
";s:4:"refs";s:80:"https://www.jinsonvarghese.com/stored-xss-vulnerability-found-in-wpforms-plugin/";}i:622;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-10385";s:4:"slug";s:12:"wpforms-lite";s:19:"versionEndExcluding";s:5:"1.5.9";s:11:"description";s:138:"A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.";s:4:"refs";s:1181:"[{"url":"http:\/\/packetstormsecurity.com\/files\/156874\/WordPress-WPForms-1.5.9-Cross-Site-Scripting.html","name":"http:\/\/packetstormsecurity.com\/files\/156874\/WordPress-WPForms-1.5.9-Cross-Site-Scripting.html","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wpforms-lite\/#developers","name":"https:\/\/wordpress.org\/plugins\/wpforms-lite\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10114","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10114","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.getastra.com\/blog\/911\/plugin-exploit\/stored-xss-vulnerability-found-in-wpforms-plugin\/","name":"https:\/\/www.getastra.com\/blog\/911\/plugin-exploit\/stored-xss-vulnerability-found-in-wpforms-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/www.jinsonvarghese.com\/stored-xss-vulnerability-found-in-wpforms-plugin\/","name":"https:\/\/www.jinsonvarghese.com\/stored-xss-vulnerability-found-in-wpforms-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:623;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18578";s:4:"slug";s:21:"crafty-social-buttons";s:19:"versionEndExcluding";s:5:"1.5.8";s:11:"description";s:68:"The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.";s:4:"refs";s:202:"[{"url":"https:\/\/wordpress.org\/plugins\/crafty-social-buttons\/#developers","name":"https:\/\/wordpress.org\/plugins\/crafty-social-buttons\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:624;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10923";s:4:"slug";s:25:"woocommerce-store-toolkit";s:19:"versionEndExcluding";s:5:"1.5.8";s:11:"description";s:89:"The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.";s:4:"refs";s:210:"[{"url":"https:\/\/wordpress.org\/plugins\/woocommerce-store-toolkit\/#developers","name":"https:\/\/wordpress.org\/plugins\/woocommerce-store-toolkit\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:625;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10923";s:4:"slug";s:25:"woocommerce-store-toolkit";s:19:"versionEndExcluding";s:5:"1.5.8";s:11:"description";s:89:"The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.";s:4:"refs";s:210:"[{"url":"https:\/\/wordpress.org\/plugins\/woocommerce-store-toolkit\/#developers","name":"https:\/\/wordpress.org\/plugins\/woocommerce-store-toolkit\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:626;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10922";s:4:"slug";s:25:"woocommerce-store-toolkit";s:19:"versionEndExcluding";s:5:"1.5.7";s:11:"description";s:89:"The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.";s:4:"refs";s:233:"[{"url":"https:\/\/wordpress.org\/plugins\/woocommerce-store-toolkit\/#developers","name":"https:\/\/wordpress.org\/plugins\/woocommerce-store-toolkit\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:627;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10922";s:4:"slug";s:25:"woocommerce-store-toolkit";s:19:"versionEndExcluding";s:5:"1.5.7";s:11:"description";s:89:"The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.";s:4:"refs";s:233:"[{"url":"https:\/\/wordpress.org\/plugins\/woocommerce-store-toolkit\/#developers","name":"https:\/\/wordpress.org\/plugins\/woocommerce-store-toolkit\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:628;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18492";s:4:"slug";s:18:"contact-form-to-db";s:19:"versionEndExcluding";s:5:"1.5.7";s:11:"description";s:81:"The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.";s:4:"refs";s:219:"[{"url":"https:\/\/wordpress.org\/plugins\/contact-form-to-db\/#developers","name":"https:\/\/wordpress.org\/plugins\/contact-form-to-db\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:629;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9395";s:4:"slug";s:11:"users-ultra";s:19:"versionEndExcluding";s:6:"1.5.64";s:11:"description";s:88:"The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.";s:4:"refs";s:537:"[{"url":"https:\/\/seclists.org\/bugtraq\/2015\/Dec\/12","name":"https:\/\/seclists.org\/bugtraq\/2015\/Dec\/12","refsource":"MISC","tags":["Mailing