cm-download-manager\/#developers","refsource":"MISC","tags":[]}]";}i:338;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15322";s:4:"slug";s:17:"shortcode-factory";s:19:"versionEndExcluding";s:3:"2.8";s:11:"description";s:79:"The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.";s:4:"refs";s:194:"[{"url":"https:\/\/wordpress.org\/plugins\/shortcode-factory\/#developers","name":"https:\/\/wordpress.org\/plugins\/shortcode-factory\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:339;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20982";s:4:"slug";s:23:"media-library-assistant";s:19:"versionEndExcluding";s:4:"2.74";s:11:"description";s:151:"The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.";s:4:"refs";s:229:"[{"url":"https:\/\/wordpress.org\/plugins\/media-library-assistant\/#developers","name":"https:\/\/wordpress.org\/plugins\/media-library-assistant\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:340;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18583";s:4:"slug";s:16:"post-pay-counter";s:19:"versionEndExcluding";s:5:"2.731";s:11:"description";s:80:"The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.";s:4:"refs";s:192:"[{"url":"https:\/\/wordpress.org\/plugins\/post-pay-counter\/#developers","name":"https:\/\/wordpress.org\/plugins\/post-pay-counter\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:341;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18584";s:4:"slug";s:16:"post-pay-counter";s:19:"versionEndExcluding";s:5:"2.731";s:11:"description";s:110:"The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.";s:4:"refs";s:192:"[{"url":"https:\/\/wordpress.org\/plugins\/post-pay-counter\/#developers","name":"https:\/\/wordpress.org\/plugins\/post-pay-counter\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:342;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10936";s:4:"slug";s:8:"wp-polls";s:19:"versionEndExcluding";s:6:"2.73.1";s:11:"description";s:80:"The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.";s:4:"refs";s:176:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-polls\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-polls\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:343;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10936";s:4:"slug";s:8:"wp-polls";s:19:"versionEndExcluding";s:6:"2.73.1";s:11:"description";s:80:"The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.";s:4:"refs";s:176:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-polls\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-polls\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:344;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9352";s:4:"slug";s:8:"wp-polls";s:19:"versionEndExcluding";s:4:"2.72";s:11:"description";s:64:"The wp-polls plugin before 2.72 for WordPress has SQL injection.";s:4:"refs";s:176:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-polls\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-polls\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:345;O:8:"stdClass":5:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:20:"fast-velocity-minify";s:19:"versionEndExcluding";s:5:"2.7.7";s:11:"description";s:181:"Medium Severity Vulnerability Patched in Fast Velocity Minify Plugin.

https://www.wordfence.com/blog/2019/10/medium-severity-vulnerability-patched-in-fast-velocity-minify-plugin/";s:4:"refs";s:0:"";}i:346;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19983";s:4:"slug";s:20:"fast-velocity-minify";s:19:"versionEndExcluding";s:5:"2.7.7";s:11:"description";s:288:"In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit this vulnerability, FVM Debug Mode needs to be enabled and an admin-ajax request needs to call the fastvelocity_min_files action.";s:4:"refs";s:421:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9914","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9914","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2019\/10\/medium-severity-vulnerability-patched-in-fast-velocity-minify-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2019\/10\/medium-severity-vulnerability-patched-in-fast-velocity-minify-plugin\/","refsource":"MISC","tags":[]}]";}i:347;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10929";s:4:"slug";s:25:"advanced-ajax-page-loader";s:19:"versionEndExcluding";s:5:"2.7.7";s:11:"description";s:139:"The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.";s:4:"refs";s:210:"[{"url":"https:\/\/wordpress.org\/plugins\/advanced-ajax-page-loader\/#developers","name":"https:\/\/wordpress.org\/plugins\/advanced-ajax-page-loader\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:348;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10929";s:4:"slug";s:25:"advanced-ajax-page-loader";s:19:"versionEndExcluding";s:5:"2.7.7";s:11:"description";s:139:"The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.";s:4:"refs";s:210:"[{"url":"https:\/\/wordpress.org\/plugins\/advanced-ajax-page-loader\/#developers","name":"https:\/\/wordpress.org\/plugins\/advanced-ajax-page-loader\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:349;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9910";s:4:"slug";s:12:"kingcomposer";s:19:"versionEndExcluding";s:5:"2.7.7";s:11:"description";s:89:"The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS.";s:4:"refs";s:673:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2019\/Mar\/39","name":"20190322 Re: KingComposer 2.7.6 - Reflected XSS (WordPress Plugin)","refsource":"FULLDISC","tags":["Mailing List","Third Party Advisory"]},{"url":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/11","name":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/11","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-kingcomposer-xss\/","name":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-kingcomposer-xss\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:350;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-15079";s:4:"slug";s:40:"Smush Image Compression and Optimization";s:19:"versionEndExcluding";s:5:"2.7.6";s:11:"description";s:106:"The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.";s:4:"refs";s:451:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-smushit\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-smushit\/#developers","refsource":"CONFIRM","tags":["Issue Tracking","Product","Release Notes","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/support\/topic\/file-transversal-bug\/","name":"https:\/\/wordpress.org\/support\/topic\/file-transversal-bug\/","refsource":"CONFIRM","tags":["Issue Tracking","Third Party Advisory"]}]";}i:351;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15320";s:4:"slug";s:11:"option-tree";s:19:"versionEndExcluding";s:5:"2.7.3";s:11:"description";s:109:"The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.";s:4:"refs";s:344:"[{"url":"https:\/\/wordpress.org\/plugins\/option-tree\/#developers","name":"https:\/\/wordpress.org\/plugins\/option-tree\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9600","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9600","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:352;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15321";s:4:"slug";s:11:"option-tree";s:19:"versionEndExcluding";s:5:"2.7.3";s:11:"description";s:113:"The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.";s:4:"refs";s:344:"[{"url":"https:\/\/wordpress.org\/plugins\/option-tree\/#developers","name":"https:\/\/wordpress.org\/plugins\/option-tree\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9600","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9600","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:353;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-8334";s:4:"slug";s:35:"WP-DBManager (aka Database Manager)";s:19:"versionEndExcluding";s:5:"2.7.2";s:11:"description";s:265:"The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) $backup['filepath'] (aka "Path to Backup:" field) or (2) $backup['mysqldumppath'] variable.";s:4:"refs";s:1783:"[{"url":"http:\/\/osvdb.org\/show\/osvdb\/113508","name":"113508","refsource":"OSVDB","tags":[]},{"url":"http:\/\/packetstormsecurity.com\/files\/128785\/WordPress-Database-Manager-2.7.1-Command-Injection-Credential-Leak.html","name":"http:\/\/packetstormsecurity.com\/files\/128785\/WordPress-Database-Manager-2.7.1-Command-Injection-Credential-Leak.html","refsource":"MISC","tags":["Exploit"]},{"url":"http:\/\/seclists.org\/fulldisclosure\/2014\/Oct\/99","name":"20141022 Vulnerabilities in WordPress Database Manager v2.7.1","refsource":"FULLDISC","tags":["Exploit"]},{"url":"http:\/\/seclists.org\/oss-sec\/2014\/q4\/365","name":"[oss-security] 20141016 Vulnerabilities in WordPress Database Manager v2.7.1","refsource":"MLIST","tags":["Exploit"]},{"url":"http:\/\/seclists.org\/oss-sec\/2014\/q4\/410","name":"[oss-security] 20141020 Re: Vulnerabilities in WordPress Database Manager v2.7.1","refsource":"MLIST","tags":["Exploit"]},{"url":"http:\/\/www.securityfocus.com\/archive\/1\/533763\/100\/0\/threaded","name":"20141021 Vulnerabilities in WordPress Database Manager v2.7.1","refsource":"BUGTRAQ","tags":[]},{"url":"http:\/\/www.securityfocus.com\/bid\/70626","name":"70626","refsource":"BID","tags":[]},{"url":"http:\/\/www.vapid.dhs.org\/advisories\/wordpress\/plugins\/wp-dbmanager-2.7.1\/index.html","name":"http:\/\/www.vapid.dhs.org\/advisories\/wordpress\/plugins\/wp-dbmanager-2.7.1\/index.html","refsource":"MISC","tags":["Exploit"]},{"url":"https:\/\/exchange.xforce.ibmcloud.com\/vulnerabilities\/97689","name":"dbmgr-wp-cve20148334-command-exec(97689)","refsource":"XF","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/wp-dbmanager\/changelog\/","name":"https:\/\/wordpress.org\/plugins\/wp-dbmanager\/changelog\/","refsource":"CONFIRM","tags":["Patch"]}]";}i:354;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-8336";s:4:"slug";s:60:""Sql Run Query" panel in WP-DBManager (aka Database Manager)";s:19:"versionEndExcluding";s:5:"2.7.2";s:11:"description";s:259:"The "Sql Run Query" panel in WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote attackers to read arbitrary files by leveraging failure to sufficiently limit queries, as demonstrated by use of LOAD_FILE in an INSERT statement.";s:4:"refs";s:1213:"[{"url":"http:\/\/www.openwall.com\/lists\/oss-security\/2014\/10\/21\/3","name":"[oss-security] 20141021 Re: Vulnerabilities in WordPress Database Manager v2.7.1","refsource":"MLIST","tags":["Issue Tracking","Mailing List","Patch","Third Party Advisory"]},{"url":"http:\/\/www.vapid.dhs.org\/advisories\/wordpress\/plugins\/wp-dbmanager-2.7.1\/index.html","name":"http:\/\/www.vapid.dhs.org\/advisories\/wordpress\/plugins\/wp-dbmanager-2.7.1\/index.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/exchange.xforce.ibmcloud.com\/vulnerabilities\/97694","name":"dbmgr-wordpress-cve20148336-file-download(97694)","refsource":"XF","tags":["Issue Tracking","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/github.com\/lesterchan\/wp-dbmanager\/commit\/7037fa8f61644098044379190d1d4bf1883b8e4a","name":"https:\/\/github.com\/lesterchan\/wp-dbmanager\/commit\/7037fa8f61644098044379190d1d4bf1883b8e4a","refsource":"CONFIRM","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-dbmanager\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-dbmanager\/#developers","refsource":"CONFIRM","tags":["Third Party Advisory"]}]";}i:355;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-13892";s:4:"slug";s:11:"sportspress";s:19:"versionEndExcluding";s:5:"2.7.2";s:11:"description";s:61:"The SportsPress plugin before 2.7.2 for WordPress allows XSS.";s:4:"refs";s:143:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10257","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10257","refsource":"MISC","tags":[]}]";}i:356;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9339";s:4:"slug";s:14:"wp-file-upload";s:19:"versionEndExcluding";s:5:"2.7.1";s:11:"description";s:106:"The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-file-upload\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-file-upload\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:357;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15319";s:4:"slug";s:18:"option-tree plugin";s:19:"versionEndExcluding";s:5:"2.7.0";s:11:"description";s:99:"The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.";s:4:"refs";s:344:"[{"url":"https:\/\/wordpress.org\/plugins\/option-tree\/#developers","name":"https:\/\/wordpress.org\/plugins\/option-tree\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9599","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9599","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:358;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10990";s:4:"slug";s:9:"wp-cerber";s:19:"versionEndExcluding";s:3:"2.7";s:11:"description";s:90:"The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.";s:4:"refs";s:350:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-cerber\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-cerber\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8430","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8430","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:359;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10990";s:4:"slug";s:9:"wp-cerber";s:19:"versionEndExcluding";s:3:"2.7";s:11:"description";s:90:"The wp-cerber plugin before 2.7 for WordPress has XSS via the X-Forwarded-For HTTP header.";s:4:"refs";s:350:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-cerber\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-cerber\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8430","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8430","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:360;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-9177";s:4:"slug";s:35:"HTML5 MP3 Player with Playlist Free";s:19:"versionEndExcluding";s:3:"2.7";s:11:"description";s:168:"The HTML5 MP3 Player with Playlist Free plugin before 2.7 for WordPress allows remote attackers to obtain the installation path via a request to html5plus/playlist.php.";s:4:"refs";s:870:"[{"url":"http:\/\/h4x0resec.blogspot.com\/2014\/11\/wordpress-html5-mp3-player-with.html","name":"http:\/\/h4x0resec.blogspot.com\/2014\/11\/wordpress-html5-mp3-player-with.html","refsource":"MISC","tags":["Exploit"]},{"url":"http:\/\/packetstormsecurity.com\/files\/129286\/WordPress-Html5-Mp3-Player-Full-Path-Disclosure.html","name":"http:\/\/packetstormsecurity.com\/files\/129286\/WordPress-Html5-Mp3-Player-Full-Path-Disclosure.html","refsource":"MISC","tags":["Exploit"]},{"url":"https:\/\/exchange.xforce.ibmcloud.com\/vulnerabilities\/98988","name":"html5mp3player-wp-playlist-path-disclosure(98988)","refsource":"XF","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/html5-mp3-player-with-playlist\/changelog\/","name":"https:\/\/wordpress.org\/plugins\/html5-mp3-player-with-playlist\/changelog\/","refsource":"CONFIRM","tags":["Patch","Vendor Advisory"]}]";}i:361;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-6780";s:4:"slug";s:9:"wise-chat";s:19:"versionEndExcluding";s:3:"2.7";s:11:"description";s:161:"The Wise Chat plugin before 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noopener and noreferrer.";s:4:"refs";s:689:"[{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2016929\/wise-chat\/trunk\/src\/rendering\/filters\/post\/WiseChatLinksPostFilter.php","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2016929\/wise-chat\/trunk\/src\/rendering\/filters\/post\/WiseChatLinksPostFilter.php","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wise-chat\/#developers","name":"https:\/\/wordpress.org\/plugins\/wise-chat\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/www.exploit-db.com\/exploits\/46247\/","name":"46247","refsource":"EXPLOIT-DB","tags":["Exploit","Third Party Advisory"]}]";}i:362;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9454";s:4:"slug";s:13:"smooth-slider";s:19:"versionEndExcluding";s:3:"2.7";s:11:"description";s:148:"The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.";s:4:"refs";s:614:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_36e814da6ac4dd903be2c77cfbdd0afd.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_36e814da6ac4dd903be2c77cfbdd0afd.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/smooth-slider\/#developers","name":"https:\/\/wordpress.org\/plugins\/smooth-slider\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8284","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8284","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:363;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-4725";s:4:"slug";s:18:"wysija-newsletters";s:19:"versionEndExcluding";s:5:"2.6.7";s:11:"description";s:286:"The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.";s:4:"refs";s:1475:"[{"url":"http:\/\/arstechnica.com\/security\/2014\/07\/mass-exploit-of-wordpress-plugin-backdoors-sites-running-joomla-magento-too\/","name":"http:\/\/arstechnica.com\/security\/2014\/07\/mass-exploit-of-wordpress-plugin-backdoors-sites-running-joomla-magento-too\/","refsource":"MISC","tags":[]},{"url":"http:\/\/blog.sucuri.net\/2014\/07\/mailpoet-vulnerability-exploited-in-the-wild-breaking-thousands-of-wordpress-sites.html","name":"http:\/\/blog.sucuri.net\/2014\/07\/mailpoet-vulnerability-exploited-in-the-wild-breaking-thousands-of-wordpress-sites.html","refsource":"MISC","tags":["Exploit"]},{"url":"http:\/\/blog.sucuri.net\/2014\/07\/malware-infection-breaking-wordpress-sites.html","name":"http:\/\/blog.sucuri.net\/2014\/07\/malware-infection-breaking-wordpress-sites.html","refsource":"MISC","tags":[]},{"url":"http:\/\/blog.sucuri.net\/2014\/07\/remote-file-upload-vulnerability-on-mailpoet-wysija-newsletters.html","name":"http:\/\/blog.sucuri.net\/2014\/07\/remote-file-upload-vulnerability-on-mailpoet-wysija-newsletters.html","refsource":"MISC","tags":[]},{"url":"http:\/\/www.openwall.com\/lists\/oss-security\/2014\/07\/08\/7","name":"[oss-security] 20140708 Re: CVE request: WordPress plugin wysija-newsletters remote file upload","refsource":"MLIST","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/wysija-newsletters\/changelog\/","name":"https:\/\/wordpress.org\/plugins\/wysija-newsletters\/changelog\/","refsource":"CONFIRM","tags":["Patch"]}]";}i:364;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15868";s:4:"slug";s:18:"affiliates-manager";s:19:"versionEndExcluding";s:5:"2.6.6";s:11:"description";s:66:"The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.";s:4:"refs";s:384:"[{"url":"https:\/\/wordpress.org\/plugins\/affiliates-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/affiliates-manager\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9335","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9335","refsource":"MISC","tags":["Patch","Third Party Advisory"]}]";}i:365;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18524";s:4:"slug";s:13:"football-pool";s:19:"versionEndExcluding";s:5:"2.6.5";s:11:"description";s:76:"The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.";s:4:"refs";s:186:"[{"url":"https:\/\/wordpress.org\/plugins\/football-pool\/#developers","name":"https:\/\/wordpress.org\/plugins\/football-pool\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:366;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-13487";s:4:"slug";s:7:"bbpress";s:19:"versionEndExcluding";s:5:"2.6.5";s:11:"description";s:283:"The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI.";s:4:"refs";s:525:"[{"url":"https:\/\/bbpress.org\/","name":"https:\/\/bbpress.org\/","refsource":"MISC","tags":[]},{"url":"https:\/\/codex.bbpress.org\/releases\/","name":"https:\/\/codex.bbpress.org\/releases\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/bbpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/bbpress\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.youtube.com\/watch?v=3rXP8CGTe08","name":"https:\/\/www.youtube.com\/watch?v=3rXP8CGTe08","refsource":"MISC","tags":[]}]";}i:367;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-13693";s:4:"slug";s:7:"bbpress";s:19:"versionEndExcluding";s:5:"2.6.5";s:11:"description";s:140:"An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.";s:4:"refs";s:459:"[{"url":"https:\/\/bbpress.org\/blog\/2020\/05\/bbpress-2-6-5-is-out\/","name":"https:\/\/bbpress.org\/blog\/2020\/05\/bbpress-2-6-5-is-out\/","refsource":"MISC","tags":[]},{"url":"https:\/\/codex.bbpress.org\/releases\/","name":"https:\/\/codex.bbpress.org\/releases\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/bbpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/bbpress\/#developers","refsource":"MISC","tags":[]}]";}i:368;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15769";s:4:"slug";s:17:"handl-utm-grabber";s:19:"versionEndExcluding";s:5:"2.6.5";s:11:"description";s:98:"The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.";s:4:"refs";s:714:"[{"url":"https:\/\/wordpress.org\/plugins\/handl-utm-grabber\/#developers","name":"https:\/\/wordpress.org\/plugins\/handl-utm-grabber\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9848","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9848","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2019\/08\/26\/our-proactive-monitoring-caught-an-authenticated-option-update-vulnerability-in-handl-utm-grabber\/","name":"https:\/\/www.pluginvulnerabilities.com\/2019\/08\/26\/our-proactive-monitoring-caught-an-authenticated-option-update-vulnerability-in-handl-utm-grabber\/","refsource":"MISC","tags":[]}]";}i:369;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-11512";s:4:"slug";s:19:"idx-broker-platinum";s:19:"versionEndExcluding";s:5:"2.6.2";s:11:"description";s:446:"Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrary JavaScript in the plugin's settings panel via the idx_update_recaptcha_key AJAX action and a crafted idx_recaptcha_site_key parameter, which would then be executed in the browser of any administrator visiting the panel. This could be used to create new administrator-level accounts.";s:4:"refs";s:425:"[{"url":"https:\/\/wordpress.org\/plugins\/idx-broker-platinum\/#developers","name":"https:\/\/wordpress.org\/plugins\/idx-broker-platinum\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/03\/vulnerabilities-patched-in-impress-for-idx-broker\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/03\/vulnerabilities-patched-in-impress-for-idx-broker\/","refsource":"MISC","tags":[]}]";}i:370;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-9514";s:4:"slug";s:19:"idx-broker-platinum";s:19:"versionEndExcluding";s:5:"2.6.2";s:11:"description";s:346:"An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. wrappers.php allows a logged-in user (with the Subscriber role) to permanently delete arbitrary posts and pages, create new posts with arbitrary subjects, and modify the subjects of existing posts and pages (via create_dynamic_page and delete_dynamic_page).";s:4:"refs";s:425:"[{"url":"https:\/\/wordpress.org\/plugins\/idx-broker-platinum\/#developers","name":"https:\/\/wordpress.org\/plugins\/idx-broker-platinum\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/03\/vulnerabilities-patched-in-impress-for-idx-broker\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/03\/vulnerabilities-patched-in-impress-for-idx-broker\/","refsource":"MISC","tags":[]}]";}i:371;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10881";s:4:"slug";s:24:"google-document-embedder";s:19:"versionEndExcluding";s:5:"2.6.2";s:11:"description";s:71:"The google-document-embedder plugin before 2.6.2 for WordPress has XSS.";s:4:"refs";s:231:"[{"url":"https:\/\/wordpress.org\/plugins\/google-document-embedder\/#developers","name":"https:\/\/wordpress.org\/plugins\/google-document-embedder\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:372;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10882";s:4:"slug";s:24:"google-document-embedder";s:19:"versionEndExcluding";s:5:"2.6.2";s:11:"description";s:72:"The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.";s:4:"refs";s:231:"[{"url":"https:\/\/wordpress.org\/plugins\/google-document-embedder\/#developers","name":"https:\/\/wordpress.org\/plugins\/google-document-embedder\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:373;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10880";s:4:"slug";s:24:"google-document-embedder";s:19:"versionEndExcluding";s:5:"2.6.1";s:11:"description";s:71:"The google-document-embedder plugin before 2.6.1 for WordPress has XSS.";s:4:"refs";s:231:"[{"url":"https:\/\/wordpress.org\/plugins\/google-document-embedder\/#developers","name":"https:\/\/wordpress.org\/plugins\/google-document-embedder\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:374;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9409";s:4:"slug";s:12:"alo-easymail";s:19:"versionEndExcluding";s:6:"2.6.01";s:11:"description";s:120:"The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.";s:4:"refs";s:557:"[{"url":"https:\/\/packetstormsecurity.com\/files\/133594\/","name":"https:\/\/packetstormsecurity.com\/files\/133594\/","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/alo-easymail\/#developers","name":"https:\/\/wordpress.org\/plugins\/alo-easymail\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8190","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8190","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:375;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10988";s:4:"slug";s:7:"leenkme";s:19:"versionEndExcluding";s:5:"2.6.0";s:11:"description";s:177:"The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, or _wp_http_referer.";s:4:"refs";s:561:"[{"url":"https:\/\/wordpress.org\/plugins\/leenkme\/#developers","name":"https:\/\/wordpress.org\/plugins\/leenkme\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8457","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8457","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/04\/16\/4","name":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/04\/16\/4","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]}]";}i:376;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10988";s:4:"slug";s:7:"leenkme";s:19:"versionEndExcluding";s:5:"2.6.0";s:11:"description";s:177:"The leenkme plugin before 2.6.0 for WordPress has stored XSS via facebook_message, facebook_linkname, facebook_caption, facebook_description, default_image, or _wp_http_referer.";s:4:"refs";s:561:"[{"url":"https:\/\/wordpress.org\/plugins\/leenkme\/#developers","name":"https:\/\/wordpress.org\/plugins\/leenkme\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8457","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8457","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/04\/16\/4","name":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/04\/16\/4","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]}]";}i:377;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10989";s:4:"slug";s:7:"leenkme";s:19:"versionEndExcluding";s:5:"2.6.0";s:11:"description";s:96:"The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF.";s:4:"refs";s:561:"[{"url":"https:\/\/wordpress.org\/plugins\/leenkme\/#developers","name":"https:\/\/wordpress.org\/plugins\/leenkme\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8457","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8457","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/04\/16\/4","name":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/04\/16\/4","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]}]";}i:378;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10989";s:4:"slug";s:7:"leenkme";s:19:"versionEndExcluding";s:5:"2.6.0";s:11:"description";s:96:"The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkme_facebook CSRF.";s:4:"refs";s:561:"[{"url":"https:\/\/wordpress.org\/plugins\/leenkme\/#developers","name":"https:\/\/wordpress.org\/plugins\/leenkme\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8457","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8457","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/04\/16\/4","name":"https:\/\/www.openwall.com\/lists\/oss-security\/2016\/04\/16\/4","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]}]";}i:379;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10895";s:4:"slug";s:11:"option-tree";s:19:"versionEndExcluding";s:5:"2.6.0";s:11:"description";s:112:"The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.";s:4:"refs";s:182:"[{"url":"https:\/\/wordpress.org\/plugins\/option-tree\/#developers","name":"https:\/\/wordpress.org\/plugins\/option-tree\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:380;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10895";s:4:"slug";s:11:"option-tree";s:19:"versionEndExcluding";s:5:"2.6.0";s:11:"description";s:112:"The option-tree plugin before 2.6.0 for WordPress has XSS via an add_list_item or add_social_links AJAX request.";s:4:"refs";s:182:"[{"url":"https:\/\/wordpress.org\/plugins\/option-tree\/#developers","name":"https:\/\/wordpress.org\/plugins\/option-tree\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:381;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10378";s:4:"slug";s:14:"duplicate-post";s:19:"versionEndExcluding";s:3:"2.6";s:11:"description";s:59:"The duplicate-post plugin before 2.6 for WordPress has XSS.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/duplicate-post\/#developers","name":"https:\/\/wordpress.org\/plugins\/duplicate-post\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:382;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10379";s:4:"slug";s:14:"duplicate-post";s:19:"versionEndExcluding";s:3:"2.6";s:11:"description";s:69:"The duplicate-post plugin before 2.6 for WordPress has SQL injection.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/duplicate-post\/#developers","name":"https:\/\/wordpress.org\/plugins\/duplicate-post\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:383;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10904";s:4:"slug";s:10:"olimometer";s:19:"versionEndExcluding";s:4:"2.57";s:11:"description";s:66:"The olimometer plugin before 2.57 for WordPress has SQL injection.";s:4:"refs";s:180:"[{"url":"https:\/\/wordpress.org\/plugins\/olimometer\/#developers","name":"https:\/\/wordpress.org\/plugins\/olimometer\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:384;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10904";s:4:"slug";s:10:"olimometer";s:19:"versionEndExcluding";s:4:"2.57";s:11:"description";s:66:"The olimometer plugin before 2.57 for WordPress has SQL injection.";s:4:"refs";s:180:"[{"url":"https:\/\/wordpress.org\/plugins\/olimometer\/#developers","name":"https:\/\/wordpress.org\/plugins\/olimometer\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:385;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18505";s:4:"slug";s:14:"twitter-plugin";s:19:"versionEndExcluding";s:4:"2.55";s:11:"description";s:60:"The twitter-plugin plugin before 2.55 for WordPress has XSS.";s:4:"refs";s:206:"[{"url":"https:\/\/wordpress.org\/plugins\/twitter-plugin\/#developers","name":"https:\/\/wordpress.org\/plugins\/twitter-plugin\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:386;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-12675";s:4:"slug";s:35:"mappress-google-maps-for-wordpress ";s:19:"versionEndExcluding";s:6:"2.54.6";s:11:"description";s:308:"The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/retrieval/deletion of PHP template files, leading to Remote Code Execution. NOTE: this issue exists because of an incomplete fix for CVE-2020-12077.";s:4:"refs";s:578:"[{"url":"https:\/\/blog.alertlogic.com\/alert-logic-threat-research-team-identifies-new-vulnerability-cve-2020-12675-in-mappress-plugin-for-wordpress\/","name":"https:\/\/blog.alertlogic.com\/alert-logic-threat-research-team-identifies-new-vulnerability-cve-2020-12675-in-mappress-plugin-for-wordpress\/","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/mappress-google-maps-for-wordpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/mappress-google-maps-for-wordpress\/#developers","refsource":"MISC","tags":["Product"]}]";}i:387;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-12077";s:4:"slug";s:34:"mappress-google-maps-for-wordpress";s:19:"versionEndExcluding";s:6:"2.53.9";s:11:"description";s:130:"The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces.";s:4:"refs";s:213:"[{"url":"https:\/\/wordpress.org\/plugins\/mappress-google-maps-for-wordpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/mappress-google-maps-for-wordpress\/#developers","refsource":"MISC","tags":[]}]";}i:388;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-20360";s:4:"slug";s:4:"give";s:19:"versionEndExcluding";s:5:"2.5.5";s:11:"description";s:482:"A flaw in Give before 2.5.5, a WordPress plugin, allowed unauthenticated users to bypass API authentication methods and access personally identifiable user information (PII) including names, addresses, IP addresses, and email addresses. Once an API key has been set to any meta key value from the wp_usermeta table, and the token is set to the corresponding MD5 hash of the meta key selected, one can make a request to the restricted endpoints, and thus access sensitive donor data.";s:4:"refs";s:389:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9889","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9889","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2019\/09\/authentication-bypass-vulnerability-in-givewp-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2019\/09\/authentication-bypass-vulnerability-in-givewp-plugin\/","refsource":"MISC","tags":[]}]";}i:389;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9320";s:4:"slug";s:11:"option-tree";s:19:"versionEndExcluding";s:5:"2.5.4";s:11:"description";s:83:"The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.";s:4:"refs";s:322:"[{"url":"https:\/\/wordpress.org\/plugins\/option-tree\/#developers","name":"https:\/\/wordpress.org\/plugins\/option-tree\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9769","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9769","refsource":"MISC","tags":[]}]";}i:390;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-11871";s:4:"slug";s:18:"Custom Field Suite";s:19:"versionEndExcluding";s:6:"2.5.15";s:11:"description";s:88:"The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins.";s:4:"refs";s:633:"[{"url":"https:\/\/blog.reddy.io\/2019\/05\/30\/xss-injection-vulnerability-in-custom-field-suite-wordpress-plugin\/","name":"https:\/\/blog.reddy.io\/2019\/05\/30\/xss-injection-vulnerability-in-custom-field-suite-wordpress-plugin\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/custom-field-suite\/#developers","name":"https:\/\/wordpress.org\/plugins\/custom-field-suite\/#developers","refsource":"MISC","tags":["Product","Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9273","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9273","refsource":"MISC","tags":[]}]";}i:391;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9338";s:4:"slug";s:14:"wp-file-upload";s:19:"versionEndExcluding";s:5:"2.5.0";s:11:"description";s:107:"The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-file-upload\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-file-upload\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:392;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18503";s:4:"slug";s:18:"twitter-cards-meta";s:19:"versionEndExcluding";s:5:"2.5.0";s:11:"description";s:65:"The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.";s:4:"refs";s:214:"[{"url":"https:\/\/wordpress.org\/plugins\/twitter-cards-meta\/#developers","name":"https:\/\/wordpress.org\/plugins\/twitter-cards-meta\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:393;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18504";s:4:"slug";s:18:"twitter-cards-meta";s:19:"versionEndExcluding";s:5:"2.5.0";s:11:"description";s:66:"The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.";s:4:"refs";s:214:"[{"url":"https:\/\/wordpress.org\/plugins\/twitter-cards-meta\/#developers","name":"https:\/\/wordpress.org\/plugins\/twitter-cards-meta\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:394;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15774";s:4:"slug";s:10:"nd-booking";s:19:"versionEndExcluding";s:3:"2.5";s:11:"description";s:121:"The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.";s:4:"refs";s:637:"[{"url":"https:\/\/threatpost.com\/wordpress-plugins-exploited-in-ongoing-attack-researchers-warn\/147671\/","name":"https:\/\/threatpost.com\/wordpress-plugins-exploited-in-ongoing-attack-researchers-warn\/147671\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/nd-booking\/#developers","name":"https:\/\/wordpress.org\/plugins\/nd-booking\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9494","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9494","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:395;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19915";s:4:"slug";s:17:"eps-301-redirects";s:19:"versionEndExcluding";s:4:"2.45";s:11:"description";s:424:"The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater access) to modify, delete, or inject redirect rules, and exploit XSS, with the /admin-ajax.php?action=eps_redirect_save and /admin-ajax.php?action=eps_redirect_delete actions. This could result in a loss of site availability, malicious redirects, and user infections. This could also be exploited via CSRF.";s:4:"refs";s:423:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9979","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9979","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2019\/12\/critical-vulnerability-patched-in-301-redirects-easy-redirect-manager\/","name":"https:\/\/www.wordfence.com\/blog\/2019\/12\/critical-vulnerability-patched-in-301-redirects-easy-redirect-manager\/","refsource":"MISC","tags":[]}]";}i:396;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-8549";s:4:"slug";s:19:"strong-testimonials";s:19:"versionEndExcluding";s:6:"2.40.1";s:11:"description";s:160:"Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious actions such as stealing session tokens.";s:4:"refs";s:873:"[{"url":"https:\/\/github.com\/MachoThemes\/strong-testimonials\/blob\/master\/changelog.txt","name":"https:\/\/github.com\/MachoThemes\/strong-testimonials\/blob\/master\/changelog.txt","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10056","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10056","refsource":"MISC","tags":[]},{"url":"https:\/\/www.getastra.com\/blog\/911\/plugin-exploit\/stored-xss-vulnerability-found-in-strong-testimonials-plugin\/","name":"https:\/\/www.getastra.com\/blog\/911\/plugin-exploit\/stored-xss-vulnerability-found-in-strong-testimonials-plugin\/","refsource":"MISC","tags":[]},{"url":"https:\/\/www.jinsonvarghese.com\/stored-xss-vulnerability-in-strong-testimonials-plugin\/","name":"https:\/\/www.jinsonvarghese.com\/stored-xss-vulnerability-in-strong-testimonials-plugin\/","refsource":"MISC","tags":[]}]";}i:397;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-13764";s:4:"slug";s:12:"gravityforms";s:19:"versionEndExcluding";s:5:"2.4.9";s:11:"description";s:184:"common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.";s:4:"refs";s:357:"[{"url":"https:\/\/docs.gravityforms.com\/gravityforms-change-log\/","name":"https:\/\/docs.gravityforms.com\/gravityforms-change-log\/","refsource":"MISC","tags":[]},{"url":"https:\/\/github.com\/wp-premium\/gravityforms\/compare\/2.4.8...2.4.9","name":"https:\/\/github.com\/wp-premium\/gravityforms\/compare\/2.4.8...2.4.9","refsource":"MISC","tags":[]}]";}i:398;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15779";s:4:"slug";s:13:"insta-gallery";s:19:"versionEndExcluding";s:5:"2.4.8";s:11:"description";s:127:"The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete.";s:4:"refs";s:358:"[{"url":"https:\/\/wordpress.org\/plugins\/insta-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/insta-gallery\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9853","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9853","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:399;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15317";s:4:"slug";s:4:"give";s:19:"versionEndExcluding";s:5:"2.4.7";s:11:"description";s:68:"The give plugin before 2.4.7 for WordPress has XSS via a donor name.";s:4:"refs";s:582:"[{"url":"https:\/\/blog.sucuri.net\/2019\/05\/wordpress-plugin-give-stored-xss-for-donors.html","name":"https:\/\/blog.sucuri.net\/2019\/05\/wordpress-plugin-give-stored-xss-for-donors.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/give\/#developers","name":"https:\/\/wordpress.org\/plugins\/give\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9584","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9584","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:400;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18498";s:4:"slug";s:16:"simple-job-board";s:19:"versionEndExcluding";s:5:"2.4.4";s:11:"description";s:92:"The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.";s:4:"refs";s:199:"[{"url":"https:\/\/wordpress.org\/plugins\/simple-job-board\/#developers","name":"https:\/\/wordpress.org\/plugins\/simple-job-board\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:401;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15324";s:4:"slug";s:11:"ad-inserter";s:19:"versionEndExcluding";s:6:"2.4.22";s:11:"description";s:77:"The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.";s:4:"refs";s:362:"[{"url":"https:\/\/wordpress.org\/plugins\/ad-inserter\/#developers","name":"https:\/\/wordpress.org\/plugins\/ad-inserter\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9455","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9455","refsource":"MISC","tags":["Exploit","Patch","Third Party Advisory"]}]";}i:402;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15323";s:4:"slug";s:11:"ad-inserter";s:19:"versionEndExcluding";s:6:"2.4.20";s:11:"description";s:70:"The ad-inserter plugin before 2.4.20 for WordPress has path traversal.";s:4:"refs";s:322:"[{"url":"https:\/\/wordpress.org\/plugins\/ad-inserter\/#developers","name":"https:\/\/wordpress.org\/plugins\/ad-inserter\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9453","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9453","refsource":"MISC","tags":[]}]";}i:403;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-6112";s:4:"slug";s:10:"sell-media";s:19:"versionEndExcluding";s:5:"2.4.2";s:11:"description";s:242:"A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field).";s:4:"refs";s:630:"[{"url":"https:\/\/github.com\/graphpaperpress\/Sell-Media\/commit\/8ac8cebf332e0885863d0a25e16b4b180abedc47#diff-f16fea0a0c8cc36031ec339d02a4fb3b","name":"https:\/\/github.com\/graphpaperpress\/Sell-Media\/commit\/8ac8cebf332e0885863d0a25e16b4b180abedc47#diff-f16fea0a0c8cc36031ec339d02a4fb3b","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/metamorfosec.com\/Files\/Advisories\/METS-2020-001-A_XSS_Vulnerability_in_Sell_Media_Plugin_v2.4.1_for_WordPress.txt","name":"https:\/\/metamorfosec.com\/Files\/Advisories\/METS-2020-001-A_XSS_Vulnerability_in_Sell_Media_Plugin_v2.4.1_for_WordPress.txt","refsource":"MISC","tags":[]}]";}i:404;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10911";s:4:"slug";s:15:"profile-builder";s:19:"versionEndExcluding";s:5:"2.4.2";s:11:"description";s:78:"The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/profile-builder\/#developers","name":"https:\/\/wordpress.org\/plugins\/profile-builder\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:405;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-9014";s:4:"slug";s:13:"wpmarketplace";s:19:"versionEndExcluding";s:5:"2.4.1";s:11:"description";s:249:"Directory traversal vulnerability in the ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin before 2.4.1 for WordPress allows remote authenticated users to download arbitrary files via a .. (dot dot) in the file parameter.";s:4:"refs";s:349:"[{"url":"https:\/\/security.szurek.pl\/wp-marketplace-240-arbitrary-file-download.html","name":"https:\/\/security.szurek.pl\/wp-marketplace-240-arbitrary-file-download.html","refsource":"MISC","tags":[]},{"url":"https:\/\/www.exploit-db.com\/exploits\/36466\/","name":"https:\/\/www.exploit-db.com\/exploits\/36466\/","refsource":"MISC","tags":[]}]";}i:406;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10946";s:4:"slug";s:5:"wp-d3";s:19:"versionEndExcluding";s:5:"2.4.1";s:11:"description";s:53:"The wp-d3 plugin before 2.4.1 for WordPress has CSRF.";s:4:"refs";s:349:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-d3\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-d3\/#developers","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8679","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8679","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:407;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10946";s:4:"slug";s:5:"wp-d3";s:19:"versionEndExcluding";s:5:"2.4.1";s:11:"description";s:53:"The wp-d3 plugin before 2.4.1 for WordPress has CSRF.";s:4:"refs";s:349:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-d3\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-d3\/#developers","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8679","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8679","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:408;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9390";s:4:"slug";s:24:"admin-management-xtended";s:19:"versionEndExcluding";s:7:"2.4.0.1";s:11:"description";s:131:"The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled.";s:4:"refs";s:481:"[{"url":"https:\/\/security.szurek.pl\/admin-management-xtended-240-privilege-escalation.html","name":"https:\/\/security.szurek.pl\/admin-management-xtended-240-privilege-escalation.