List","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/users-ultra\/#developers","name":"https:\/\/wordpress.org\/plugins\/users-ultra\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8349\/","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8349\/","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:630;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9392";s:4:"slug";s:11:"users-ultra";s:19:"versionEndExcluding";s:6:"1.5.63";s:11:"description";s:84:"The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.";s:4:"refs";s:543:"[{"url":"https:\/\/seclists.org\/bugtraq\/2015\/Dec\/13","name":"https:\/\/seclists.org\/bugtraq\/2015\/Dec\/13","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/users-ultra\/#developers","name":"https:\/\/wordpress.org\/plugins\/users-ultra\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8350","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8350","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:631;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9393";s:4:"slug";s:11:"users-ultra";s:19:"versionEndExcluding";s:6:"1.5.63";s:11:"description";s:84:"The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.";s:4:"refs";s:354:"[{"url":"https:\/\/wordpress.org\/plugins\/users-ultra\/#developers","name":"https:\/\/wordpress.org\/plugins\/users-ultra\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8350","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8350","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:632;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9394";s:4:"slug";s:11:"users-ultra";s:19:"versionEndExcluding";s:6:"1.5.63";s:11:"description";s:114:"The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.";s:4:"refs";s:348:"[{"url":"https:\/\/wordpress.org\/plugins\/users-ultra\/#developers","name":"https:\/\/wordpress.org\/plugins\/users-ultra\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8350","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8350","refsource":"MISC","tags":["Not Applicable"]}]";}i:633;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18566";s:4:"slug";s:9:"user-role";s:19:"versionEndExcluding";s:5:"1.5.6";s:11:"description";s:72:"The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.";s:4:"refs";s:178:"[{"url":"https:\/\/wordpress.org\/plugins\/user-role\/#developers","name":"https:\/\/wordpress.org\/plugins\/user-role\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:634;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9402";s:4:"slug";s:11:"users-ultra";s:19:"versionEndExcluding";s:6:"1.5.59";s:11:"description";s:103:"The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.";s:4:"refs";s:540:"[{"url":"https:\/\/seclists.org\/bugtraq\/2015\/Nov\/93","name":"https:\/\/seclists.org\/bugtraq\/2015\/Nov\/93","refsource":"MISC","tags":["Mailing List","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/users-ultra\/#developers","name":"https:\/\/wordpress.org\/plugins\/users-ultra\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8243","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8243","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:635;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-17451";s:4:"slug";s:11:"WP Mailster";s:19:"versionEndExcluding";s:5:"1.5.5";s:11:"description";s:145:"The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php.";s:4:"refs";s:640:"[{"url":"https:\/\/packetstormsecurity.com\/files\/145222\/WordPress-WP-Mailster-1.5.4.0-Cross-Site-Scripting.html","name":"https:\/\/packetstormsecurity.com\/files\/145222\/WordPress-WP-Mailster-1.5.4.0-Cross-Site-Scripting.html","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-mailster\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-mailster\/#developers","refsource":"MISC","tags":["Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8973","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8973","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:636;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-9335";s:4:"slug";s:13:"photo-gallery";s:19:"versionEndExcluding";s:6:"1.5.46";s:11:"description";s:252:"Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authenticated admin user to inject arbitrary JavaScript code that is viewed by other users.";s:4:"refs";s:373:"[{"url":"https:\/\/wordpress.org\/plugins\/photo-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/photo-gallery\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10088","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10088","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:637;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16117";s:4:"slug";s:13:"photo-gallery";s:19:"versionEndExcluding";s:6:"1.5.35";s:11:"description";s:143:"Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.";s:4:"refs";s:1051:"[{"url":"http:\/\/packetstormsecurity.com\/files\/154433\/WordPress-Photo-Gallery-1.5.34-Cross-Site-Scripting.html","name":"http:\/\/packetstormsecurity.com\/files\/154433\/WordPress-Photo-Gallery-1.5.34-Cross-Site-Scripting.html","refsource":"MISC","tags":[]