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/admin-management-xtended\/#developers","name":"https:\/\/wordpress.org\/plugins\/admin-management-xtended\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:409;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18489";s:4:"slug";s:24:"contact-form-7-sms-addon";s:19:"versionEndExcluding";s:5:"2.4.0";s:11:"description";s:71:"The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.";s:4:"refs";s:231:"[{"url":"https:\/\/wordpress.org\/plugins\/contact-form-7-sms-addon\/#developers","name":"https:\/\/wordpress.org\/plugins\/contact-form-7-sms-addon\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:410;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18495";s:4:"slug";s:31:"gravity-forms-sms-notifications";s:19:"versionEndExcluding";s:5:"2.4.0";s:11:"description";s:78:"The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.";s:4:"refs";s:229:"[{"url":"https:\/\/wordpress.org\/plugins\/gravity-forms-sms-notifications\/#developers","name":"https:\/\/wordpress.org\/plugins\/gravity-forms-sms-notifications\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:411;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18525";s:4:"slug";s:8:"megamenu";s:19:"versionEndExcluding";s:3:"2.4";s:11:"description";s:53:"The megamenu plugin before 2.4 for WordPress has XSS.";s:4:"refs";s:176:"[{"url":"https:\/\/wordpress.org\/plugins\/megamenu\/#developers","name":"https:\/\/wordpress.org\/plugins\/megamenu\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:412;O:8:"stdClass":6:{s:6:"CVE_ID";s:13:"CVE-2014-7238";s:4:"slug";s:40:"contact-form-integrated-with-google-maps";s:19:"versionEndExcluding";s:3:"2.4";s:11:"description";s:84:"The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS";s:14:"recommendation";s:111:"This plugin has been closed as of August 27, 2019 and is not available for download. This closure is permanent.";s:4:"refs";s:141:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8235","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8235","refsource":"MISC","tags":[]}]";}i:413;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10960";s:4:"slug";s:7:"wsecure";s:19:"versionEndExcluding";s:3:"2.4";s:11:"description";s:139:"The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.";s:4:"refs";s:480:"[{"url":"https:\/\/wordpress.org\/plugins\/wsecure\/#developers","name":"https:\/\/wordpress.org\/plugins\/wsecure\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2016\/07\/12\/remote-code-execution-rce-vulnerability-in-wsecure-lite\/","name":"https:\/\/www.pluginvulnerabilities.com\/2016\/07\/12\/remote-code-execution-rce-vulnerability-in-wsecure-lite\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:414;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10960";s:4:"slug";s:7:"wsecure";s:19:"versionEndExcluding";s:3:"2.4";s:11:"description";s:139:"The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.";s:4:"refs";s:480:"[{"url":"https:\/\/wordpress.org\/plugins\/wsecure\/#developers","name":"https:\/\/wordpress.org\/plugins\/wsecure\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2016\/07\/12\/remote-code-execution-rce-vulnerability-in-wsecure-lite\/","name":"https:\/\/www.pluginvulnerabilities.com\/2016\/07\/12\/remote-code-execution-rce-vulnerability-in-wsecure-lite\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:415;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18563";s:4:"slug";s:4:"rsvp";s:19:"versionEndExcluding";s:5:"2.3.8";s:11:"description";s:109:"The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.";s:4:"refs";s:168:"[{"url":"https:\/\/wordpress.org\/plugins\/rsvp\/#developers","name":"https:\/\/wordpress.org\/plugins\/rsvp\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:416;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9305";s:4:"slug";s:20:"wp-google-map-plugin";s:19:"versionEndExcluding";s:5:"2.3.7";s:11:"description";s:131:"The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.";s:4:"refs";s:218:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-google-map-plugin\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-google-map-plugin\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:417;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17385";s:4:"slug";s:10:"animate-it";s:19:"versionEndExcluding";s:5:"2.3.6";s:11:"description";s:57:"The animate-it plugin before 2.3.5 for WordPress has XSS.";s:4:"refs";s:360:"[{"url":"https:\/\/wordpress.org\/plugins\/animate-it\/#developers","name":"https:\/\/wordpress.org\/plugins\/animate-it\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9900","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9900","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:418;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17386";s:4:"slug";s:10:"animate-it";s:19:"versionEndExcluding";s:5:"2.3.6";s:11:"description";s:76:"The animate-it plugin before 2.3.6 for WordPress has CSRF in edsanimate.php.";s:4:"refs";s:1140:"[{"url":"https:\/\/plugins.trac.wordpress.org\/changeset?old_path=%2Fanimate-it%2Ftags%2F2.3.6%2Fedsanimate.php&old=2129363&new_path=%2Fanimate-it%2Ftags%2F2.3.5%2Fedsanimate.php","name":"https:\/\/plugins.trac.wordpress.org\/changeset?old_path=%2Fanimate-it%2Ftags%2F2.3.6%2Fedsanimate.php&old=2129363&new_path=%2Fanimate-it%2Ftags%2F2.3.5%2Fedsanimate.php","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/animate-it\/#developers","name":"https:\/\/wordpress.org\/plugins\/animate-it\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9900","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9900","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2019\/07\/29\/vulnerability-details-cross-site-request-forgery-csrf-cross-site-scripting-xss-in-animate-it\/","name":"https:\/\/www.pluginvulnerabilities.com\/2019\/07\/29\/vulnerability-details-cross-site-request-forgery-csrf-cross-site-scripting-xss-in-animate-it\/","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:419;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2013-7483";s:4:"slug";s:10:"slidedeck2";s:19:"versionEndExcluding";s:5:"2.3.5";s:11:"description";s:68:"The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion.";s:4:"refs";s:180:"[{"url":"https:\/\/wordpress.org\/plugins\/slidedeck2\/#developers","name":"https:\/\/wordpress.org\/plugins\/slidedeck2\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:420;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-12742";s:4:"slug";s:27:"iubenda-cookie-law-solution";s:19:"versionEndExcluding";s:5:"2.3.5";s:11:"description";s:119:"The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.";s:4:"refs";s:451:"[{"url":"https:\/\/github.com\/iubenda\/iubenda-cookie-class\/commit\/545e0586320ae6f16204ba548cf533ef75dc2fbd","name":"https:\/\/github.com\/iubenda\/iubenda-cookie-class\/commit\/545e0586320ae6f16204ba548cf533ef75dc2fbd","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/iubenda-cookie-law-solution\/#developers","name":"https:\/\/wordpress.org\/plugins\/iubenda-cookie-law-solution\/#developers","refsource":"MISC","tags":[]}]";}i:421;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9324";s:4:"slug";s:22:"easy-digital-downloads";s:19:"versionEndExcluding";s:5:"2.3.3";s:11:"description";s:79:"The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.";s:4:"refs";s:368:"[{"url":"https:\/\/wordpress.org\/plugins\/easy-digital-downloads\/#developers","name":"https:\/\/wordpress.org\/plugins\/easy-digital-downloads\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9770","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9770","refsource":"MISC","tags":[]}]";}i:422;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10891";s:4:"slug";s:17:"aryo-activity-log";s:19:"versionEndExcluding";s:5:"2.3.3";s:11:"description";s:64:"The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.";s:4:"refs";s:194:"[{"url":"https:\/\/wordpress.org\/plugins\/aryo-activity-log\/#developers","name":"https:\/\/wordpress.org\/plugins\/aryo-activity-log\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:423;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10891";s:4:"slug";s:17:"aryo-activity-log";s:19:"versionEndExcluding";s:5:"2.3.3";s:11:"description";s:64:"The aryo-activity-log plugin before 2.3.3 for WordPress has XSS.";s:4:"refs";s:194:"[{"url":"https:\/\/wordpress.org\/plugins\/aryo-activity-log\/#developers","name":"https:\/\/wordpress.org\/plugins\/aryo-activity-log\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:424;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18553";s:4:"slug";s:10:"ad-buttons";s:19:"versionEndExcluding";s:5:"2.3.2";s:11:"description";s:57:"The ad-buttons plugin before 2.3.2 for WordPress has XSS.";s:4:"refs";s:180:"[{"url":"https:\/\/wordpress.org\/plugins\/ad-buttons\/#developers","name":"https:\/\/wordpress.org\/plugins\/ad-buttons\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:425;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10890";s:4:"slug";s:17:"aryo-activity-log";s:19:"versionEndExcluding";s:5:"2.3.2";s:11:"description";s:64:"The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.";s:4:"refs";s:194:"[{"url":"https:\/\/wordpress.org\/plugins\/aryo-activity-log\/#developers","name":"https:\/\/wordpress.org\/plugins\/aryo-activity-log\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:426;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10890";s:4:"slug";s:17:"aryo-activity-log";s:19:"versionEndExcluding";s:5:"2.3.2";s:11:"description";s:64:"The aryo-activity-log plugin before 2.3.2 for WordPress has XSS.";s:4:"refs";s:194:"[{"url":"https:\/\/wordpress.org\/plugins\/aryo-activity-log\/#developers","name":"https:\/\/wordpress.org\/plugins\/aryo-activity-log\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:427;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15821";s:4:"slug";s:17:"bold-page-builder";s:19:"versionEndExcluding";s:5:"2.3.2";s:11:"description";s:120:"The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data.";s:4:"refs";s:683:"[{"url":"https:\/\/blog.nintechnet.com\/critical-vulnerability-in-wordpress-bold-page-builder-plugin-currently-being-exploited\/","name":"https:\/\/blog.nintechnet.com\/critical-vulnerability-in-wordpress-bold-page-builder-plugin-currently-being-exploited\/","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/bold-page-builder\/#developers","name":"https:\/\/wordpress.org\/plugins\/bold-page-builder\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9703","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9703","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:428;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9420";s:4:"slug";s:18:"soundcloud-is-gold";s:19:"versionEndExcluding";s:5:"2.3.2";s:11:"description";s:139:"The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter.";s:4:"refs";s:624:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_9acbc3ef2dd43bfb78b6b3dcf6c5ef01.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_9acbc3ef2dd43bfb78b6b3dcf6c5ef01.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/soundcloud-is-gold\/#developers","name":"https:\/\/wordpress.org\/plugins\/soundcloud-is-gold\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8306","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8306","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:429;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10941";s:4:"slug";s:39:"podlove-podcasting-plugin-for-wordpress";s:19:"versionEndExcluding";s:6:"2.3.16";s:11:"description";s:108:"The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.";s:4:"refs";s:665:"[{"url":"https:\/\/blog.ripstech.com\/2016\/the-state-of-wordpress-security\/","name":"https:\/\/blog.ripstech.com\/2016\/the-state-of-wordpress-security\/","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/github.com\/podlove\/podlove-publisher\/blob\/master\/changelog.txt","name":"https:\/\/github.com\/podlove\/podlove-publisher\/blob\/master\/changelog.txt","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wordpress.org\/plugins\/podlove-podcasting-plugin-for-wordpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/podlove-podcasting-plugin-for-wordpress\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:430;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10941";s:4:"slug";s:39:"podlove-podcasting-plugin-for-wordpress";s:19:"versionEndExcluding";s:6:"2.3.16";s:11:"description";s:108:"The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF.";s:4:"refs";s:665:"[{"url":"https:\/\/blog.ripstech.com\/2016\/the-state-of-wordpress-security\/","name":"https:\/\/blog.ripstech.com\/2016\/the-state-of-wordpress-security\/","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/github.com\/podlove\/podlove-publisher\/blob\/master\/changelog.txt","name":"https:\/\/github.com\/podlove\/podlove-publisher\/blob\/master\/changelog.txt","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wordpress.org\/plugins\/podlove-podcasting-plugin-for-wordpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/podlove-podcasting-plugin-for-wordpress\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:431;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10942";s:4:"slug";s:39:"podlove-podcasting-plugin-for-wordpress";s:19:"versionEndExcluding";s:6:"2.3.16";s:11:"description";s:146:"The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.";s:4:"refs";s:665:"[{"url":"https:\/\/blog.ripstech.com\/2016\/the-state-of-wordpress-security\/","name":"https:\/\/blog.ripstech.com\/2016\/the-state-of-wordpress-security\/","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/github.com\/podlove\/podlove-publisher\/blob\/master\/changelog.txt","name":"https:\/\/github.com\/podlove\/podlove-publisher\/blob\/master\/changelog.txt","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wordpress.org\/plugins\/podlove-podcasting-plugin-for-wordpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/podlove-podcasting-plugin-for-wordpress\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:432;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10942";s:4:"slug";s:39:"podlove-podcasting-plugin-for-wordpress";s:19:"versionEndExcluding";s:6:"2.3.16";s:11:"description";s:146:"The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.";s:4:"refs";s:665:"[{"url":"https:\/\/blog.ripstech.com\/2016\/the-state-of-wordpress-security\/","name":"https:\/\/blog.ripstech.com\/2016\/the-state-of-wordpress-security\/","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/github.com\/podlove\/podlove-publisher\/blob\/master\/changelog.txt","name":"https:\/\/github.com\/podlove\/podlove-publisher\/blob\/master\/changelog.txt","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wordpress.org\/plugins\/podlove-podcasting-plugin-for-wordpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/podlove-podcasting-plugin-for-wordpress\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:433;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:25:"yith-woocommerce-compare	";s:19:"versionEndExcluding";s:6:"2.3.15";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:434;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9353";s:4:"slug";s:8:"gigpress";s:19:"versionEndExcluding";s:6:"2.3.11";s:11:"description";s:130:"The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.";s:4:"refs";s:199:"[{"url":"https:\/\/wordpress.org\/plugins\/gigpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/gigpress\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:435;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9354";s:4:"slug";s:8:"gigpress";s:19:"versionEndExcluding";s:6:"2.3.11";s:11:"description";s:56:"The gigpress plugin before 2.3.11 for WordPress has XSS.";s:4:"refs";s:199:"[{"url":"https:\/\/wordpress.org\/plugins\/gigpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/gigpress\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:436;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9307";s:4:"slug";s:20:"wp-google-map-plugin";s:19:"versionEndExcluding";s:6:"2.3.10";s:11:"description";s:102:"The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.";s:4:"refs";s:218:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-google-map-plugin\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-google-map-plugin\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:437;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9308";s:4:"slug";s:20:"wp-google-map-plugin";s:19:"versionEndExcluding";s:6:"2.3.10";s:11:"description";s:97:"The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.";s:4:"refs";s:218:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-google-map-plugin\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-google-map-plugin\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:438;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9309";s:4:"slug";s:20:"wp-google-map-plugin";s:19:"versionEndExcluding";s:6:"2.3.10";s:11:"description";s:102:"The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.";s:4:"refs";s:218:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-google-map-plugin\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-google-map-plugin\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:439;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10959";s:4:"slug";s:7:"estatik";s:19:"versionEndExcluding";s:5:"2.3.1";s:11:"description";s:159:"The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.";s:4:"refs";s:490:"[{"url":"https:\/\/wordpress.org\/plugins\/estatik\/#developers","name":"https:\/\/wordpress.org\/plugins\/estatik\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2016\/08\/19\/authenticated-arbitrary-file-upload-vulnerability-in-estatik\/","name":"https:\/\/www.pluginvulnerabilities.com\/2016\/08\/19\/authenticated-arbitrary-file-upload-vulnerability-in-estatik\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:440;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10959";s:4:"slug";s:7:"estatik";s:19:"versionEndExcluding";s:5:"2.3.1";s:11:"description";s:159:"The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.";s:4:"refs";s:490:"[{"url":"https:\/\/wordpress.org\/plugins\/estatik\/#developers","name":"https:\/\/wordpress.org\/plugins\/estatik\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2016\/08\/19\/authenticated-arbitrary-file-upload-vulnerability-in-estatik\/","name":"https:\/\/www.pluginvulnerabilities.com\/2016\/08\/19\/authenticated-arbitrary-file-upload-vulnerability-in-estatik\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:441;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9909";s:4:"slug";s:4:"give";s:19:"versionEndExcluding";s:5:"2.3.1";s:11:"description";s:111:"The "Donation Plugin and Fundraising Platform" plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.";s:4:"refs";s:809:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2019\/Mar\/38","name":"20190322 Re: Give 2.3.0 - Reflected XSS (WordPress Plugin)","refsource":"FULLDISC","tags":["Mailing List","Third Party Advisory"]},{"url":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/9","name":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/9","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-give-xss\/","name":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-give-xss\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9240","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9240","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:442;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10995";s:4:"slug";s:10:"Tevolution";s:19:"versionEndExcluding";s:5:"2.3.0";s:11:"description";s:118:"The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php.";s:4:"refs";s:163:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8482","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8482","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:443;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10995";s:4:"slug";s:10:"Tevolution";s:19:"versionEndExcluding";s:5:"2.3.0";s:11:"description";s:118:"The Tevolution plugin before 2.3.0 for WordPress has arbitrary file upload via single_upload.php or single-upload.php.";s:4:"refs";s:163:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8482","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8482","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:444;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10958";s:4:"slug";s:7:"estatik";s:19:"versionEndExcluding";s:5:"2.3.0";s:11:"description";s:137:"The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.";s:4:"refs";s:645:"[{"url":"https:\/\/estatik.net\/estatik-released-security-updates\/","name":"https:\/\/estatik.net\/estatik-released-security-updates\/","refsource":"MISC","tags":["Vendor Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/estatik\/#developers","name":"https:\/\/wordpress.org\/plugins\/estatik\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2016\/08\/01\/arbitrary-file-upload-vulnerability-in-estatik\/","name":"https:\/\/www.pluginvulnerabilities.com\/2016\/08\/01\/arbitrary-file-upload-vulnerability-in-estatik\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:445;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10958";s:4:"slug";s:7:"estatik";s:19:"versionEndExcluding";s:5:"2.3.0";s:11:"description";s:137:"The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.";s:4:"refs";s:645:"[{"url":"https:\/\/estatik.net\/estatik-released-security-updates\/","name":"https:\/\/estatik.net\/estatik-released-security-updates\/","refsource":"MISC","tags":["Vendor Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/estatik\/#developers","name":"https:\/\/wordpress.org\/plugins\/estatik\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2016\/08\/01\/arbitrary-file-upload-vulnerability-in-estatik\/","name":"https:\/\/www.pluginvulnerabilities.com\/2016\/08\/01\/arbitrary-file-upload-vulnerability-in-estatik\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:446;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2011-5329";s:4:"slug";s:11:"redirection";s:19:"versionEndExcluding";s:5:"2.2.9";s:11:"description";s:114:"The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.";s:4:"refs";s:205:"[{"url":"https:\/\/wordpress.org\/plugins\/redirection\/#developers","name":"https:\/\/wordpress.org\/plugins\/redirection\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:447;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-13644";s:4:"slug";s:10:"accordions";s:19:"versionEndExcluding";s:5:"2.2.9";s:11:"description";s:304:"An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion.";s:4:"refs";s:391:"[{"url":"https:\/\/wordpress.org\/plugins\/accordions\/#developers","name":"https:\/\/wordpress.org\/plugins\/accordions\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/04\/vulnerability-patched-in-accordion-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/04\/vulnerability-patched-in-accordion-plugin\/","refsource":"MISC","tags":[]}]";}i:448;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-21003";s:4:"slug";s:10:"buddyforms";s:19:"versionEndExcluding";s:5:"2.2.8";s:11:"description";s:67:"The buddyforms plugin before 2.2.8 for WordPress has SQL injection.";s:4:"refs";s:333:"[{"url":"https:\/\/wordpress.org\/plugins\/buddyforms\/#developers","name":"https:\/\/wordpress.org\/plugins\/buddyforms\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9829","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9829","refsource":"MISC","tags":["Broken Link"]}]";}i:449;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16289";s:4:"slug";s:10:"insert-php";s:19:"versionEndExcluding";s:5:"2.2.8";s:11:"description";s:126:"The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.";s:4:"refs";s:532:"[{"url":"https:\/\/generaleg0x01.com\/2019\/09\/13\/xss-woody\/","name":"https:\/\/generaleg0x01.com\/2019\/09\/13\/xss-woody\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/insert-php\/#developers","name":"https:\/\/wordpress.org\/plugins\/insert-php\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9880","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9880","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:450;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10974";s:4:"slug";s:26:"fluid-responsive-slideshow";s:19:"versionEndExcluding";s:5:"2.2.7";s:11:"description";s:109:"The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.";s:4:"refs";s:402:"[{"url":"https:\/\/klikki.fi\/adv\/fluid_responsive_slideshow.html","name":"https:\/\/klikki.fi\/adv\/fluid_responsive_slideshow.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/fluid-responsive-slideshow\/#developers","name":"https:\/\/wordpress.org\/plugins\/fluid-responsive-slideshow\/#developers","refsource":"MISC","tags":["Product"]}]";}i:451;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10974";s:4:"slug";s:26:"fluid-responsive-slideshow";s:19:"versionEndExcluding";s:5:"2.2.7";s:11:"description";s:109:"The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has frs_save CSRF with resultant stored XSS.";s:4:"refs";s:402:"[{"url":"https:\/\/klikki.fi\/adv\/fluid_responsive_slideshow.html","name":"https:\/\/klikki.fi\/adv\/fluid_responsive_slideshow.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/fluid-responsive-slideshow\/#developers","name":"https:\/\/wordpress.org\/plugins\/fluid-responsive-slideshow\/#developers","refsource":"MISC","tags":["Product"]}]";}i:452;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10975";s:4:"slug";s:26:"fluid-responsive-slideshow";s:19:"versionEndExcluding";s:5:"2.2.7";s:11:"description";s:106:"The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.";s:4:"refs";s:402:"[{"url":"https:\/\/klikki.fi\/adv\/fluid_responsive_slideshow.html","name":"https:\/\/klikki.fi\/adv\/fluid_responsive_slideshow.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/fluid-responsive-slideshow\/#developers","name":"https:\/\/wordpress.org\/plugins\/fluid-responsive-slideshow\/#developers","refsource":"MISC","tags":["Product"]}]";}i:453;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10975";s:4:"slug";s:26:"fluid-responsive-slideshow";s:19:"versionEndExcluding";s:5:"2.2.7";s:11:"description";s:106:"The fluid-responsive-slideshow plugin before 2.2.7 for WordPress has reflected XSS via the skin parameter.";s:4:"refs";s:402:"[{"url":"https:\/\/klikki.fi\/adv\/fluid_responsive_slideshow.html","name":"https:\/\/klikki.fi\/adv\/fluid_responsive_slideshow.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/fluid-responsive-slideshow\/#developers","name":"https:\/\/wordpress.org\/plugins\/fluid-responsive-slideshow\/#developers","refsource":"MISC","tags":["Product"]}]";}i:454;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-12073";s:4:"slug";s:18:"responsive-add-ons";s:19:"versionEndExcluding";s:5:"2.2.7";s:11:"description";s:131:"The responsive-add-ons plugin before 2.2.7 for WordPress has incorrect access control for wp-admin/admin-ajax.php?action= requests.";s:4:"refs";s:269:"[{"url":"https:\/\/www.wordfence.com\/blog\/2020\/03\/severe-flaws-patched-in-responsive-ready-sites-importer-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/03\/severe-flaws-patched-in-responsive-ready-sites-importer-plugin\/","refsource":"MISC","tags":[]}]";}i:455;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-0902";s:4:"slug";s:29:"Semper Fi All in One SEO Pack";s:19:"versionEndExcluding";s:5:"2.2.6";s:11:"description";s:261:"The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code.";s:4:"refs";s:529:"[{"url":"http:\/\/jvn.jp\/en\/jp\/JVN75615300\/index.html","name":"JVN#75615300","refsource":"JVN","tags":["Vendor Advisory"]},{"url":"http:\/\/jvndb.jvn.jp\/jvndb\/JVNDB-2015-000046","name":"JVNDB-2015-000046","refsource":"JVNDB","tags":["Vendor Advisory"]},{"url":"http:\/\/semperfiwebdesign.com\/blog\/all-in-one-seo-pack\/all-in-one-seo-pack-release-history\/","name":"http:\/\/semperfiwebdesign.com\/blog\/all-in-one-seo-pack\/all-in-one-seo-pack-release-history\/","refsource":"CONFIRM","tags":["Patch","Vendor Advisory"]}]";}i:456;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9573";s:4:"slug";s:3:"hrm";s:19:"versionEndExcluding";s:5:"2.2.6";s:11:"description";s:97:"The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications.";s:4:"refs";s:512:"[{"url":"http:\/\/www.openwall.com\/lists\/oss-security\/2019\/03\/17\/1","name":"[oss-security] 20190317 CVE-2019-9573 \/ CVE-2019-9574: WordPress plugin hrm missing server side authorization checks","refsource":"MLIST","tags":[]},{"url":"http:\/\/www.securityfocus.com\/bid\/107464","name":"107464","refsource":"BID","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/hrm\/#developers","name":"https:\/\/wordpress.org\/plugins\/hrm\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]}]";}i:457;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9574";s:4:"slug";s:3:"hrm";s:19:"versionEndExcluding";s:5:"2.2.6";s:11:"description";s:171:"The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Administrator or HR Manager role.";s:4:"refs";s:560:"[{"url":"http:\/\/www.openwall.com\/lists\/oss-security\/2019\/03\/17\/1","name":"[oss-security] 20190317 CVE-2019-9573 \/ CVE-2019-9574: WordPress plugin hrm missing server side authorization checks","refsource":"MLIST","tags":["Mailing List"]},{"url":"http:\/\/www.securityfocus.com\/bid\/107464","name":"107464","refsource":"BID","tags":["Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/hrm\/#developers","name":"https:\/\/wordpress.org\/plugins\/hrm\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]}]";}i:458;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9328";s:4:"slug";s:15:"profile-builder";s:19:"versionEndExcluding";s:5:"2.2.5";s:11:"description";s:62:"The profile-builder plugin before 2.2.5 for WordPress has XSS.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/profile-builder\/#developers","name":"https:\/\/wordpress.org\/plugins\/profile-builder\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:459;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15858";s:4:"slug";s:10:"insert-php";s:19:"versionEndExcluding";s:5:"2.2.5";s:11:"description";s:208:"admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.";s:4:"refs";s:495:"[{"url":"https:\/\/blog.nintechnet.com\/multiple-vulnerabilities-in-wordpress-woody-ad-snippets-plugin-lead-to-remote-code-execution\/","name":"https:\/\/blog.nintechnet.com\/multiple-vulnerabilities-in-wordpress-woody-ad-snippets-plugin-lead-to-remote-code-execution\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9490","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9490","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:460;O:8:"stdClass":6:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:11:"astra-addon";s:19:"versionEndExcluding";s:5:"2.2.5";s:11:"description";s:194:"https://wpastra.com/changelog/astra-pro-addon/

A security researcher privately reported a bug about a cross-site scripting (XSS) vulnerability. The Astra team released an update the same day.";s:14:"recommendation";s:28:"Update to 2.2.5 immediately.";s:4:"refs";s:0:"";}i:461;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-9003";s:4:"slug";s:24:"modula-best-grid-gallery";s:19:"versionEndExcluding";s:5:"2.2.5";s:11:"description";s:258:"A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerability would allow an authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users.";s:4:"refs";s:657:"[{"url":"https:\/\/fortiguard.com\/zeroday\/FG-VD-20-041","name":"https:\/\/fortiguard.com\/zeroday\/FG-VD-20-041","refsource":"MISC","tags":[]},{"url":"https:\/\/github.com\/MachoThemes\/modula-lite\/blob\/master\/changelog.txt","name":"https:\/\/github.com\/MachoThemes\/modula-lite\/blob\/master\/changelog.txt","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/modula-best-grid-gallery\/","name":"https:\/\/wordpress.org\/plugins\/modula-best-grid-gallery\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10077","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10077","refsource":"MISC","tags":[]}]";}i:462;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19134";s:4:"slug";s:9:"hmapsprem";s:19:"versionEndExcluding";s:5:"2.2.3";s:11:"description";s:439:"The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based tokens or to launch other attacks.";s:4:"refs";s:617:"[{"url":"https:\/\/heroplugins.com\/changelogs\/hmaps\/changelog.txt","name":"https:\/\/heroplugins.com\/changelogs\/hmaps\/changelog.txt","refsource":"MISC","tags":[]},{"url":"https:\/\/heroplugins.com\/product\/maps\/","name":"https:\/\/heroplugins.com\/product\/maps\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10095","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10095","refsource":"MISC","tags":[]},{"url":"https:\/\/www.hooperlabs.xyz\/disclosures\/cve-2019-19134.php","name":"https:\/\/www.hooperlabs.xyz\/disclosures\/cve-2019-19134.php","refsource":"MISC","tags":[]}]";}i:463;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15777";s:4:"slug";s:16:"shapepress-dsgvo";s:19:"versionEndExcluding";s:6:"2.2.19";s:11:"description";s:130:"The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.";s:4:"refs";s:667:"[{"url":"https:\/\/wordpress.org\/plugins\/shapepress-dsgvo\/#developers","name":"https:\/\/wordpress.org\/plugins\/shapepress-dsgvo\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9850","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9850","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2019\/08\/22\/gdpr-plugins-for-wordpress-continue-to-be-insecure\/","name":"https:\/\/www.pluginvulnerabilities.com\/2019\/08\/22\/gdpr-plugins-for-wordpress-continue-to-be-insecure\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:464;O:8:"stdClass":5:{s:6:"CVE_ID";s:16:"CVE-2019-1010124";s:4:"slug";s:38:"webappick-product-feed-for-woocommerce";s:19:"versionEndExcluding";s:6:"2.2.18";s:11:"description";s:278:"WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in.";s:4:"refs";s:758:"[{"url":"http:\/\/104.207.151.48\/woo-feed-manage-list.php","name":"http:\/\/104.207.151.48\/woo-feed-manage-list.php","refsource":"MISC","tags":["Broken Link"]},{"url":"http:\/\/packetstormsecurity.com\/files\/154263\/WordPress-WooCommerce-Product-Feed-2.2.18-Cross-Site-Scripting.html","name":"http:\/\/packetstormsecurity.com\/files\/154263\/WordPress-WooCommerce-Product-Feed-2.2.18-Cross-Site-Scripting.html","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9856","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9856","refsource":"MISC","tags":[]},{"url":"https:\/\/www.youtube.com\/watch?v=T-sqQDFRRBg","name":"https:\/\/www.youtube.com\/watch?v=T-sqQDFRRBg","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:465;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:25:"yith-woocommerce-wishlist";s:19:"versionEndExcluding";s:6:"2.2.14";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:466;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2012-6717";s:4:"slug";s:11:"redirection";s:19:"versionEndExcluding";s:6:"2.2.12";s:11:"description";s:97:"The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.";s:4:"refs";s:205:"[{"url":"https:\/\/wordpress.org\/plugins\/redirection\/#developers","name":"https:\/\/wordpress.org\/plugins\/redirection\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:467;O:8:"stdClass":5:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:17:"wp-email-template";s:19:"versionEndExcluding";s:6:"2.2.11";s:11:"description";s:211:"Multiple plugins offering to convert WordPress’ default plain text emails to HTML format were found to be vulnerable to HTML injection, which could lead to phishing or CSRF attacks targeting the administrator.";s:4:"refs";s:84:"https://blog.nintechnet.com/multiple-wordpress-plugins-vulnerable-to-html-injection/";}i:468;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15839";s:4:"slug";s:28:"sina-extension-for-elementor";s:19:"versionEndExcluding";s:5:"2.2.1";s:11:"description";s:92:"The sina-extension-for-elementor plugin before 2.2.1 for WordPress has local file inclusion.";s:4:"refs";s:798:"[{"url":"https:\/\/wordpress.org\/plugins\/sina-extension-for-elementor\/#developers","name":"https:\/\/wordpress.org\/plugins\/sina-extension-for-elementor\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9368","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9368","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2019\/06\/18\/our-proactive-monitoring-caught-a-local-file-inclusion-lfi-vulnerability-being-added-in-to-sina-extension-for-elementor\/","name":"https:\/\/www.pluginvulnerabilities.com\/2019\/06\/18\/our-proactive-monitoring-caught-a-local-file-inclusion-lfi-vulnerability-being-added-in-to-sina-extension-for-elementor\/","refsource":"MISC","tags":[]}]";}i:469;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10928";s:4:"slug";s:17:"onelogin-saml-sso";s:19:"versionEndExcluding";s:5:"2.2.0";s:11:"description";s:129:"The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.";s:4:"refs";s:466:"[{"url":"https:\/\/github.com\/onelogin\/wordpress-saml\/commit\/fbe808e2fd8fde8cb7e6bf365c5334b5702262da","name":"https:\/\/github.com\/onelogin\/wordpress-saml\/commit\/fbe808e2fd8fde8cb7e6bf365c5334b5702262da","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/onelogin-saml-sso\/#developers","name":"https:\/\/wordpress.org\/plugins\/onelogin-saml-sso\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:470;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10928";s:4:"slug";s:17:"onelogin-saml-sso";s:19:"versionEndExcluding";s:5:"2.2.0";s:11:"description";s:129:"The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.";s:4:"refs";s:466:"[{"url":"https:\/\/github.com\/onelogin\/wordpress-saml\/commit\/fbe808e2fd8fde8cb7e6bf365c5334b5702262da","name":"https:\/\/github.com\/onelogin\/wordpress-saml\/commit\/fbe808e2fd8fde8cb7e6bf365c5334b5702262da","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/onelogin-saml-sso\/#developers","name":"https:\/\/wordpress.org\/plugins\/onelogin-saml-sso\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:471;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-35589";s:4:"slug";s:29:"limit-login-attempts-reloaded";s:19:"versionEndExcluding";s:6:"2.17.4";s:11:"description";s:472:"The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims.";s:4:"refs";s:427:"[{"url":"https:\/\/n4nj0.github.io\/advisories\/wordpress-plugin-limit-login-attempts-reloaded\/","name":"https:\/\/n4nj0.github.io\/advisories\/wordpress-plugin-limit-login-attempts-reloaded\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/limit-login-attempts-reloaded\/#developers","name":"https:\/\/wordpress.org\/plugins\/limit-login-attempts-reloaded\/#developers","refsource":"MISC","tags":[]}]";}i:472;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-35590";s:4:"slug";s:29:"limit-login-attempts-reloaded";s:19:"versionEndExcluding";s:6:"2.17.4";s:11:"description";s:510:"LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.";s:4:"refs";s:427:"[{"url":"https:\/\/n4nj0.github.io\/advisories\/wordpress-plugin-limit-login-attempts-reloaded\/","name":"https:\/\/n4nj0.github.io\/advisories\/wordpress-plugin-limit-login-attempts-reloaded\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/limit-login-attempts-reloaded\/#developers","name":"https:\/\/wordpress.org\/plugins\/limit-login-attempts-reloaded\/#developers","refsource":"MISC","tags":[]}]";}i:473;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-6166";s:4:"slug";s:36:"minimal-coming-soon-maintenance-mode";s:19:"versionEndExcluding";s:4:"2.17";s:11:"description";s:184:"A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.15, allows authenticated users with basic access to export settings and change maintenance-mode themes.";s:4:"refs";s:698:"[{"url":"https:\/\/wordpress.org\/plugins\/minimal-coming-soon-maintenance-mode\/#developers","name":"https:\/\/wordpress.org\/plugins\/minimal-coming-soon-maintenance-mode\/#developers","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10009","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10009","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/01\/multiple-vulnerabilities-patched-in-minimal-coming-soon-maintenance-mode-coming-soon-page-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/01\/multiple-vulnerabilities-patched-in-minimal-coming-soon-maintenance-mode-coming-soon-page-plugin\/","refsource":"MISC","tags":[]}]";}i:474;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-6167";s:4:"slug";s:36:"minimal-coming-soon-maintenance-mode";s:19:"versionEndExcluding";s:4:"2.17";s:11:"description";s:215:"A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable maintenance mode, inject XSS, modify several important settings, or include remote files as a logo.";s:4:"refs";s:698:"[{"url":"https:\/\/wordpress.org\/plugins\/minimal-coming-soon-maintenance-mode\/#developers","name":"https:\/\/wordpress.org\/plugins\/minimal-coming-soon-maintenance-mode\/#developers","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10007","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10007","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/01\/multiple-vulnerabilities-patched-in-minimal-coming-soon-maintenance-mode-coming-soon-page-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/01\/multiple-vulnerabilities-patched-in-minimal-coming-soon-maintenance-mode-coming-soon-page-plugin\/","refsource":"MISC","tags":[]}]";}i:475;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-6168";s:4:"slug";s:36:"minimal-coming-soon-maintenance-mode";s:19:"versionEndExcluding";s:4:"2.17";s:11:"description";s:289:"A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with basic access to enable and disable maintenance-mode settings (impacting the availability and confidentiality of a vulnerable site, along with the integrity of the setting).";s:4:"refs";s:698:"[{"url":"https:\/\/wordpress.org\/plugins\/minimal-coming-soon-maintenance-mode\/#developers","name":"https:\/\/wordpress.org\/plugins\/minimal-coming-soon-maintenance-mode\/#developers","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10008","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10008","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/01\/multiple-vulnerabilities-patched-in-minimal-coming-soon-maintenance-mode-coming-soon-page-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/01\/multiple-vulnerabilities-patched-in-minimal-coming-soon-maintenance-mode-coming-soon-page-plugin\/","refsource":"MISC","tags":[]}]";}i:476;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-8417";s:4:"slug";s:13:"code-snippets";s:19:"versionEndExcluding";s:6:"2.14.0";s:11:"description";s:123:"The Code Snippets plugin before 2.14.0 for WordPress allows CSRF because of the lack of a Referer check on the import menu.";s:4:"refs";s:171:"[{"url":"https:\/\/wordpress.org\/plugins\/code-snippets\/#developers","name":"https:\/\/wordpress.org\/plugins\/code-snippets\/#developers","refsource":"MISC","tags":[]}]";}i:477;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-13642";s:4:"slug";s:17:"siteorigin-panels";s:19:"versionEndExcluding";s:7:"2.10.16";s:11:"description";s:332:"An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser.";s:4:"refs";s:487:"[{"url":"https:\/\/wordpress.org\/plugins\/siteorigin-panels\/#developers","name":"https:\/\/wordpress.org\/plugins\/siteorigin-panels\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/05\/vulnerabilities-patched-in-page-builder-by-siteorigin-affects-over-1-million-sites\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/05\/vulnerabilities-patched-in-page-builder-by-siteorigin-affects-over-1-million-sites\/","refsource":"MISC","tags":[]}]";}i:478;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-13643";s:4:"slug";s:17:"siteorigin-panels";s:19:"versionEndExcluding";s:7:"2.10.16";s:11:"description";s:332:"An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser.";s:4:"refs";s:487:"[{"url":"https:\/\/wordpress.org\/plugins\/siteorigin-panels\/#developers","name":"https:\/\/wordpress.org\/plugins\/siteorigin-panels\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/05\/vulnerabilities-patched-in-page-builder-by-siteorigin-affects-over-1-million-sites\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/05\/vulnerabilities-patched-in-page-builder-by-siteorigin-affects-over-1-million-sites\/","refsource":"MISC","tags":[]}]";}i:479;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2018-5670";s:4:"slug";s:16:"booking-calendar";s:19:"versionEndExcluding";s:5:"2.1.8";s:11:"description";s:149:"An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] parameter.";s:4:"refs";s:419:"[{"url":"https:\/\/github.com\/d4wner\/Vulnerabilities-Report\/blob\/master\/booking-calendar.md","name":"https:\/\/github.com\/d4wner\/Vulnerabilities-Report\/blob\/master\/booking-calendar.md","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9012","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9012","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:480;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10889";s:4:"slug";s:15:"nextgen-gallery";s:19:"versionEndExcluding";s:6:"2.1.57";s:11:"description";s:92:"The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.";s:4:"refs";s:213:"[{"url":"https:\/\/wordpress.org\/plugins\/nextgen-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/nextgen-gallery\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:481;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10889";s:4:"slug";s:15:"nextgen-gallery";s:19:"versionEndExcluding";s:6:"2.1.57";s:11:"description";s:92:"The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.";s:4:"refs";s:213:"[{"url":"https:\/\/wordpress.org\/plugins\/nextgen-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/nextgen-gallery\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:482;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:26:"yith-woocommerce-mailchimp";s:19:"versionEndExcluding";s:5:"2.1.4";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:483;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9337";s:4:"slug";s:15:"profile-builder";s:19:"versionEndExcluding";s:5:"2.1.4";s:11:"description";s:123:"The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.";s:4:"refs";s:213:"[{"url":"https:\/\/wordpress.org\/plugins\/profile-builder\/#developers","name":"https:\/\/wordpress.org\/plugins\/profile-builder\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:484;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17071";s:4:"slug";s:11:"client-dash";s:19:"versionEndExcluding";s:5:"2.1.4";s:11:"description";s:72:"The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS.";s:4:"refs";s:410:"[{"url":"https:\/\/gist.github.com\/rezaduty\/18afedba24bb1e5835010bd2de67cece","name":"https:\/\/gist.github.com\/rezaduty\/18afedba24bb1e5835010bd2de67cece","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/client-dash\/#developers","name":"https:\/\/wordpress.org\/plugins\/client-dash\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:485;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9269";s:4:"slug";s:69:"export/content.php