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2150912\/photo-gallery\/trunk\/admin\/models\/Galleries.php?old=2135029&old_path=photo-gallery%2Ftrunk%2Fadmin%2Fmodels%2FGalleries.php","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2150912\/photo-gallery\/trunk\/admin\/models\/Galleries.php?old=2135029&old_path=photo-gallery%2Ftrunk%2Fadmin%2Fmodels%2FGalleries.php","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/photo-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/photo-gallery\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9872","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9872","refsource":"MISC","tags":[]}]";}i:638;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16118";s:4:"slug";s:13:"photo-gallery";s:19:"versionEndExcluding";s:6:"1.5.35";s:11:"description";s:146:"Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.";s:4:"refs";s:1437:"[{"url":"http:\/\/packetstormsecurity.com\/files\/154433\/WordPress-Photo-Gallery-1.5.34-Cross-Site-Scripting.html","name":"http:\/\/packetstormsecurity.com\/files\/154433\/WordPress-Photo-Gallery-1.5.34-Cross-Site-Scripting.html","refsource":"MISC","tags":[]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2150912\/photo-gallery\/trunk\/admin\/controllers\/Options.php?old=2142624&old_path=photo-gallery%2Ftrunk%2Fadmin%2Fcontrollers%2FOptions.php","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2150912\/photo-gallery\/trunk\/admin\/controllers\/Options.php?old=2142624&old_path=photo-gallery%2Ftrunk%2Fadmin%2Fcontrollers%2FOptions.php","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2150912\/photo-gallery\/trunk\/js\/bwg.js?old=2135029&old_path=photo-gallery%2Ftrunk%2Fjs%2Fbwg.js","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2150912\/photo-gallery\/trunk\/js\/bwg.js?old=2135029&old_path=photo-gallery%2Ftrunk%2Fjs%2Fbwg.js","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/photo-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/photo-gallery\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9872","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9872","refsource":"MISC","tags":[]}]";}i:639;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16119";s:4:"slug";s:13:"photo-gallery";s:19:"versionEndExcluding";s:6:"1.5.35";s:11:"description";s:164:"SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter.";s:4:"refs";s:1081:"[{"url":"http:\/\/packetstormsecurity.com\/files\/154432\/WordPress-Photo-Gallery-1.5.34-SQL-Injection.html","name":"http:\/\/packetstormsecurity.com\/files\/154432\/WordPress-Photo-Gallery-1.5.34-SQL-Injection.html","refsource":"MISC","tags":[]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2150912\/photo-gallery\/trunk\/admin\/controllers\/Albumsgalleries.php?old=1845136&old_path=photo-gallery%2Ftrunk%2Fadmin%2Fcontrollers%2FAlbumsgalleries.php","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2150912\/photo-gallery\/trunk\/admin\/controllers\/Albumsgalleries.php?old=1845136&old_path=photo-gallery%2Ftrunk%2Fadmin%2Fcontrollers%2FAlbumsgalleries.php","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/photo-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/photo-gallery\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9872","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9872","refsource":"MISC","tags":[]}]";}i:640;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9497";s:4:"slug";s:11:"ad-inserter";s:19:"versionEndExcluding";s:5:"1.5.3";s:11:"description";s:132:"The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php.";s:4:"refs";s:291:"[{"url":"https:\/\/packetstormsecurity.com\/files\/131798\/","name":"https:\/\/packetstormsecurity.com\/files\/131798\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/7974","name":"https:\/\/wpvulndb.com\/vulnerabilities\/7974","refsource":"MISC","tags":[]}]";}i:641;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18541";s:4:"slug";s:11:"xo-security";s:19:"versionEndExcluding";s:5:"1.5.3";s:11:"description";s:58:"The xo-security plugin before 1.5.3 for WordPress has