exportarticle feature in the wordpress-mobile-pack";s:19:"versionEndExcluding";s:16:"2.1.3 2015-06-03";s:11:"description";s:248:"The export/content.php exportarticle feature in the wordpress-mobile-pack plugin before 2.1.3 2015-06-03 for WordPress allows remote attackers to obtain sensitive information because the content of a privately published post is sent in JSON format.";s:4:"refs";s:643:"[{"url":"https:\/\/seclists.org\/fulldisclosure\/2015\/Jul\/97","name":"https:\/\/seclists.org\/fulldisclosure\/2015\/Jul\/97","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wordpress-mobile-pack\/#developers","name":"https:\/\/wordpress.org\/plugins\/wordpress-mobile-pack\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/www.openwall.com\/lists\/oss-security\/2015\/07\/19\/1","name":"https:\/\/www.openwall.com\/lists\/oss-security\/2015\/07\/19\/1","refsource":"MISC","tags":["Mailing List","Third Party Advisory"]}]";}i:486;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-11497";s:4:"slug";s:24:"nab-transact-direct-post";s:19:"versionEndExcluding";s:5:"2.1.2";s:11:"description";s:259:"An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marked as fully paid by assigning an arbitrary bank transaction ID during the payment-details entry step.";s:4:"refs";s:347:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2020\/Aug\/13","name":"http:\/\/seclists.org\/fulldisclosure\/2020\/Aug\/13","refsource":"MISC","tags":[]},{"url":"https:\/\/www.themissinglink.com.au\/security-advisories-cve-2020-11497","name":"https:\/\/www.themissinglink.com.au\/security-advisories-cve-2020-11497","refsource":"MISC","tags":[]}]";}i:487;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-6859";s:4:"slug";s:15:"ultimate-member";s:19:"versionEndExcluding";s:5:"2.1.2";s:11:"description";s:314:"Multiple Insecure Direct Object Reference vulnerabilities in includes/core/class-files.php in the Ultimate Member plugin through 2.1.2 for WordPress allow remote attackers to change other users' profiles and cover photos via a modified user_id parameter. This is related to ajax_image_upload and ajax_resize_image.";s:4:"refs";s:1084:"[{"url":"https:\/\/github.com\/ultimatemember\/ultimatemember\/blob\/627bbb0fae81ac34c60b43f0867eadcf8e1bc523\/includes\/core\/class-files.php#L269","name":"https:\/\/github.com\/ultimatemember\/ultimatemember\/blob\/627bbb0fae81ac34c60b43f0867eadcf8e1bc523\/includes\/core\/class-files.php#L269","refsource":"MISC","tags":[]},{"url":"https:\/\/github.com\/ultimatemember\/ultimatemember\/blob\/627bbb0fae81ac34c60b43f0867eadcf8e1bc523\/includes\/core\/class-files.php#L310","name":"https:\/\/github.com\/ultimatemember\/ultimatemember\/blob\/627bbb0fae81ac34c60b43f0867eadcf8e1bc523\/includes\/core\/class-files.php#L310","refsource":"MISC","tags":[]},{"url":"https:\/\/github.com\/ultimatemember\/ultimatemember\/commit\/249682559012734a4f7d71f52609b2f301ea55b1","name":"https:\/\/github.com\/ultimatemember\/ultimatemember\/commit\/249682559012734a4f7d71f52609b2f301ea55b1","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","name":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","refsource":"MISC","tags":[]}]";}i:488;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9538";s:4:"slug";s:15:"nextgen-gallery";s:19:"versionEndExcluding";s:6:"2.1.15";s:11:"description";s:104:"The NextGEN Gallery plugin before 2.1.15 for WordPress allows ../ Directory Traversal in path selection.";s:4:"refs";s:1145:"[{"url":"https:\/\/cxsecurity.com\/issue\/WLB-2015080165","name":"https:\/\/cxsecurity.com\/issue\/WLB-2015080165","refsource":"MISC","tags":[]},{"url":"https:\/\/github.com\/cybersecurityworks\/Disclosed\/issues\/2","name":"https:\/\/github.com\/cybersecurityworks\/Disclosed\/issues\/2","refsource":"MISC","tags":[]},{"url":"https:\/\/packetstormsecurity.com\/files\/135114\/WordPress-NextGEN-Gallery-2.1.15-Cross-Site-Scripting-Path-Traversal.html","name":"https:\/\/packetstormsecurity.com\/files\/135114\/WordPress-NextGEN-Gallery-2.1.15-Cross-Site-Scripting-Path-Traversal.html","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/nextgen-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/nextgen-gallery\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.openwall.com\/lists\/oss-security\/2015\/08\/28\/4","name":"https:\/\/www.openwall.com\/lists\/oss-security\/2015\/08\/28\/4","refsource":"MISC","tags":[]},{"url":"https:\/\/www.openwall.com\/lists\/oss-security\/2015\/09\/01\/7","name":"https:\/\/www.openwall.com\/lists\/oss-security\/2015\/09\/01\/7","refsource":"MISC","tags":[]}]";}i:489;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9537";s:4:"slug";s:15:"nextgen-gallery";s:19:"versionEndExcluding";s:6:"2.1.10";s:11:"description";s:182:"The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width, thumbnail_height, thumbwidth, thumbheight, wmXpos, and wmYpos, and template.";s:4:"refs";s:527:"[{"url":"https:\/\/github.com\/cybersecurityworks\/Disclosed\/issues\/1","name":"https:\/\/github.com\/cybersecurityworks\/Disclosed\/issues\/1","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/nextgen-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/nextgen-gallery\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.openwall.com\/lists\/oss-security\/2015\/10\/27\/4","name":"https:\/\/www.openwall.com\/lists\/oss-security\/2015\/10\/27\/4","refsource":"MISC","tags":[]}]";}i:490;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2012-6692";s:4:"slug";s:13:"wordpress-seo";s:19:"versionEndExcluding";s:5:"2.1.1";s:11:"description";s:312:"Cross-site scripting (XSS) vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_title parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview functionality.";s:4:"refs";s:1428:"[{"url":"http:\/\/packetstormsecurity.com\/files\/132294\/WordPress-Yoast-2.1.1-Cross-Site-Scripting.html","name":"http:\/\/packetstormsecurity.com\/files\/132294\/WordPress-Yoast-2.1.1-Cross-Site-Scripting.html","refsource":"MISC","tags":["Exploit"]},{"url":"http:\/\/seclists.org\/fulldisclosure\/2015\/Jun\/40","name":"20150613 Yoast Wordpress SEO Plugin <= 2.1.1 Stored, Authenticated XSS","refsource":"FULLDISC","tags":["Exploit"]},{"url":"http:\/\/www.securityfocus.com\/bid\/75196","name":"75196","refsource":"BID","tags":[]},{"url":"http:\/\/www.securitytracker.com\/id\/1032580","name":"1032580","refsource":"SECTRACK","tags":[]},{"url":"https:\/\/inventropy.us\/blog\/yoast-seo-plugin-cross-site-scripting-vulnerability\/","name":"https:\/\/inventropy.us\/blog\/yoast-seo-plugin-cross-site-scripting-vulnerability\/","refsource":"MISC","tags":["Exploit"]},{"url":"https:\/\/wordpress.org\/plugins\/wordpress-seo\/changelog\/","name":"https:\/\/wordpress.org\/plugins\/wordpress-seo\/changelog\/","refsource":"CONFIRM","tags":["Patch"]},{"url":"https:\/\/wordpress.org\/support\/topic\/security-issue-with-post-title-field-xss-vulnerability","name":"https:\/\/wordpress.org\/support\/topic\/security-issue-with-post-title-field-xss-vulnerability","refsource":"MISC","tags":["Exploit"]},{"url":"https:\/\/yoast.com\/wordpress-seo-2-2\/","name":"https:\/\/yoast.com\/wordpress-seo-2-2\/","refsource":"CONFIRM","tags":[]}]";}i:491;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18591";s:4:"slug";s:16:"gd-rating-system";s:19:"versionEndExcluding";s:3:"2.1";s:11:"description";s:72:"The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.";s:4:"refs";s:192:"[{"url":"https:\/\/wordpress.org\/plugins\/gd-rating-system\/#developers","name":"https:\/\/wordpress.org\/plugins\/gd-rating-system\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:492;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9344";s:4:"slug";s:8:"link-log";s:19:"versionEndExcluding";s:3:"2.1";s:11:"description";s:63:"The link-log plugin before 2.1 for WordPress has SQL injection.";s:4:"refs";s:176:"[{"url":"https:\/\/wordpress.org\/plugins\/link-log\/#developers","name":"https:\/\/wordpress.org\/plugins\/link-log\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:493;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-7413";s:4:"slug";s:23:"adamrob-parallax-scroll";s:19:"versionEndExcluding";s:3:"2.1";s:11:"description";s:216:"In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress, includes/adamrob-parralax-shortcode.php allows XSS via the title text. ("parallax" has a spelling change within the PHP filename.)";s:4:"refs";s:519:"[{"url":"https:\/\/metamorfosec.com\/Files\/Advisories\/METS-2019-004-A_XSS_Vulnerability_in_Parallax_Scroll_plugin_before_v2.1_for_WordPress.txt","name":"https:\/\/metamorfosec.com\/Files\/Advisories\/METS-2019-004-A_XSS_Vulnerability_in_Parallax_Scroll_plugin_before_v2.1_for_WordPress.txt","refsource":"MISC","tags":[]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2024194\/","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2024194\/","refsource":"MISC","tags":["Patch","Third Party Advisory"]}]";}i:494;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9460";s:4:"slug";s:14:"booking-system";s:19:"versionEndExcluding";s:3:"2.1";s:11:"description";s:130:"The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter.";s:4:"refs";s:606:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_dad9a09a6290ae952bfd97010583bdbd.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_dad9a09a6290ae952bfd97010583bdbd.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/booking-system\/#developers","name":"https:\/\/wordpress.org\/plugins\/booking-system\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8339","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8339","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:495;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9438";s:4:"slug";s:15:"display-widgets";s:19:"versionEndExcluding";s:4:"2.04";s:11:"description";s:161:"The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.";s:4:"refs";s:615:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_a7012199c9236754edd72786637e5d2d.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_a7012199c9236754edd72786637e5d2d.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/display-widgets\/#developers","name":"https:\/\/wordpress.org\/plugins\/display-widgets\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8247","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8247","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:496;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-35938";s:4:"slug";s:9:"post-grid";s:19:"versionEndExcluding";s:6:"2.0.73";s:11:"description";s:333:"PHP Object injection vulnerabilities in the Post Grid plugin before 2.0.73 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to post_grid_import_xml_layouts.";s:4:"refs";s:281:"[{"url":"https:\/\/www.wordfence.com\/blog\/2020\/10\/high-severity-vulnerabilities-in-post-grid-and-team-showcase-plugins\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/10\/high-severity-vulnerabilities-in-post-grid-and-team-showcase-plugins\/","refsource":"MISC","tags":[]}]";}i:497;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20154";s:4:"slug";s:19:"WP Maintenance Mode";s:19:"versionEndExcluding";s:5:"2.0.7";s:11:"description";s:136:"The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.";s:4:"refs";s:241:"[{"url":"https:\/\/www.wordfence.com\/blog\/2016\/07\/3-vulnerabilities-wp-maintenance-mode\/","name":"https:\/\/www.wordfence.com\/blog\/2016\/07\/3-vulnerabilities-wp-maintenance-mode\/","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:498;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20155";s:4:"slug";s:19:"WP Maintenance Mode";s:19:"versionEndExcluding";s:5:"2.0.7";s:11:"description";s:172:"The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.";s:4:"refs";s:241:"[{"url":"https:\/\/www.wordfence.com\/blog\/2016\/07\/3-vulnerabilities-wp-maintenance-mode\/","name":"https:\/\/www.wordfence.com\/blog\/2016\/07\/3-vulnerabilities-wp-maintenance-mode\/","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:499;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10900";s:4:"slug";s:13:"uji-countdown";s:19:"versionEndExcluding";s:5:"2.0.7";s:11:"description";s:60:"The uji-countdown plugin before 2.0.7 for WordPress has XSS.";s:4:"refs";s:186:"[{"url":"https:\/\/wordpress.org\/plugins\/uji-countdown\/#developers","name":"https:\/\/wordpress.org\/plugins\/uji-countdown\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:500;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-21002";s:4:"slug";s:17:"js-support-ticket";s:19:"versionEndExcluding";s:5:"2.0.6";s:11:"description";s:65:"The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.";s:4:"refs";s:217:"[{"url":"https:\/\/wordpress.org\/plugins\/js-support-ticket\/#developers","name":"https:\/\/wordpress.org\/plugins\/js-support-ticket\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:501;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-4942";s:4:"slug";s:21:"EasyCart (wp-easycart";s:19:"versionEndExcluding";s:5:"2.0.6";s:11:"description";s:201:"The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.";s:4:"refs";s:592:"[{"url":"http:\/\/codevigilant.com\/disclosure\/wp-plugin-wp-easycart-information-disclosure\/","name":"http:\/\/codevigilant.com\/disclosure\/wp-plugin-wp-easycart-information-disclosure\/","refsource":"MISC","tags":["Exploit"]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset?sfp_email=&sfph_mail=&reponame=&new=829290%40wp-easycart&old=827627%40wp-easycart&sfp_email=&sfph_mail=","name":"https:\/\/plugins.trac.wordpress.org\/changeset?sfp_email=&sfph_mail=&reponame=&new=829290%40wp-easycart&old=827627%40wp-easycart&sfp_email=&sfph_mail=","refsource":"CONFIRM","tags":["Patch"]}]";}i:502;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10952";s:4:"slug";s:17:"quotes-collection";s:19:"versionEndExcluding";s:5:"2.0.6";s:11:"description";s:129:"The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter.";s:4:"refs";s:685:"[{"url":"https:\/\/sumofpwn.nl\/advisory\/2016\/cross_site_scripting_vulnerability_in_quotes_collection_wordpress_plugin.html","name":"https:\/\/sumofpwn.nl\/advisory\/2016\/cross_site_scripting_vulnerability_in_quotes_collection_wordpress_plugin.html","refsource":"MISC","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/quotes-collection\/#developers","name":"https:\/\/wordpress.org\/plugins\/quotes-collection\/#developers","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8649","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8649","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:503;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10952";s:4:"slug";s:17:"quotes-collection";s:19:"versionEndExcluding";s:5:"2.0.6";s:11:"description";s:129:"The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter.";s:4:"refs";s:685:"[{"url":"https:\/\/sumofpwn.nl\/advisory\/2016\/cross_site_scripting_vulnerability_in_quotes_collection_wordpress_plugin.html","name":"https:\/\/sumofpwn.nl\/advisory\/2016\/cross_site_scripting_vulnerability_in_quotes_collection_wordpress_plugin.html","refsource":"MISC","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/quotes-collection\/#developers","name":"https:\/\/wordpress.org\/plugins\/quotes-collection\/#developers","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8649","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8649","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:504;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14945";s:4:"slug";s:15:"ultimate-member";s:19:"versionEndExcluding";s:6:"2.0.54";s:11:"description";s:63:"The ultimate-member plugin before 2.0.54 for WordPress has XSS.";s:4:"refs";s:380:"[{"url":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","name":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9506","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9506","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:505;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14946";s:4:"slug";s:15:"ultimate-member";s:19:"versionEndExcluding";s:6:"2.0.52";s:11:"description";s:110:"The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.";s:4:"refs";s:380:"[{"url":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","name":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9449","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9449","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:506;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14947";s:4:"slug";s:15:"ultimate-member";s:19:"versionEndExcluding";s:6:"2.0.52";s:11:"description";s:89:"The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.";s:4:"refs";s:380:"[{"url":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","name":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9449","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9449","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:507;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20965";s:4:"slug";s:15:"ultimate-member";s:19:"versionEndExcluding";s:5:"2.0.4";s:11:"description";s:62:"The ultimate-member plugin before 2.0.4 for WordPress has XSS.";s:4:"refs";s:208:"[{"url":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","name":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:508;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-8877";s:4:"slug";s:100:"alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downlo";s:19:"versionEndExcluding";s:5:"2.0.4";s:11:"description";s:304:"The alterSearchQuery function in lib/controllers/CmdownloadController.php in the CreativeMinds CM Downloads Manager plugin before 2.0.4 for WordPress allows remote attackers to execute arbitrary PHP code via the CMDsearch parameter to cmdownloads/, which is processed by the PHP create_function function.";s:4:"refs";s:935:"[{"url":"http:\/\/packetstormsecurity.com\/files\/129183\/WordPress-CM-Download-Manager-2.0.0-Code-Injection.html","name":"http:\/\/packetstormsecurity.com\/files\/129183\/WordPress-CM-Download-Manager-2.0.0-Code-Injection.html","refsource":"MISC","tags":["Exploit"]},{"url":"http:\/\/www.itas.vn\/news\/code-injection-in-cm-download-manager-plugin-66.html","name":"http:\/\/www.itas.vn\/news\/code-injection-in-cm-download-manager-plugin-66.html","refsource":"MISC","tags":[]},{"url":"http:\/\/www.securityfocus.com\/archive\/1\/534037\/100\/0\/threaded","name":"20141120 CVE-2014-8877 - Code Injection in Wordpress CM Download Manager plugin","refsource":"BUGTRAQ","tags":[]},{"url":"http:\/\/www.securityfocus.com\/bid\/71204","name":"71204","refsource":"BID","tags":[]},{"url":"https:\/\/downloadsmanager.cminds.com\/release-notes\/","name":"https:\/\/downloadsmanager.cminds.com\/release-notes\/","refsource":"CONFIRM","tags":[]}]";}i:509;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20970";s:4:"slug";s:9:"pdf-print";s:19:"versionEndExcluding";s:5:"2.0.3";s:11:"description";s:72:"The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.";s:4:"refs";s:178:"[{"url":"https:\/\/wordpress.org\/plugins\/pdf-print\/#developers","name":"https:\/\/wordpress.org\/plugins\/pdf-print\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:510;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9323";s:4:"slug";s:10:"404-to-301";s:19:"versionEndExcluding";s:5:"2.0.3";s:11:"description";s:67:"The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.";s:4:"refs";s:204:"[{"url":"https:\/\/wordpress.org\/plugins\/404-to-301\/#developers","name":"https:\/\/wordpress.org\/plugins\/404-to-301\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:511;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-26876";s:4:"slug";s:10:"wp-courses";s:19:"versionEndExcluding";s:6:"2.0.29";s:11:"description";s:349:"The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because show_in_rest is enabled for custom post types (e.g., /wp-json/wp/v2/course and /wp-json/wp/v2/lesson exist).";s:4:"refs";s:627:"[{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2388997","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2388997","refsource":"MISC","tags":[]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2389243","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2389243","refsource":"MISC","tags":[]},{"url":"https:\/\/www.redtimmy.com\/critical-information-disclosure-on-wp-courses-plugin-exposes-private-course-videos-and-materials\/","name":"https:\/\/www.redtimmy.com\/critical-information-disclosure-on-wp-courses-plugin-exposes-private-course-videos-and-materials\/","refsource":"MISC","tags":[]}]";}i:512;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:23:"yith-woocommerce-stripe";s:19:"versionEndExcluding";s:5:"2.0.2";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:513;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11013";s:4:"slug";s:11:"wp-listings";s:19:"versionEndExcluding";s:5:"2.0.2";s:11:"description";s:92:"The wp-listings plugin before 2.0.2 for WordPress has includes/views/single-listing.php XSS.";s:4:"refs";s:413:"[{"url":"https:\/\/github.com\/agentevolution\/wp-listings\/pull\/52","name":"https:\/\/github.com\/agentevolution\/wp-listings\/pull\/52","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-listings\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-listings\/#developers","refsource":"MISC","tags":["Product","Release Notes","Third Party Advisory"]}]";}i:514;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-5337";s:4:"slug";s:21:"WordPress Mobile Pack";s:19:"versionEndExcluding";s:5:"2.0.2";s:11:"description";s:236:"The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php.";s:4:"refs";s:749:"[{"url":"http:\/\/secunia.com\/advisories\/60584","name":"60584","refsource":"SECUNIA","tags":[]},{"url":"http:\/\/wordpress.org\/plugins\/wordpress-mobile-pack\/changelog\/","name":"http:\/\/wordpress.org\/plugins\/wordpress-mobile-pack\/changelog\/","refsource":"CONFIRM","tags":["Patch"]},{"url":"http:\/\/www.securityfocus.com\/bid\/69292","name":"69292","refsource":"BID","tags":[]},{"url":"https:\/\/security.dxw.com\/advisories\/information-disclosure-vulnerability-in-wordpress-mobile-pack-allows-anybody-to-read-password-protected-posts\/","name":"https:\/\/security.dxw.com\/advisories\/information-disclosure-vulnerability-in-wordpress-mobile-pack-allows-anybody-to-read-password-protected-posts\/","refsource":"MISC","tags":["Exploit"]}]";}i:515;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-13136";s:4:"slug";s:15:"ultimate-member";s:19:"versionEndExcluding";s:6:"2.0.18";s:11:"description";s:117:"The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen.";s:4:"refs";s:565:"[{"url":"https:\/\/github.com\/ultimatemember\/ultimatemember\/issues\/456","name":"https:\/\/github.com\/ultimatemember\/ultimatemember\/issues\/456","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/github.com\/ultimatemember\/ultimatemember\/releases\/tag\/2.0.18","name":"https:\/\/github.com\/ultimatemember\/ultimatemember\/releases\/tag\/2.0.18","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9708","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9708","refsource":"MISC","tags":[]}]";}i:516;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-8802";s:4:"slug";s:12:"Pie Register";s:19:"versionEndExcluding";s:6:"2.0.14";s:11:"description";s:261:"The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.";s:4:"refs";s:489:"[{"url":"http:\/\/secunia.com\/advisories\/62351","name":"62351","refsource":"SECUNIA","tags":[]},{"url":"http:\/\/security.szurek.pl\/pie-register-2013-privilege-escalation.html","name":"http:\/\/security.szurek.pl\/pie-register-2013-privilege-escalation.html","refsource":"MISC","tags":["Exploit"]},{"url":"https:\/\/wordpress.org\/plugins\/pie-register\/changelog\/","name":"https:\/\/wordpress.org\/plugins\/pie-register\/changelog\/","refsource":"CONFIRM","tags":["Vendor Advisory"]}]";}i:517;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9450";s:4:"slug";s:33:"plugmatter-optin-feature-box-lite";s:19:"versionEndExcluding";s:6:"2.0.14";s:11:"description";s:157:"The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.";s:4:"refs";s:634:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_ec951d52aa603c9caaca8c7005b84004.