XSS.";s:4:"refs";s:205:"[{"url":"https:\/\/wordpress.org\/plugins\/xo-security\/#developers","name":"https:\/\/wordpress.org\/plugins\/xo-security\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:642;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15823";s:4:"slug";s:14:"wps-hide-login";s:19:"versionEndExcluding";s:5:"1.5.3";s:11:"description";s:99:"The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.";s:4:"refs";s:611:"[{"url":"https:\/\/secupress.me\/blog\/wps-hide-login-v1-5-2-2-multiples-vulnerabilities\/","name":"https:\/\/secupress.me\/blog\/wps-hide-login-v1-5-2-2-multiples-vulnerabilities\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wps-hide-login\/#developers","name":"https:\/\/wordpress.org\/plugins\/wps-hide-login\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9469","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9469","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:643;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15824";s:4:"slug";s:14:"wps-hide-login";s:19:"versionEndExcluding";s:5:"1.5.3";s:11:"description";s:88:"The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.";s:4:"refs";s:611:"[{"url":"https:\/\/secupress.me\/blog\/wps-hide-login-v1-5-2-2-multiples-vulnerabilities\/","name":"https:\/\/secupress.me\/blog\/wps-hide-login-v1-5-2-2-multiples-vulnerabilities\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wps-hide-login\/#developers","name":"https:\/\/wordpress.org\/plugins\/wps-hide-login\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9469","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9469","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:644;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15825";s:4:"slug";s:14:"wps-hide-login";s:19:"versionEndExcluding";s:5:"1.5.3";s:11:"description";s:98:"The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.";s:4:"refs";s:611:"[{"url":"https:\/\/secupress.me\/blog\/wps-hide-login-v1-5-2-2-multiples-vulnerabilities\/","name":"https:\/\/secupress.me\/blog\/wps-hide-login-v1-5-2-2-multiples-vulnerabilities\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wps-hide-login\/#developers","name":"https:\/\/wordpress.org\/plugins\/wps-hide-login\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9469","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9469","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:645;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15826";s:4:"slug";s:14:"wps-hide-login";s:19:"versionEndExcluding";s:5:"1.5.3";s:11:"description";s:115:"The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.";s:4:"refs";s:611:"[{"url":"https:\/\/secupress.me\/blog\/wps-hide-login-v1-5-2-2-multiples-vulnerabilities\/","name":"https:\/\/secupress.me\/blog\/wps-hide-login-v1-5-2-2-multiples-vulnerabilities\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wps-hide-login\/#developers","name":"https:\/\/wordpress.org\/plugins\/wps-hide-login\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9469","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9469","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:646;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-8615";s:4:"slug";s:5:"tutor";s:19:"versionEndExcluding";s:5:"1.5.3";s:11:"description";s:217:"A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).";s:4:"refs";s:755:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10058","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10058","refsource":"MISC","tags":[]},{"url":"https:\/\/www.getastra.com\/blog\/911\/plugin-exploit\/cross-site-request-forgery-in-tutor-lms-plugin\/","name":"https:\/\/www.getastra.com\/blog\/911\/plugin-exploit\/cross-site-request-forgery-in-tutor-lms-plugin\/","refsource":"MISC","tags":[]},{"url":"https:\/\/www.jinsonvarghese.com\/cross-site-request-forgery-in-tutor-lms\/","name":"https:\/\/www.jinsonvarghese.com\/cross-site-request-forgery-in-tutor-lms\/","refsource":"MISC","tags":[]},{"url":"https:\/\/www.themeum.com\/tutor-lms-updated-v1-5-3\/","name":"https:\/\/www.themeum.com\/tutor-lms-updated-v1-5-3\/","refsource":"MISC","tags":[]}]";}i:647;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:32:"yith-woocommerce-product-add-ons";s:19:"versionEndExcluding";s:6:"1.5.23";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:648;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14797";s:4:"slug";s:19:"10Web Photo Gallery";s:19:"versionEndExcluding";s:6:"1.5.23";s:11:"description";s:88:"The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.";s:4:"refs";s:193:"[{"url":"https:\/\/wordpress.org\/plugins\/photo-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/photo-gallery\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:649;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18582";s:4:"slug";s:11:"time-sheets";s:19:"versionEndExcluding";s:5:"1.5.2";s:11:"description";s:74:"The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.";s:4:"refs";s:182:"[{"url":"https:\/\/wordpress.org\/plugins\/time-sheets\/#developers","name":"https:\/\/wordpress.org\/plugins\/time-sheets\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:650;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-28649";s:4:"slug";s:28:"orbisius-child-theme-creator";s:19:"versionEndExcluding";s:5:"1.5.2";s:11:"description";s:121:"The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file.";s:4:"refs";s:485:"[{"url":"https:\/\/wordpress.org\/plugins\/orbisius-child-theme-creator\/#developers","name":"https:\/\/wordpress.org\/plugins\/orbisius-child-theme-creator\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/10\/high-severity-vulnerability-patched-in-child-theme-creator-by-orbisius\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/10\/high-severity-vulnerability-patched-in-child-theme-creator-by-orbisius\/","refsource":"MISC","tags":[]}]";}i:651;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-9043";s:4:"slug";s:10:"wp-central";s:19:"versionEndExcluding";s:5:"1.5.2";s:11:"description";s:88:"The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key.";s:4:"refs";s:553:"[{"url":"https:\/\/plugins.trac.wordpress.org\/changeset?&old=2244363%40wp-central&new=2244363%40wp-central","name":"https:\/\/plugins.trac.wordpress.org\/changeset?&old=2244363%40wp-central&new=2244363%40wp-central","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/wp-central\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-central\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10074","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10074","refsource":"MISC","tags":[]}]";}i:652;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-21011";s:4:"slug";s:10:"charitable";s:19:"versionEndExcluding";s:6:"1.5.14";s:11:"description";s:103:"The charitable plugin before 1.5.14 for WordPress has unauthorized access to user and donation details.";s:4:"refs";s:428:"[{"url":"https:\/\/wordpress.org\/plugins\/charitable\/#developers","name":"https:\/\/wordpress.org\/plugins\/charitable\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/www.wpcharitable.com\/release-notes-security-release-1-5-14\/","name":"https:\/\/www.wpcharitable.com\/release-notes-security-release-1-5-14\/","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:653;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9436";s:4:"slug";s:15:"dynamic-widgets";s:19:"versionEndExcluding";s:6:"1.5.11";s:11:"description";s:142:"The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.";s:4:"refs";s:625:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_489304900a50751da1495e2ea660bc51.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_489304900a50751da1495e2ea660bc51.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/dynamic-widgets\/#developers","name":"https:\/\/wordpress.org\/plugins\/dynamic-widgets\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8258","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8258","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:654;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9437";s:4:"slug";s:15:"dynamic-widgets";s:19:"versionEndExcluding";s:6:"1.5.11";s:11:"description";s:151:"The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.";s:4:"refs";s:625:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_489304900a50751da1495e2ea660bc51.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_489304900a50751da1495e2ea660bc51.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/dynamic-widgets\/#developers","name":"https:\/\/wordpress.org\/plugins\/dynamic-widgets\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8258","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8258","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:655;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9336";s:4:"slug";s:11:"clean-login";s:19:"versionEndExcluding";s:5:"1.5.1";s:11:"description";s:68:"The clean-login plugin before 1.5.1 for WordPress has reflected XSS.";s:4:"refs";s:205:"[{"url":"https:\/\/wordpress.org\/plugins\/clean-login\/#developers","name":"https:\/\/wordpress.org\/plugins\/clean-login\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:656;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17239";s:4:"slug";s:26:"download-plugins-dashboard";s:19:"versionEndExcluding";s:5:"1.5.1";s:11:"description";s:174:"includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues.";s:4:"refs";s:384:"[{"url":"https:\/\/wordpress.org\/plugins\/download-plugins-dashboard\/#developers","name":"https:\/\/wordpress.org\/plugins\/download-plugins-dashboard\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9896","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9896","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:657;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20977";s:4:"slug";s:34:"all-in-one-schemaorg-rich-snippets";s:19:"versionEndExcluding";s:5:"1.5.0";s:11:"description";s:102:"The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page.";s:4:"refs";s:228:"[{"url":"https:\/\/wordpress.org\/plugins\/all-in-one-schemaorg-rich-snippets\/#developers","name":"https:\/\/wordpress.org\/plugins\/all-in-one-schemaorg-rich-snippets\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:658;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18581";s:4:"slug";s:11:"time-sheets";s:19:"versionEndExcluding";s:5:"1.5.0";s:11:"description";s:85:"The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.";s:4:"refs";s:182:"[{"url":"https:\/\/wordpress.org\/plugins\/time-sheets\/#developers","name":"https:\/\/wordpress.org\/plugins\/time-sheets\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:659;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10381";s:4:"slug";s:21:"user-domain-whitelist";s:19:"versionEndExcluding";s:3:"1.5";s:11:"description";s:67:"The