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_ec951d52aa603c9caaca8c7005b84004.html","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/plugmatter-optin-feature-box-lite\/#developers","name":"https:\/\/wordpress.org\/plugins\/plugmatter-optin-feature-box-lite\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8340","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8340","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:518;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9451";s:4:"slug";s:33:"plugmatter-optin-feature-box-lite";s:19:"versionEndExcluding";s:6:"2.0.14";s:11:"description";s:164:"The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.";s:4:"refs";s:654:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_ec951d52aa603c9caaca8c7005b84004.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_ec951d52aa603c9caaca8c7005b84004.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/plugmatter-optin-feature-box-lite\/#developers","name":"https:\/\/wordpress.org\/plugins\/plugmatter-optin-feature-box-lite\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8340","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8340","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:519;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18506";s:4:"slug";s:38:"woocommerce-pdf-invoices-packing-slips";s:19:"versionEndExcluding";s:6:"2.0.13";s:11:"description";s:138:"The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.";s:4:"refs";s:254:"[{"url":"https:\/\/wordpress.org\/plugins\/woocommerce-pdf-invoices-packing-slips\/#developers","name":"https:\/\/wordpress.org\/plugins\/woocommerce-pdf-invoices-packing-slips\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:520;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2013-4241";s:4:"slug";s:16:"hms-testimonials";s:19:"versionEndExcluding";s:6:"2.0.11";s:11:"description";s:610:"Multiple cross-site scripting (XSS) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) image, (3) url, or (4) testimonial parameter to the Testimonial form (hms-testimonials-addnew page); (5) date_format parameter to the Settings - Default form (hms-testimonials-settings page); (6) name parameter in a Save action to the Settings - Custom Fields form (hms-testimonials-settings-fields page); or (7) name parameter in a Save action to the Settings - Template form (hms-testimonials-templates-new page).";s:4:"refs";s:765:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2013\/Aug\/96","name":"http:\/\/seclists.org\/fulldisclosure\/2013\/Aug\/96","refsource":"MISC","tags":[]},{"url":"http:\/\/seclists.org\/fulldisclosure\/2013\/Aug\/98","name":"http:\/\/seclists.org\/fulldisclosure\/2013\/Aug\/98","refsource":"MISC","tags":[]},{"url":"http:\/\/seclists.org\/oss-sec\/2013\/q3\/345","name":"http:\/\/seclists.org\/oss-sec\/2013\/q3\/345","refsource":"MISC","tags":[]},{"url":"http:\/\/seclists.org\/oss-sec\/2013\/q3\/361","name":"http:\/\/seclists.org\/oss-sec\/2013\/q3\/361","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/hms-testimonials\/#developers","name":"https:\/\/wordpress.org\/plugins\/hms-testimonials\/#developers","refsource":"MISC","tags":[]}]";}i:521;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18010";s:4:"slug";s:47:"E-goi Smart Marketing SMS and Newsletters Forms";s:19:"versionEndExcluding";s:5:"2.0.0";s:11:"description";s:164:"The E-goi Smart Marketing SMS and Newsletters Forms plugin before 2.0.0 for WordPress has XSS via the admin/partials/custom/egoi-for-wp-form_egoi.php url parameter.";s:4:"refs";s:740:"[{"url":"https:\/\/packetstormsecurity.com\/files\/145217\/WordPress-Smart-Marketing-SMS-And-Newsletters-Forms-1.1.1-XSS.html","name":"https:\/\/packetstormsecurity.com\/files\/145217\/WordPress-Smart-Marketing-SMS-And-Newsletters-Forms-1.1.1-XSS.html","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/smart-marketing-for-wp\/#developers","name":"https:\/\/wordpress.org\/plugins\/smart-marketing-for-wp\/#developers","refsource":"CONFIRM","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8974","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8974","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]}]";}i:522;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-12070";s:4:"slug";s:19:"advanced-woo-search";s:19:"versionEndExcluding";s:3:"2.0";s:11:"description";s:208:"The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request via the sql field to includes/class-aws-search.php.";s:4:"refs";s:767:"[{"url":"https:\/\/plugins.trac.wordpress.org\/browser\/advanced-woo-search\/tags\/1.99\/includes\/class-aws-search.php#L222","name":"https:\/\/plugins.trac.wordpress.org\/browser\/advanced-woo-search\/tags\/1.99\/includes\/class-aws-search.php#L222","refsource":"MISC","tags":[]},{"url":"https:\/\/plugins.trac.wordpress.org\/browser\/advanced-woo-search\/tags\/2.00\/includes\/class-aws-search.php?rev=2290090#L219","name":"https:\/\/plugins.trac.wordpress.org\/browser\/advanced-woo-search\/tags\/2.00\/includes\/class-aws-search.php?rev=2290090#L219","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/advanced-woo-search\/#developers","name":"https:\/\/wordpress.org\/plugins\/advanced-woo-search\/#developers","refsource":"MISC","tags":[]}]";}i:523;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9345";s:4:"slug";s:8:"link-log";s:19:"versionEndExcluding";s:3:"2.0";s:11:"description";s:73:"The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.";s:4:"refs";s:176:"[{"url":"https:\/\/wordpress.org\/plugins\/link-log\/#developers","name":"https:\/\/wordpress.org\/plugins\/link-log\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:524;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15816";s:4:"slug";s:23:"wp-private-content-plus";s:19:"versionEndExcluding";s:3:"2.0";s:11:"description";s:150:"The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ functions.";s:4:"refs";s:709:"[{"url":"https:\/\/blog.nintechnet.com\/unauthenticated-options-change-vulnerability-in-wordpress-wp-private-content-plus-plugin\/","name":"https:\/\/blog.nintechnet.com\/unauthenticated-options-change-vulnerability-in-wordpress-wp-private-content-plus-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-private-content-plus\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-private-content-plus\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9817","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9817","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:525;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14948";s:4:"slug";s:25:"woocommerce-product-addon";s:19:"versionEndExcluding";s:4:"18.4";s:11:"description";s:114:"The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.";s:4:"refs";s:780:"[{"url":"https:\/\/wordpress.org\/plugins\/woocommerce-product-addon\/#developers","name":"https:\/\/wordpress.org\/plugins\/woocommerce-product-addon\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9502","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9502","refsource":"MISC","tags":[]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2019\/08\/08\/this-authenticated-persistent-xss-vulnerability-might-be-what-hackers-are-targeting-ppom-for-woocommerce-for\/","name":"https:\/\/www.pluginvulnerabilities.com\/2019\/08\/08\/this-authenticated-persistent-xss-vulnerability-might-be-what-hackers-are-targeting-ppom-for-woocommerce-for\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:526;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15238";s:4:"slug";s:7:"cforms2";s:19:"versionEndExcluding";s:6:"15.0.2";s:11:"description";s:88:"The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.";s:4:"refs";s:346:"[{"url":"https:\/\/wordpress.org\/plugins\/cforms2\/#developers","name":"https:\/\/wordpress.org\/plugins\/cforms2\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9505","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9505","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:527;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9333";s:4:"slug";s:7:"cforms2";s:19:"versionEndExcluding";s:7:"14.6.10";s:11:"description";s:66:"The cforms2 plugin before 14.6.10 for WordPress has SQL injection.";s:4:"refs";s:314:"[{"url":"https:\/\/wordpress.org\/plugins\/cforms2\/#developers","name":"https:\/\/wordpress.org\/plugins\/cforms2\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9773","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9773","refsource":"MISC","tags":[]}]";}i:528;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18559";s:4:"slug";s:7:"cforms2";s:19:"versionEndExcluding";s:7:"14.13.3";s:11:"description";s:72:"The cforms2 plugin before 14.13.3 for WordPress has multiple XSS issues.";s:4:"refs";s:314:"[{"url":"https:\/\/wordpress.org\/plugins\/cforms2\/#developers","name":"https:\/\/wordpress.org\/plugins\/cforms2\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9727","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9727","refsource":"MISC","tags":[]}]";}i:529;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18570";s:4:"slug";s:7:"cforms2";s:19:"versionEndExcluding";s:5:"14.13";s:11:"description";s:126:"The cforms2 plugin before 14.13 for WordPress has SQL injection in the tracking DB GUI via Delete Entries or Download Entries.";s:4:"refs";s:174:"[{"url":"https:\/\/wordpress.org\/plugins\/cforms2\/#developers","name":"https:\/\/wordpress.org\/plugins\/cforms2\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:530;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10377";s:4:"slug";s:7:"cforms2";s:19:"versionEndExcluding";s:4:"13.2";s:11:"description";s:69:"The cforms2 plugin before 13.2 for WordPress has XSS in lib_ajax.php.";s:4:"refs";s:314:"[{"url":"https:\/\/wordpress.org\/plugins\/cforms2\/#developers","name":"https:\/\/wordpress.org\/plugins\/cforms2\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9812","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9812","refsource":"MISC","tags":[]}]";}i:531;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18515";s:4:"slug";s:13:"wp-statistics";s:19:"versionEndExcluding";s:6:"12.0.8";s:11:"description";s:71:"The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.";s:4:"refs";s:193:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-statistics\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-statistics\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:532;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-13478";s:4:"slug";s:13:"wordpress-seo";s:19:"versionEndExcluding";s:4:"11.7";s:11:"description";s:115:"The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions.";s:4:"refs";s:363:"[{"url":"https:\/\/github.com\/Yoast\/wordpress-seo\/releases\/tag\/11.6-RC5","name":"https:\/\/github.com\/Yoast\/wordpress-seo\/releases\/tag\/11.6-RC5","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9445","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9445","refsource":"MISC","tags":[]}]";}i:533;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-26511";s:4:"slug";s:12:"wpo365-login";s:19:"versionEndExcluding";s:4:"11.7";s:11:"description";s:110:"The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token.";s:4:"refs";s:461:"[{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2388992\/","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2388992\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/wpo365-login\/#developers","name":"https:\/\/wordpress.org\/plugins\/wpo365-login\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wpo365.com\/change-log\/","name":"https:\/\/www.wpo365.com\/change-log\/","refsource":"MISC","tags":[]}]";}i:534;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10393";s:4:"slug";s:7:"cforms2";s:19:"versionEndExcluding";s:4:"10.5";s:11:"description";s:53:"The cforms2 plugin before 10.5 for WordPress has XSS.";s:4:"refs";s:174:"[{"url":"https:\/\/wordpress.org\/plugins\/cforms2\/#developers","name":"https:\/\/wordpress.org\/plugins\/cforms2\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:535;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10392";s:4:"slug";s:7:"cforms2";s:19:"versionEndExcluding";s:4:"10.2";s:11:"description";s:53:"The cforms2 plugin before 10.2 for WordPress has XSS.";s:4:"refs";s:336:"[{"url":"https:\/\/wordpress.org\/plugins\/cforms2\/#developers","name":"https:\/\/wordpress.org\/plugins\/cforms2\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9621","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9621","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:536;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2018-5366";s:4:"slug";s:8:"wpglobus";s:19:"versionEndExcluding";s:5:"1.9.7";s:11:"description";s:122:"The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[more_languages] parameter to wp-admin/options.php.";s:4:"refs";s:415:"[{"url":"https:\/\/github.com\/d4wner\/Vulnerabilities-Report\/blob\/master\/wpglobus.md","name":"https:\/\/github.com\/d4wner\/Vulnerabilities-Report\/blob\/master\/wpglobus.md","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9003","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9003","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"]}]";}i:537;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9360";s:4:"slug";s:11:"updraftplus";s:19:"versionEndExcluding";s:6:"1.9.64";s:11:"description";s:102:"The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().";s:4:"refs";s:630:"[{"url":"https:\/\/blog.sucuri.net\/2015\/04\/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html","name":"https:\/\/blog.sucuri.net\/2015\/04\/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/updraftplus.com\/new-security-vulnerability-found-across-significant-numbers-of-wordpress-plugins-including-updraftplus\/","name":"https:\/\/updraftplus.com\/new-security-vulnerability-found-across-significant-numbers-of-wordpress-plugins-including-updraftplus\/","refsource":"MISC","tags":["Vendor Advisory"]}]";}i:538;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-18854";s:4:"slug";s:8:"safe-svg";s:19:"versionEndExcluding";s:5:"1.9.6";s:11:"description";s:192:"A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to unlimited recursion for a '<use ... xlink:href="#identifier">' substring.";s:4:"refs";s:607:"[{"url":"https:\/\/fortiguard.com\/zeroday\/FG-VD-19-113","name":"https:\/\/fortiguard.com\/zeroday\/FG-VD-19-113","refsource":"MISC","tags":[]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2185438","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2185438","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/safe-svg\/#developers","name":"https:\/\/wordpress.org\/plugins\/safe-svg\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9937","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9937","refsource":"MISC","tags":[]}]";}i:539;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-18855";s:4:"slug";s:8:"safe-svg";s:19:"versionEndExcluding";s:5:"1.9.6";s:11:"description";s:163:"A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to potentially unwanted elements or attributes.";s:4:"refs";s:607:"[{"url":"https:\/\/fortiguard.com\/zeroday\/FG-VD-19-113","name":"https:\/\/fortiguard.com\/zeroday\/FG-VD-19-113","refsource":"MISC","tags":[]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2185438","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2185438","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/safe-svg\/#developers","name":"https:\/\/wordpress.org\/plugins\/safe-svg\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9937","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9937","refsource":"MISC","tags":[]}]";}i:540;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-8596";s:4:"slug";s:21:"participants-database";s:19:"versionEndExcluding";s:7:"1.9.5.5";s:11:"description";s:304:"participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if certain conditions are met).";s:4:"refs";s:287:"[{"url":"https:\/\/blog.impenetrable.tech\/cve-2020-8596","name":"https:\/\/blog.impenetrable.tech\/cve-2020-8596","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10068","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10068","refsource":"MISC","tags":[]}]";}i:541;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-20204";s:4:"slug";s:6:"postie";s:19:"versionEndExcluding";s:6:"1.9.41";s:11:"description";s:150:"The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.";s:4:"refs";s:501:"[{"url":"https:\/\/github.com\/V1n1v131r4\/Exploiting-Postie-WordPress-Plugin-\/blob\/master\/README.md","name":"https:\/\/github.com\/V1n1v131r4\/Exploiting-Postie-WordPress-Plugin-\/blob\/master\/README.md","refsource":"MISC","tags":[]},{"url":"https:\/\/postieplugin.com\/","name":"https:\/\/postieplugin.com\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/postie\/#developers","name":"https:\/\/wordpress.org\/plugins\/postie\/#developers","refsource":"MISC","tags":[]}]";}i:542;O:8:"stdClass":6:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:10:"iwp-client";s:19:"versionEndExcluding";s:7:"1.9.4.5";s:11:"description";s:190:"The InfiniteWP Client plugin had an authentication security issue that was identified and reported by the team at WebARX Security on Jan 7th. The InfiniteWP team released a fix the next day.";s:14:"recommendation";s:30:"Update to 1.9.4.5 immediately.";s:4:"refs";s:0:"";}i:543;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-8772";s:4:"slug";s:10:"iwp-client";s:19:"versionEndExcluding";s:7:"1.9.4.5";s:11:"description";s:195:"The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.";s:4:"refs";s:359:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10011","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10011","refsource":"MISC","tags":[]},{"url":"https:\/\/www.webarxsecurity.com\/vulnerability-infinitewp-client-wp-time-capsule\/","name":"https:\/\/www.webarxsecurity.com\/vulnerability-infinitewp-client-wp-time-capsule\/","refsource":"MISC","tags":[]}]";}i:544;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18528";s:4:"slug";s:9:"pdf-print";s:19:"versionEndExcluding";s:5:"1.9.4";s:11:"description";s:72:"The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.";s:4:"refs";s:178:"[{"url":"https:\/\/wordpress.org\/plugins\/pdf-print\/#developers","name":"https:\/\/wordpress.org\/plugins\/pdf-print\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:545;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-28339";s:4:"slug";s:10:"usc-e-shop";s:19:"versionEndExcluding";s:6:"1.9.36";s:11:"description";s:170:"The usc-e-shop (aka Collne Welcart e-Commerce) plugin before 1.9.36 for WordPress allows Object Injection because of usces_unserialize. There is not a complete POP chain.";s:4:"refs";s:427:"[{"url":"https:\/\/wordpress.org\/plugins\/usc-e-shop\/#developers","name":"https:\/\/wordpress.org\/plugins\/usc-e-shop\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/11\/object-injection-vulnerability-in-welcart-e-commerce-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/11\/object-injection-vulnerability-in-welcart-e-commerce-plugin\/","refsource":"MISC","tags":[]}]";}i:546;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-5227";s:4:"slug";s:13:"Landing Pages";s:19:"versionEndExcluding";s:5:"1.9.2";s:11:"description";s:124:"The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter.";s:4:"refs";s:374:"[{"url":"https:\/\/wordpress.org\/plugins\/landing-pages\/#developers","name":"https:\/\/wordpress.org\/plugins\/landing-pages\/#developers","refsource":"CONFIRM","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8200","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8200","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:547;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18560";s:4:"slug";s:13:"content-audit";s:19:"versionEndExcluding";s:5:"1.9.2";s:11:"description";s:60:"The content-audit plugin before 1.9.2 for WordPress has XSS.";s:4:"refs";s:186:"[{"url":"https:\/\/wordpress.org\/plugins\/content-audit\/#developers","name":"https:\/\/wordpress.org\/plugins\/content-audit\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:548;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-1889";s:4:"slug";s:40:"Group