user-domain-whitelist plugin before 1.5 for WordPress has CSRF.";s:4:"refs";s:202:"[{"url":"https:\/\/wordpress.org\/plugins\/user-domain-whitelist\/#developers","name":"https:\/\/wordpress.org\/plugins\/user-domain-whitelist\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:660;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10762";s:4:"slug";s:23:"CampTix Event Ticketing";s:19:"versionEndExcluding";s:3:"1.5";s:11:"description";s:110:"The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used.";s:4:"refs";s:359:"[{"url":"https:\/\/hackerone.com\/reports\/151516","name":"https:\/\/hackerone.com\/reports\/151516","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/camptix\/#developers","name":"https:\/\/wordpress.org\/plugins\/camptix\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:661;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10763";s:4:"slug";s:23:"CampTix Event Ticketing";s:19:"versionEndExcluding";s:3:"1.5";s:11:"description";s:119:"The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body.";s:4:"refs";s:359:"[{"url":"https:\/\/hackerone.com\/reports\/152958","name":"https:\/\/hackerone.com\/reports\/152958","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/camptix\/#developers","name":"https:\/\/wordpress.org\/plugins\/camptix\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:662;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15819";s:4:"slug";s:26:"nd-restaurant-reservations";s:19:"versionEndExcluding";s:3:"1.5";s:11:"description";s:137:"The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.";s:4:"refs";s:701:"[{"url":"https:\/\/blog.nintechnet.com\/privilege-escalation-vulnerability-in-wordpress-nd-restaurant-reservations-plugin\/","name":"https:\/\/blog.nintechnet.com\/privilege-escalation-vulnerability-in-wordpress-nd-restaurant-reservations-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/nd-restaurant-reservations\/#developers","name":"https:\/\/wordpress.org\/plugins\/nd-restaurant-reservations\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9501","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9501","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:663;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9445";s:4:"slug";s:18:"unite-gallery-lite";s:19:"versionEndExcluding";s:3:"1.5";s:11:"description";s:150:"The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.";s:4:"refs";s:560:"[{"url":"http:\/\/packetstormsecurity.com\/files\/132842\/","name":"http:\/\/packetstormsecurity.com\/files\/132842\/","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/unite-gallery-lite\/#developers","name":"https:\/\/wordpress.org\/plugins\/unite-gallery-lite\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8113","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8113","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:664;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9446";s:4:"slug";s:18:"unite-gallery-lite";s:19:"versionEndExcluding";s:3:"1.5";s:11:"description";s:120:"The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php.";s:4:"refs";s:560:"[{"url":"http:\/\/packetstormsecurity.com\/files\/132842\/","name":"http:\/\/packetstormsecurity.com\/files\/132842\/","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/unite-gallery-lite\/#developers","name":"https:\/\/wordpress.org\/plugins\/unite-gallery-lite\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8113","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8113","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:665;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9447";s:4:"slug";s:18:"unite-gallery-lite";s:19:"versionEndExcluding";s:3:"1.5";s:11:"description";s:132:"The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.";s:4:"refs";s:560:"[{"url":"http:\/\/packetstormsecurity.com\/files\/132842\/","name":"http:\/\/packetstormsecurity.com\/files\/132842\/","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/unite-gallery-lite\/#developers","name":"https:\/\/wordpress.org\/plugins\/unite-gallery-lite\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8113","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8113","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:666;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18487";s:4:"slug";s:35:"adsense-plugin (aka Google AdSense)";s:19:"versionEndExcluding";s:4:"1.44";s:11:"description";s:97:"The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.";s:4:"refs";s:211:"[{"url":"https:\/\/wordpress.org\/plugins\/adsense-plugin\/#developers","name":"https:\/\/wordpress.org\/plugins\/adsense-plugin\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:667;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:32:"yith-woocommerce-request-a-quote";s:19:"versionEndExcluding";s:5:"1.4.9";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:668;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15082";s:4:"slug";s:20:"360-product-rotation";s:19:"versionEndExcluding";s:5:"1.4.8";s:11:"description";s:77:"The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.";s:4:"refs";s:362:"[{"url":"https:\/\/wordpress.org\/plugins\/360-product-rotation\/#developers","name":"https:\/\/wordpress.org\/plugins\/360-product-rotation\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9405","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9405","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:669;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18526";s:4:"slug";s:10:"moreads-se";s:19:"versionEndExcluding";s:5:"1.4.7";s:11:"description";s:57:"The moreads-se plugin before 1.4.7 for WordPress has XSS.";s:4:"refs";s:180:"[{"url":"https:\/\/wordpress.org\/plugins\/moreads-se\/#developers","name":"https:\/\/wordpress.org\/plugins\/moreads-se\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:670;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15828";s:4:"slug";s:13:"one-click-ssl";s:19:"versionEndExcluding";s:5:"1.4.7";s:11:"description";s:61:"The one-click-ssl plugin before 1.4.7 for WordPress has CSRF.";s:4:"refs";s:365:"[{"url":"https:\/\/wordpress.org\/plugins\/one-click-ssl\/#developers","name":"https:\/\/wordpress.org\/plugins\/one-click-ssl\/#developers","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9448","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9448","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:671;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9411";s:4:"slug";s:9:"Postmatic";s:19:"versionEndExcluding";s:5:"1.4.6";s:11:"description";s:56:"The Postmatic plugin before 1.4.6 for WordPress has XSS.";s:4:"refs";s:357:"[{"url":"https:\/\/wordpress.org\/plugins\/postmatic\/#developers","name":"https:\/\/wordpress.org\/plugins\/postmatic\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8183","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8183","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:672;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:30:"yith-woocommerce-cart-messages";s:19:"versionEndExcluding";s:5:"1.4.5";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:673;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-35234";s:4:"slug";s:12:"easy-wp-smtp";s:19:"versionEndExcluding";s:5:"1.4.4";s:11:"description";s:412:"The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file (such as #############_debug_log.txt) that contains all password-reset links. The attacker can request a reset of the Administrator password and then use a link found there.";s:4:"refs";s:401:"[{"url":"https:\/\/blog.nintechnet.com\/wordpress-easy-wp-smtp-plugin-fixed-zero-day-vulnerability\/","name":"https:\/\/blog.nintechnet.com\/wordpress-easy-wp-smtp-plugin-fixed-zero-day-vulnerability\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/easy-wp-smtp\/#developers","name":"https:\/\/wordpress.org\/plugins\/easy-wp-smtp\/#developers","refsource":"MISC","tags":[]}]";}i:674;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-19207";s:4:"slug";s:18:"wp-gdpr-compliance";s:19:"versionEndExcluding";s:5:"1.4.3";s:11:"description";s:228:"The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.";s:4:"refs";s:806:"[{"url":"http:\/\/www.securityfocus.com\/bid\/105921","name":"105921","refsource":"BID","tags":["Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-gdpr-compliance\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-gdpr-compliance\/#developers","refsource":"MISC","tags":["Product","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9144","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9144","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/www.wordfence.com\/blog\/2018\/11\/trends-following-vulnerability-in-wp-gdpr-compliance-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2018\/11\/trends-following-vulnerability-in-wp-gdpr-compliance-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:675;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2013-7482";s:4:"slug";s:14:"reflex-gallery";s:19:"versionEndExcluding";s:5:"1.4.3";s:11:"description";s:61:"The reflex-gallery plugin before 1.4.3 for WordPress has XSS.