creation process in the Buddypress";s:19:"versionEndExcluding";s:5:"1.9.2";s:11:"description";s:191:"The Group creation process in the Buddypress plugin before 1.9.2 for WordPress allows remote authenticated users to gain control of arbitrary groups by leveraging a missing permissions check.";s:4:"refs";s:738:"[{"url":"http:\/\/www.securityfocus.com\/archive\/1\/531050\/100\/0\/threaded","name":"20140213 Wordpress plugin Buddypress <= 1.9.1 privilege escalation vulnerability","refsource":"BUGTRAQ","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http:\/\/www.securityfocus.com\/bid\/65554","name":"65554","refsource":"BID","tags":["Third Party Advisory","VDB Entry"]},{"url":"https:\/\/buddypress.org\/2014\/02\/buddypress-1-9-2\/","name":"https:\/\/buddypress.org\/2014\/02\/buddypress-1-9-2\/","refsource":"CONFIRM","tags":["Vendor Advisory"]},{"url":"https:\/\/exchange.xforce.ibmcloud.com\/vulnerabilities\/91261","name":"buddypress-cve20141889-sec-bypass(91261)","refsource":"XF","tags":["Third Party Advisory","VDB Entry"]}]";}i:549;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10962";s:4:"slug";s:7:"icegram";s:19:"versionEndExcluding";s:6:"1.9.19";s:11:"description";s:104:"The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.";s:4:"refs";s:442:"[{"url":"https:\/\/sumofpwn.nl\/advisory\/2016\/cross_site_request_forgery_in_icegram_wordpress_plugin.html","name":"https:\/\/sumofpwn.nl\/advisory\/2016\/cross_site_request_forgery_in_icegram_wordpress_plugin.html","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/icegram\/#developers","name":"https:\/\/wordpress.org\/plugins\/icegram\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:550;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10962";s:4:"slug";s:7:"icegram";s:19:"versionEndExcluding";s:6:"1.9.19";s:11:"description";s:104:"The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.";s:4:"refs";s:442:"[{"url":"https:\/\/sumofpwn.nl\/advisory\/2016\/cross_site_request_forgery_in_icegram_wordpress_plugin.html","name":"https:\/\/sumofpwn.nl\/advisory\/2016\/cross_site_request_forgery_in_icegram_wordpress_plugin.html","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/icegram\/#developers","name":"https:\/\/wordpress.org\/plugins\/icegram\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:551;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10963";s:4:"slug";s:7:"icegram";s:19:"versionEndExcluding";s:6:"1.9.19";s:11:"description";s:55:"The icegram plugin before 1.9.19 for WordPress has XSS.";s:4:"refs";s:174:"[{"url":"https:\/\/wordpress.org\/plugins\/icegram\/#developers","name":"https:\/\/wordpress.org\/plugins\/icegram\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:552;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10963";s:4:"slug";s:7:"icegram";s:19:"versionEndExcluding";s:6:"1.9.19";s:11:"description";s:55:"The icegram plugin before 1.9.19 for WordPress has XSS.";s:4:"refs";s:174:"[{"url":"https:\/\/wordpress.org\/plugins\/icegram\/#developers","name":"https:\/\/wordpress.org\/plugins\/icegram\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:553;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15841";s:4:"slug";s:24:"facebook-for-woocommerce";s:19:"versionEndExcluding";s:6:"1.9.15";s:11:"description";s:169:"The facebook-for-woocommerce plugin before 1.9.15 for WordPress has CSRF via ajax_woo_infobanner_post_click, ajax_woo_infobanner_post_xout, or ajax_fb_toggle_visibility.";s:4:"refs";s:226:"[{"url":"https:\/\/wordpress.org\/plugins\/facebook-for-woocommerce\/#developers","name":"https:\/\/wordpress.org\/plugins\/facebook-for-woocommerce\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:554;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15840";s:4:"slug";s:24:"facebook-for-woocommerce";s:19:"versionEndExcluding";s:6:"1.9.14";s:11:"description";s:73:"The facebook-for-woocommerce plugin before 1.9.14 for WordPress has CSRF.";s:4:"refs";s:226:"[{"url":"https:\/\/wordpress.org\/plugins\/facebook-for-woocommerce\/#developers","name":"https:\/\/wordpress.org\/plugins\/facebook-for-woocommerce\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:555;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10919";s:4:"slug";s:6:"wassup";s:19:"versionEndExcluding";s:5:"1.9.1";s:11:"description";s:161:"The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.";s:4:"refs";s:195:"[{"url":"https:\/\/wordpress.org\/plugins\/wassup\/#developers","name":"https:\/\/wordpress.org\/plugins\/wassup\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:556;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10919";s:4:"slug";s:6:"wassup";s:19:"versionEndExcluding";s:5:"1.9.1";s:11:"description";s:161:"The wassup plugin before 1.9.1 for WordPress has XSS via the Top stats widget or the wassupURI::add_siteurl method, a different vulnerability than CVE-2012-2633.";s:4:"refs";s:195:"[{"url":"https:\/\/wordpress.org\/plugins\/wassup\/#developers","name":"https:\/\/wordpress.org\/plugins\/wassup\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:557;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-0173";s:4:"slug";s:7:"Jetpack";s:19:"versionEndExcluding";s:20:"1.9 before 1.9.4, 2.";s:11:"description";s:495:"The Jetpack plugin before 1.9 before 1.9.4, 2.0.x before 2.0.9, 2.1.x before 2.1.4, 2.2.x before 2.2.7, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.2, 2.6.x before 2.6.3, 2.7.x before 2.7.2, 2.8.x before 2.8.2, and 2.9.x before 2.9.3 for WordPress does not properly restrict access to the XML-RPC service, which allows remote attackers to bypass intended restrictions and publish posts via unspecified vectors.  NOTE: some of these details are obtained from third party information.";s:4:"refs";s:558:"[{"url":"http:\/\/jetpack.me\/2014\/04\/10\/jetpack-security-update\/","name":"http:\/\/jetpack.me\/2014\/04\/10\/jetpack-security-update\/","refsource":"CONFIRM","tags":["Vendor Advisory"]},{"url":"http:\/\/secunia.com\/advisories\/57729","name":"57729","refsource":"SECUNIA","tags":["Vendor Advisory"]},{"url":"http:\/\/www.securityfocus.com\/bid\/66789","name":"66789","refsource":"BID","tags":[]},{"url":"https:\/\/exchange.xforce.ibmcloud.com\/vulnerabilities\/92560","name":"jetpack-wordpress-cve20140173-sec-bypass(92560)","refsource":"XF","tags":[]}]";}i:558;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9461";s:4:"slug";s:28:"awesome-filterable-portfolio";s:19:"versionEndExcluding";s:3:"1.9";s:11:"description";s:141:"The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_portfolio_item_page SQL injection via the item_id parameter.";s:4:"refs";s:647:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_082287dbf7a24d415ff71581fc248330.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_082287dbf7a24d415ff71581fc248330.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/awesome-filterable-portfolio\/#developers","name":"https:\/\/wordpress.org\/plugins\/awesome-filterable-portfolio\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8311","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8311","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:559;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9462";s:4:"slug";s:28:"awesome-filterable-portfolio";s:19:"versionEndExcluding";s:3:"1.9";s:11:"description";s:134:"The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_category_page SQL injection via the cat_id parameter.";s:4:"refs";s:647:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_082287dbf7a24d415ff71581fc248330.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_082287dbf7a24d415ff71581fc248330.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/awesome-filterable-portfolio\/#developers","name":"https:\/\/wordpress.org\/plugins\/awesome-filterable-portfolio\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8311","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8311","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:560;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10918";s:4:"slug";s:20:"gallery-by-supsystic";s:19:"versionEndExcluding";s:5:"1.8.6";s:11:"description";s:68:"The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.";s:4:"refs";s:223:"[{"url":"https:\/\/wordpress.org\/plugins\/gallery-by-supsystic\/#developers","name":"https:\/\/wordpress.org\/plugins\/gallery-by-supsystic\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:561;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10918";s:4:"slug";s:20:"gallery-by-supsystic";s:19:"versionEndExcluding";s:5:"1.8.6";s:11:"description";s:68:"The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.";s:4:"refs";s:223:"[{"url":"https:\/\/wordpress.org\/plugins\/gallery-by-supsystic\/#developers","name":"https:\/\/wordpress.org\/plugins\/gallery-by-supsystic\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:562;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10935";s:4:"slug";s:20:"woocommerce-exporter";s:19:"versionEndExcluding";s:5:"1.8.4";s:11:"description";s:84:"The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.";s:4:"refs";s:200:"[{"url":"https:\/\/wordpress.org\/plugins\/woocommerce-exporter\/#developers","name":"https:\/\/wordpress.org\/plugins\/woocommerce-exporter\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:563;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10935";s:4:"slug";s:20:"woocommerce-exporter";s:19:"versionEndExcluding";s:5:"1.8.4";s:11:"description";s:84:"The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.";s:4:"refs";s:200:"[{"url":"https:\/\/wordpress.org\/plugins\/woocommerce-exporter\/#developers","name":"https:\/\/wordpress.org\/plugins\/woocommerce-exporter\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:564;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-7107";s:4:"slug";s:13:"ultimate-faqs";s:19:"versionEndExcluding";s:6:"1.8.30";s:11:"description";s:109:"The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.";s:4:"refs";s:449:"[{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2222959\/ultimate-faqs\/tags\/1.8.30\/Shortcodes\/DisplayFAQs.php","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2222959\/ultimate-faqs\/tags\/1.8.30\/Shortcodes\/DisplayFAQs.php","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/ultimate-faqs\/#developers","name":"https:\/\/wordpress.org\/plugins\/ultimate-faqs\/#developers","refsource":"MISC","tags":[]}]";}i:565;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18531";s:4:"slug";s:9:"raygun4wp";s:19:"versionEndExcluding";s:5:"1.8.3";s:11:"description";s:110:"The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings, a different issue than CVE-2017-9288.";s:4:"refs";s:178:"[{"url":"https:\/\/wordpress.org\/plugins\/raygun4wp\/#developers","name":"https:\/\/wordpress.org\/plugins\/raygun4wp\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:566;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-20633";s:4:"slug";s:15:"cookie-law-info";s:19:"versionEndExcluding";s:5:"1.8.3";s:11:"description";s:236:"ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent (cookie-law-info) 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation.";s:4:"refs";s:229:"[{"url":"https:\/\/blog.nintechnet.com\/wordpress-gdpr-cookie-consent-plugin-fixed-vulnerability\/","name":"https:\/\/blog.nintechnet.com\/wordpress-gdpr-cookie-consent-plugin-fixed-vulnerability\/","refsource":"MISC","tags":[]}]";}i:567;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2016-4825";s:4:"slug";s:25:"Collne Welcart e-Commerce";s:19:"versionEndExcluding";s:5:"1.8.3";s:11:"description";s:187:"The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted serialized data.";s:4:"refs";s:433:"[{"url":"http:\/\/jvn.jp\/en\/jp\/JVN47363774\/index.html","name":"JVN#47363774","refsource":"JVN","tags":["Vendor Advisory"]},{"url":"http:\/\/jvndb.jvn.jp\/jvndb\/JVNDB-2016-000115","name":"JVNDB-2016-000115","refsource":"JVNDB","tags":["Vendor Advisory"]},{"url":"http:\/\/www.welcart.com\/community\/archives\/78977","name":"http:\/\/www.welcart.com\/community\/archives\/78977","refsource":"CONFIRM","tags":["Vendor Advisory"]}]";}i:568;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2016-4828";s:4:"slug";s:25:"Collne Welcart e-Commerce";s:19:"versionEndExcluding";s:5:"1.8.3";s:11:"description";s:205:"The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by leveraging knowledge of the e-mail address associated with an account.";s:4:"refs";s:433:"[{"url":"http:\/\/jvn.jp\/en\/jp\/JVN61578437\/index.html","name":"JVN#61578437","refsource":"JVN","tags":["Vendor Advisory"]},{"url":"http:\/\/jvndb.jvn.jp\/jvndb\/JVNDB-2016-000118","name":"JVNDB-2016-000118","refsource":"JVNDB","tags":["Vendor Advisory"]},{"url":"http:\/\/www.welcart.com\/community\/archives\/78977","name":"http:\/\/www.welcart.com\/community\/archives\/78977","refsource":"CONFIRM","tags":["Vendor Advisory"]}]";}i:569;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17233";s:4:"slug";s:13:"ultimate-faqs";s:19:"versionEndExcluding";s:6:"1.8.25";s:11:"description";s:117:"Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.";s:4:"refs";s:660:"[{"url":"https:\/\/blog.nintechnet.com\/unauthenticated-options-import-vulnerability-in-wordpress-ultimate-faq-plugin\/","name":"https:\/\/blog.nintechnet.com\/unauthenticated-options-import-vulnerability-in-wordpress-ultimate-faq-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/ultimate-faqs\/#developers","name":"https:\/\/wordpress.org\/plugins\/ultimate-faqs\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9883","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9883","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:570;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15643";s:4:"slug";s:13:"ultimate-faqs";s:19:"versionEndExcluding";s:6:"1.8.22";s:11:"description";s:61:"The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.";s:4:"refs";s:348:"[{"url":"https:\/\/wordpress.org\/plugins\/ultimate-faqs\/#developers","name":"https:\/\/wordpress.org\/plugins\/ultimate-faqs\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9833","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9833","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:571;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9361";s:4:"slug";s:13:"Related Posts";s:19:"versionEndExcluding";s:5:"1.8.2";s:11:"description";s:103:"The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().";s:4:"refs";s:503:"[{"url":"https:\/\/blog.sucuri.net\/2015\/04\/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html","name":"https:\/\/blog.sucuri.net\/2015\/04\/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.barrykooij.com\/several-security-updates-released\/","name":"https:\/\/www.barrykooij.com\/several-security-updates-released\/","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:572;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-9393";s:4:"slug";s:26:"pricing-table-by-supsystic";s:19:"versionEndExcluding";s:5:"1.8.2";s:11:"description";s:107:"An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS.";s:4:"refs";s:197:"[{"url":"https:\/\/wordpress.org\/plugins\/pricing-table-by-supsystic\/#developers","name":"https:\/\/wordpress.org\/plugins\/pricing-table-by-supsystic\/#developers","refsource":"MISC","tags":[]}]";}i:573;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-9394";s:4:"slug";s:26:"pricing-table-by-supsystic";s:19:"versionEndExcluding";s:5:"1.8.2";s:11:"description";s:108:"An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF.";s:4:"refs";s:197:"[{"url":"https:\/\/wordpress.org\/plugins\/pricing-table-by-supsystic\/#developers","name":"https:\/\/wordpress.org\/plugins\/pricing-table-by-supsystic\/#developers","refsource":"MISC","tags":[]}]";}i:574;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-20182";s:4:"slug";s:10:"foogallery";s:19:"versionEndExcluding";s:6:"1.8.18";s:11:"description";s:82:"The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter.";s:4:"refs";s:337:"[{"url":"https:\/\/medium.com\/@Pablo0xSantiago\/cve-2019-20182-foogallery-image-gallery-wordpress-plugin-1-8-12-stored-cross-site-scripting-d5864f1259f","name":"https:\/\/medium.com\/@Pablo0xSantiago\/cve-2019-20182-foogallery-image-gallery-wordpress-plugin-1-8-12-stored-cross-site-scripting-d5864f1259f","refsource":"MISC","tags":[]}]";}i:575;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16524";s:4:"slug";s:13:"easy-fancybox";s:19:"versionEndExcluding";s:6:"1.8.18";s:11:"description";s:281:"The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output filter.";s:4:"refs";s:702:"[{"url":"https:\/\/github.com\/sbaresearch\/advisories\/tree\/public\/2019\/SBA-ADV-20190911-01_Easy_FancyBox_WP_Plugin_Stored_XSS","name":"https:\/\/github.com\/sbaresearch\/advisories\/tree\/public\/2019\/SBA-ADV-20190911-01_Easy_FancyBox_WP_Plugin_Stored_XSS","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/easy-fancybox\/#developers","name":"https:\/\/wordpress.org\/plugins\/easy-fancybox\/#developers","refsource":"CONFIRM","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9891","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9891","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:576;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:47:"yith-color-and-label-variations-for-woocommerce";s:19:"versionEndExcluding";s:6:"1.8.13";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:577;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17574";s:4:"slug";s:11:"popup-maker";s:19:"versionEndExcluding";s:6:"1.8.13";s:11:"description";s:328:"An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the do_action function to invoke certain popmake_ or pum_ methods, as demonstrated by controlling content and delivery of popmake-system-info.txt (aka the "support debug text file").";s:4:"refs";s:570:"[{"url":"http:\/\/blog.redyops.com\/wordpress-plugin-popup-maker\/","name":"http:\/\/blog.redyops.com\/wordpress-plugin-popup-maker\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/github.com\/PopupMaker\/Popup-Maker\/blob\/master\/CHANGELOG.md","name":"https:\/\/github.com\/PopupMaker\/Popup-Maker\/blob\/master\/CHANGELOG.md","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9907","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9907","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:578;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18596";s:4:"slug";s:9:"elementor";s:19:"versionEndExcluding";s:5:"1.8.0";s:11:"description";s:100:"The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.";s:4:"refs";s:340:"[{"url":"https:\/\/wordpress.org\/plugins\/elementor\/#developers","name":"https:\/\/wordpress.org\/plugins\/elementor\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8965","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8965","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:579;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-14313";s:4:"slug";s:66:"shibboleth_login_form function in shibboleth.php in the Shibboleth";s:19:"versionEndExcluding";s:3:"1.8";s:11:"description";s:175:"The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg().";s:4:"refs";s:723:"[{"url":"http:\/\/www.debian.org\/security\/2017\/dsa-3973","name":"DSA-3973","refsource":"DEBIAN","tags":[]},{"url":"https:\/\/bugs.debian.org\/874416","name":"https:\/\/bugs.debian.org\/874416","refsource":"CONFIRM","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https:\/\/github.com\/michaelryanmcneill\/shibboleth\/commit\/1d65ad6786282d23ba1865f56e2fd19188e7c26a","name":"https:\/\/github.com\/michaelryanmcneill\/shibboleth\/commit\/1d65ad6786282d23ba1865f56e2fd19188e7c26a","refsource":"CONFIRM","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8901","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8901","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:580;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-10309";s:4:"slug";s:25:"Responsive Cookie Consent";s:19:"versionEndExcluding";s:3:"1.8";s:11:"description";s:103:"The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS.";s:4:"refs";s:726:"[{"url":"https:\/\/gist.github.com\/B0UG\/f0cfb356e23be3cd6ebea69566d6100a","name":"https:\/\/gist.github.com\/B0UG\/f0cfb356e23be3cd6ebea69566d6100a","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/responsive-cookie-consent\/#developers","name":"https:\/\/wordpress.org\/plugins\/responsive-cookie-consent\/#developers","refsource":"CONFIRM","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9067","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9067","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.exploit-db.com\/exploits\/44563\/","name":"44563","refsource":"EXPLOIT-DB","tags":["Third Party Advisory","VDB Entry"]}]";}i:581;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-2558";s:4:"slug";s:12:"File Gallery";s:19:"versionEndExcluding";s:7:"1.7.9.2";s:11:"description";s:273:"The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function.";s:4:"refs";s:566:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2014\/Apr\/305","name":"20140429 Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin)","refsource":"FULLDISC","tags":["Exploit"]},{"url":"http:\/\/wordpress.org\/plugins\/file-gallery\/changelog\/","name":"http:\/\/wordpress.org\/plugins\/file-gallery\/changelog\/","refsource":"MISC","tags":["Patch"]},{"url":"http:\/\/www.securityfocus.com\/bid\/67120","name":"67120","refsource":"BID","tags":[]},{"url":"http:\/\/www.securityfocus.com\/bid\/67183","name":"67183","refsource":"BID","tags":[]}]";}i:582;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10915";s:4:"slug";s:18:"popup-by-supsystic";s:19:"versionEndExcluding";s:5:"1.7.9";s:11:"description";s:66:"The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.";s:4:"refs";s:196:"[{"url":"https:\/\/wordpress.org\/plugins\/popup-by-supsystic\/#developers","name":"https:\/\/wordpress.org\/plugins\/popup-by-supsystic\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:583;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18496";s:4:"slug";s:8:"htaccess";s:19:"versionEndExcluding";s:5:"1.7.6";s:11:"description";s:71:"The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.";s:4:"refs";s:199:"[{"url":"https:\/\/wordpress.org\/plugins\/htaccess\/#developers","name":"https:\/\/wordpress.org\/plugins\/htaccess\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:584;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-14126";s:4:"slug";s:21:"Participants Database";s:19:"versionEndExcluding";s:8:"1.7.5.10";s:11:"description";s:71:"The Participants Database plugin before 1.7.5.10 for WordPress has XSS.";s:4:"refs";s:534:"[{"url":"https:\/\/limbenjamin.com\/articles\/cve-2017-14126-participants-database-xss.html","name":"https:\/\/limbenjamin.com\/articles\/cve-2017-14126-participants-database-xss.html","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/participants-database\/#developers","name":"https:\/\/wordpress.org\/plugins\/participants-database\/#developers","refsource":"CONFIRM","tags":["Third Party Advisory"]},{"url":"https:\/\/www.exploit-db.com\/exploits\/42618\/","name":"42618","refsource":"EXPLOIT-DB","tags":[]}]";}i:585;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:36:"yith-woocommerce-multi-step-checkout";s:19:"versionEndExcluding";s:5:"1.7.5";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:586;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-2292";s:4:"slug";s:13:"wordpress-seo";s:19:"versionEndExcluding";s:5:"1.7.4";s:11:"description";s:453:"Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php.  NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands.";s:4:"refs";s:1156:"[{"url":"http:\/\/packetstormsecurity.com\/files\/130811\/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html","name":"http:\/\/packetstormsecurity.com\/files\/130811\/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html","refsource":"MISC","tags":["Exploit"]},{"url":"http:\/\/seclists.org\/fulldisclosure\/2015\/Mar\/73","name":"20150312 WordPress SEO by Yoast <= 1.7.3.3 - Blind SQL Injection","refsource":"FULLDISC","tags":["Exploit"]},{"url":"http:\/\/www.securitytracker.com\/id\/1031920","name":"1031920","refsource":"SECTRACK","tags":["Exploit"]},{"url":"https:\/\/wordpress.org\/plugins\/wordpress-seo\/changelog\/","name":"https:\/\/wordpress.org\/plugins\/wordpress-seo\/changelog\/","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/7841","name":"https:\/\/wpvulndb.com\/vulnerabilities\/7841","refsource":"MISC","tags":["Exploit"]},{"url":"https:\/\/www.exploit-db.com\/exploits\/36413\/","name":"36413","refsource":"EXPLOIT-DB","tags":[]},{"url":"https:\/\/yoast.com\/wordpress-seo-security-release\/","name":"https:\/\/yoast.com\/wordpress-seo-security-release\/","refsource":"CONFIRM","tags":["Vendor Advisory"]}]";}i:587;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-2293";s:4:"slug";s:13:"wordpress-seo";s:19:"versionEndExcluding";s:5:"1.7.4";s:11:"description";s:400:"Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.";s:4:"refs";s:1039:"[{"url":"http:\/\/packetstormsecurity.com\/files\/130811\/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html","name":"http:\/\/packetstormsecurity.com\/files\/130811\/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html","refsource":"MISC","tags":["Exploit"]},{"url":"http:\/\/seclists.org\/fulldisclosure\/2015\/Mar\/73","name":"20150312 WordPress SEO by Yoast <= 1.7.3.3 - Blind SQL Injection","refsource":"FULLDISC","tags":["Exploit"]},{"url":"http:\/\/www.securitytracker.com\/id\/1031920","name":"1031920","refsource":"SECTRACK","tags":["Exploit"]},{"url":"https:\/\/wordpress.org\/plugins\/wordpress-seo\/changelog\/","name":"https:\/\/wordpress.org\/plugins\/wordpress-seo\/changelog\/","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/7841","name":"https:\/\/wpvulndb.com\/vulnerabilities\/7841","refsource":"MISC","tags":[]},{"url":"https:\/\/yoast.com\/wordpress-seo-security-release\/","name":"https:\/\/yoast.com\/wordpress-seo-security-release\/","refsource":"CONFIRM","tags":["Vendor Advisory"]}]";}i:588;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18609";s:4:"slug";s:12:"magic-fields";s:19:"versionEndExcluding";s:5:"1.7.2";s:11:"description";s:99:"The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.";s:4:"refs";s:495:"[{"url":"https:\/\/sumofpwn.nl\/advisory\/2016\/cross_site_scripting_in_magic_fields_1_wordpress_plugin.html","name":"https:\/\/sumofpwn.nl\/advisory\/2016\/cross_site_scripting_in_magic_fields_1_wordpress_plugin.html","refsource":"MISC","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/magic-fields\/#developers","name":"https:\/\/wordpress.org\/plugins\/magic-fields\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:589;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18610";s:4:"slug";s:12:"magic-fields";s:19:"versionEndExcluding";s:5:"1.7.2";s:11:"description";s:125:"The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.";s:4:"refs";s:495:"[{"url":"https:\/\/sumofpwn.nl\/advisory\/2016\/cross_site_scripting_in_magic_fields_1_wordpress_plugin.html","name":"https:\/\/sumofpwn.nl\/advisory\/2016\/cross_site_scripting_in_magic_fields_1_wordpress_plugin.html","refsource":"MISC","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/magic-fields\/#developers","name":"https:\/\/wordpress.org\/plugins\/magic-fields\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:590;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18611";s:4:"slug";s:12:"magic-fields";s:19:"versionEndExcluding";s:5:"1.7.2";s:11:"description";s:126:"The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.";s:4:"refs";s:495:"[{"url":"https:\/\/sumofpwn.nl\/advisory\/2016\/cross_site_scripting_in_magic_fields_1_wordpress_plugin.html","name":"https:\/\/sumofpwn.nl\/advisory\/2016\/cross_site_scripting_in_magic_fields_1_wordpress_plugin.html","refsource":"MISC","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/magic-fields\/#developers","name":"https:\/\/wordpress.org\/plugins\/magic-fields\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:591;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15867";s:4:"slug";s:11:"slick-popup";s:19:"versionEndExcluding";s:5:"1.7.2";s:11:"description";s:166:"The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber calls a certain AJAX action.";s:4:"refs";s:666:"[{"url":"https:\/\/wordpress.org\/plugins\/slick-popup\/#developers","name":"https:\/\/wordpress.org\/plugins\/slick-popup\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9317","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9317","refsource":"MISC","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https:\/\/www.wordfence.com\/blog\/2019\/05\/privilege-escalation-flaw-present-in-slick-popup-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2019\/05\/privilege-escalation-flaw-present-in-slick-popup-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:592;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9434";s:4:"slug";s:18:"kiwi-logo-carousel";s:19:"versionEndExcluding";s:5:"1.7.2";s:11:"description";s:184:"The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.";s:4:"refs";s:631:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_3764bb40db5ed12aac2c7812d7544730.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_3764bb40db5ed12aac2c7812d7544730.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/kiwi-logo-carousel\/#developers","name":"https:\/\/wordpress.org\/plugins\/kiwi-logo-carousel\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8290","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8290","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:593;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9433";s:4:"slug";s:27:"wp-social-bookmarking-light";s:19:"versionEndExcluding";s:6:"1.7.10";s:11:"description";s:247:"The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc. in wp-admin/options-general.php?page=wp-social-bookmarking-light%2Fmodules%2Fadmin.php.";s:4:"refs";s:642:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_58e88633599b7b2fc0f44ce6fa7ff27d.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_58e88633599b7b2fc0f44ce6fa7ff27d.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-social-bookmarking-light\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-social-bookmarking-light\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8252","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8252","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:594;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18556";s:4:"slug";s:20:"bws-google-analytics";s:19:"versionEndExcluding";s:5:"1.7.1";s:11:"description";s:83:"The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.";s:4:"refs";s:200:"[{"url":"https:\/\/wordpress.org\/plugins\/bws-google-analytics\/#developers","name":"https:\/\/wordpress.org\/plugins\/bws-google-analytics\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:595;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:28:"yith-woocommerce-ajax-search";s:19:"versionEndExcluding";s:5:"1.7.1";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:596;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9296";s:4:"slug";s:16:"download-monitor";s:19:"versionEndExcluding";s:5:"1.7.1";s:11:"description";s:88:"The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.";s:4:"refs";s:215:"[{"url":"https:\/\/wordpress.org\/plugins\/download-monitor\/#developers","name":"https:\/\/wordpress.org\/plugins\/download-monitor\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:597;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19109";s:4:"slug";s:6:"wpforo";s:19:"versionEndExcluding";s:5:"1.7.0";s:11:"description";s:92:"The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF.";s:4:"refs";s:169:"[{"url":"https:\/\/twitter.com\/Sh0ckFR\/status\/1257298443527053313","name":"https:\/\/twitter.com\/Sh0ckFR\/status\/1257298443527053313","refsource":"MISC","tags":[]}]";}i:598;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19110";s:4:"slug";s:6:"wpforo";s:19:"versionEndExcluding";s:5:"1.7.0";s:11:"description";s:108:"The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter.";s:4:"refs";s:201:"[{"url":"https:\/\/twitter.com\/Sh0ckFR\/status\/1257298443527053313","name":"https:\/\/twitter.com\/Sh0ckFR\/status\/1257298443527053313","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:599;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19111";s:4:"slug";s:6:"wpforo";s:19:"versionEndExcluding";s:5:"1.7.0";s:11:"description";s:113:"The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter.";s:4:"refs";s:201:"[{"url":"https:\/\/twitter.com\/Sh0ckFR\/status\/1257298443527053313","name":"https:\/\/twitter.com\/Sh0ckFR\/status\/1257298443527053313","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:600;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19112";s:4:"slug";s:6:"wpforo";s:19:"versionEndExcluding";s:5:"1.7.0";s:11:"description";s:102:"The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.";s:4:"refs";s:201:"[{"url":"https:\/\/twitter.com\/Sh0ckFR\/status\/1257298443527053313","name":"https:\/\/twitter.com\/Sh0ckFR\/status\/1257298443527053313","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:601;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9350";s:4:"slug";s:16:"feed-them-social";s:19:"versionEndExcluding";s:5:"1.7.0";s:11:"description";s:112:"The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.";s:4:"refs";s:192:"[{"url":"https:\/\/wordpress.org\/plugins\/feed-them-social\/#developers","name":"https:\/\/wordpress.org\/plugins\/feed-them-social\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:602;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9351";s:4:"slug";s:16:"feed-them-social";s:19:"versionEndExcluding";s:5:"1.7.0";s:11:"description";s:127:"The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.";s:4:"refs";s:192:"[{"url":"https:\/\/wordpress.org\/plugins\/feed-them-social\/#developers","name":"https:\/\/wordpress.org\/plugins\/feed-them-social\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:603;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10883";s:4:"slug";s:25:"simple-add-pages-or-posts";s:19:"versionEndExcluding";s:3:"1.7";s:11:"description";s:90:"The simple-add-pages-or-posts plugin before 1.7 for WordPress has CSRF for deleting users.";s:4:"refs";s:234:"[{"url":"https:\/\/wordpress.org\/plugins\/simple-add-pages-or-posts\/#developers","name":"https:\/\/wordpress.org\/plugins\/simple-add-pages-or-posts\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:604;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15773";s:4:"slug";s:9:"nd-travel";s:19:"versionEndExcluding";s:3:"1.7";s:11:"description";s:120:"The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.";s:4:"refs";s:635:"[{"url":"https:\/\/threatpost.com\/wordpress-plugins-exploited-in-ongoing-attack-researchers-warn\/147671\/","name":"https:\/\/threatpost.com\/wordpress-plugins-exploited-in-ongoing-attack-researchers-warn\/147671\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/nd-travel\/#developers","name":"https:\/\/wordpress.org\/plugins\/nd-travel\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9491","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9491","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:605;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15833";s:4:"slug";s:27:"simple-mail-address-encoder";s:19:"versionEndExcluding";s:3:"1.7";s:11:"description";s:82:"The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.";s:4:"refs";s:377:"[{"url":"https:\/\/wordpress.org\/plugins\/simple-mail-address-encoder\/#developers","name":"https:\/\/wordpress.org\/plugins\/simple-mail-address-encoder\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9418","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9418","refsource":"MISC","tags":[]}]";}i:606;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19306";s:4:"slug";s:14:"zoho-crm-forms";s:19:"versionEndExcluding";s:7:"1.6.9.2";s:11:"description";s:106:"The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName.";s:4:"refs";s:349:"[{"url":"https:\/\/github.com\/cybersecurityworks\/Disclosed\/issues\/16","name":"https:\/\/github.com\/cybersecurityworks\/Disclosed\/issues\/16","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/zoho-crm-forms\/#developers","name":"https:\/\/wordpress.org\/plugins\/zoho-crm-forms\/#developers","refsource":"MISC","tags":[]}]";}i:607;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9457";s:4:"slug";s:11:"pretty-link";s:19:"versionEndExcluding";s:5:"1.6.8";s:11:"description";s:124:"The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter.";s:4:"refs";s:590:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_9ca443a3759e5c7fd889ae0e02e044e6.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_9ca443a3759e5c7fd889ae0e02e044e6.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/pretty-link\/#developers","name":"https:\/\/wordpress.org\/plugins\/pretty-link\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8249","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8249","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:608;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2008-7321";s:4:"slug";s:9:"tubepress";s:19:"versionEndExcluding";s:5:"1.6.5";s:11:"description";s:56:"The tubepress plugin before 1.6.5 for WordPress has XSS.";s:4:"refs";s:178:"[{"url":"https:\/\/wordpress.org\/plugins\/tubepress\/#developers","name":"https:\/\/wordpress.org\/plugins\/tubepress\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:609;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-27615";s:4:"slug";s:9:"loginizer";s:19:"versionEndExcluding";s:5:"1.6.4";s:11:"description";s:141:"The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.";s:4:"refs";s:769:"[{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2401010\/loginizer","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2401010\/loginizer","refsource":"MISC","tags":[]},{"url":"https:\/\/wpdeeply.com\/loginizer-before-1-6-4-sqli-injection\/","name":"https:\/\/wpdeeply.com\/loginizer-before-1-6-4-sqli-injection\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpscan.com\/vulnerability\/10441","name":"https:\/\/wpscan.com\/vulnerability\/10441","refsource":"MISC","tags":[]},{"url":"https:\/\/www.zdnet.com\/article\/wordpress-deploys-forced-security-update-for-dangerous-bug-in-popular-plugin\/","name":"https:\/\/www.zdnet.com\/article\/wordpress-deploys-forced-security-update-for-dangerous-bug-in-popular-plugin\/","refsource":"MISC","tags":[]}]";}i:610;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-14766";s:4:"slug";s:21:"Simple Student Result";s:19:"versionEndExcluding";s:5:"1.6.4";s:11:"description";s:243:"The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fn_ssr_add_st_submit() function and fn_ssr_del_st_submit() function in functions.php only require knowing the student id number.";s:4:"refs";s:629:"[{"url":"https:\/\/limbenjamin.com\/articles\/simple-student-result-auth-bypass.html","name":"https:\/\/limbenjamin.com\/articles\/simple-student-result-auth-bypass.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/simple-student-result\/#developers","name":"https:\/\/wordpress.org\/plugins\/simple-student-result\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8920","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8920","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:611;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:27:"yith-woocommerce-affiliates";s:19:"versionEndExcluding";s:5:"1.6.3";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:612;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9326";s:4:"slug";s:29:"wp-business-intelligence-lite";s:19:"versionEndExcluding";s:5:"1.6.3";s:11:"description";s:86:"The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.";s:4:"refs";s:218:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-business-intelligence-lite\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-business-intelligence-lite\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:613;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9319";s:4:"slug";s:26:"gregs-high-performance-seo";s:19:"versionEndExcluding";s:5:"1.6.2";s:11:"description";s:106:"The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.";s:4:"refs";s:212:"[{"url":"https:\/\/wordpress.org\/plugins\/gregs-high-performance-seo\/#developers","name":"https:\/\/wordpress.org\/plugins\/gregs-high-performance-seo\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:614;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9449";s:4:"slug";s:16:"microblog-poster";s:19:"versionEndExcluding";s:5:"1.6.2";s:11:"description";s:156:"The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.";s:4:"refs";s:620:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_642d8f7d8715d08f070a35b896f2d8bd.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_642d8f7d8715d08f070a35b896f2d8bd.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/microblog-poster\/#developers","name":"https:\/\/wordpress.org\/plugins\/microblog-poster\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8321","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8321","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:615;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9455";s:4:"slug";s:24:"buddypress-activity-plus";s:19:"versionEndExcluding";s:5:"1.6.2";s:11:"description";s:199:"The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action.";s:4:"refs";s:502:"[{"url":"https:\/\/security.dxw.com\/advisories\/csrf-and-arbitrary-file-deletion-in-buddypress-activity-plus-1-5\/","name":"https:\/\/security.dxw.com\/advisories\/csrf-and-arbitrary-file-deletion-in-buddypress-activity-plus-1-5\/","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/buddypress-activity-plus\/#developers","name":"https:\/\/wordpress.org\/plugins\/buddypress-activity-plus\/#developers","refsource":"MISC","tags":["Product","Release Notes"]}]";}i:616;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10968";s:4:"slug";s:11:"peepso-core";s:19:"versionEndExcluding";s:5:"1.6.1";s:11:"description";s:112:"The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation.";s:4:"refs";s:425:"[{"url":"http:\/\/www.pritect.net\/blog\/peepso-1-6-0-logged-user-privilege-escalation","name":"http:\/\/www.pritect.net\/blog\/peepso-1-6-0-logged-user-privilege-escalation","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/peepso-core\/#developers","name":"https:\/\/wordpress.org\/plugins\/peepso-core\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]}]";}i:617;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15770";s:4:"slug";s:16:"woo-address-book";s:19:"versionEndExcluding";s:5:"1.6.0";s:11:"description";s:104:"The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.";s:4:"refs";s:354:"[{"url":"https:\/\/wordpress.org\/plugins\/woo-address-book\/#developers","name":"https:\/\/wordpress.org\/plugins\/woo-address-book\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9849","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9849","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:618;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9496";s:4:"slug";s:20:"freshmail-newsletter";s:19:"versionEndExcluding";s:3:"1.6";s:11:"description";s:121:"The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FM_form id=' substring.";s:4:"refs";s:247:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/7972","name":"https:\/\/wpvulndb.com\/vulnerabilities\/7972","refsource":"MISC","tags":[]},{"url":"https:\/\/www.exploit-db.com\/exploits\/36942","name":"36942","refsource":"EXPLOIT-DB","tags":[]}]";}i:619;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9567";s:4:"slug";s:10:"forminator";s:19:"versionEndExcluding";s:3:"1.6";s:11:"description";s:126:"The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.";s:4:"refs";s:848:"[{"url":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/4","name":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/4","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-forminator-persistent-xss-blind-sql-injection\/","name":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-forminator-persistent-xss-blind-sql-injection\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/forminator\/#developers","name":"https:\/\/wordpress.org\/plugins\/forminator\/#developers","refsource":"MISC","tags":["Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9215","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9215","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:620;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9568";s:4:"slug";s:10:"forminator";s:19:"versionEndExcluding";s:3:"1.6";s:11:"description";s:212:"The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry[] parameter if the attacker has the delete permission.";s:4:"refs";s:864:"[{"url":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/4","name":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/4","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-forminator-persistent-xss-blind-sql-injection\/","name":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-forminator-persistent-xss-blind-sql-injection\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/forminator\/#developers","name":"https:\/\/wordpress.org\/plugins\/forminator\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9215","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9215","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:621;O:8:"stdClass":5:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:12:"wpforms-lite";s:19:"versionEndExcluding";s:5:"1.5.9";s:11:"description";s:101:"WPForms Plugin version 1.5.8.2 and below were found to be vulnerable to authenticated stored XSS.