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/reflex-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/reflex-gallery\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:676;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9466";s:4:"slug";s:13:"wti-like-post";s:19:"versionEndExcluding";s:5:"1.4.3";s:11:"description";s:204:"The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTP_FORWARDED_FOR, or HTTP_FORWARDED variable.";s:4:"refs";s:611:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_576345187f5867ec8921b12de5884fb1.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_576345187f5867ec8921b12de5884fb1.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wti-like-post\/#developers","name":"https:\/\/wordpress.org\/plugins\/wti-like-post\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8318","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8318","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:677;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9493";s:4:"slug";s:12:"my-wish-list";s:19:"versionEndExcluding";s:5:"1.4.2";s:11:"description";s:75:"The my-wish-list plugin before 1.4.2 for WordPress has multiple XSS issues.";s:4:"refs";s:312:"[{"url":"https:\/\/wordpress.org\/plugins\/my-wish-list\/#developers","name":"https:\/\/wordpress.org\/plugins\/my-wish-list\/#developers","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/7937","name":"https:\/\/wpvulndb.com\/vulnerabilities\/7937","refsource":"MISC","tags":[]}]";}i:678;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20968";s:4:"slug";s:20:"wp-ultimate-exporter";s:19:"versionEndExcluding";s:5:"1.4.2";s:11:"description";s:68:"The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.";s:4:"refs";s:224:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-ultimate-exporter\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-ultimate-exporter\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:679;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18572";s:4:"slug";s:11:"gnucommerce";s:19:"versionEndExcluding";s:5:"1.4.2";s:11:"description";s:58:"The gnucommerce plugin before 1.4.2 for WordPress has XSS.";s:4:"refs";s:205:"[{"url":"https:\/\/wordpress.org\/plugins\/gnucommerce\/#developers","name":"https:\/\/wordpress.org\/plugins\/gnucommerce\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:680;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2018-6465";s:4:"slug";s:12:"PropertyHive";s:19:"versionEndExcluding";s:6:"1.4.15";s:11:"description";s:148:"The PropertyHive plugin before 1.4.15 for WordPress has XSS via the body parameter to includes/admin/views/html-preview-applicant-matches-email.php.";s:4:"refs";s:916:"[{"url":"https:\/\/packetstormsecurity.com\/files\/146174\/WordPress-Propertyhive-1.4.14-Cross-Site-Scripting.html","name":"https:\/\/packetstormsecurity.com\/files\/146174\/WordPress-Propertyhive-1.4.14-Cross-Site-Scripting.html","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/propertyhive\/#developers","name":"https:\/\/wordpress.org\/plugins\/propertyhive\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wordpress.org\/support\/topic\/wordpress-propertyhive-1-4-14-cross-site-scripting\/","name":"https:\/\/wordpress.org\/support\/topic\/wordpress-propertyhive-1-4-14-cross-site-scripting\/","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9020","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9020","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:681;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9302";s:4:"slug";s:13:"simple-fields";s:19:"versionEndExcluding";s:6:"1.4.11";s:11:"description";s:61:"The simple-fields plugin before 1.4.11 for WordPress has XSS.";s:4:"refs";s:209:"[{"url":"https:\/\/wordpress.org\/plugins\/simple-fields\/#developers","name":"https:\/\/wordpress.org\/plugins\/simple-fields\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:682;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17229";s:4:"slug";s:41:"motors-car-dealership-classified-listings";s:19:"versionEndExcluding";s:5:"1.4.1";s:11:"description";s:179:"includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XSS issues.";s:4:"refs";s:497:"[{"url":"https:\/\/blog.nintechnet.com\/multiple-vulnerabilities-in-wordpress-motors-car-dealer-classified-ads-plugin\/","name":"https:\/\/blog.nintechnet.com\/multiple-vulnerabilities-in-wordpress-motors-car-dealer-classified-ads-plugin\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/motors-car-dealership-classified-listings\/#developers","name":"https:\/\/wordpress.org\/plugins\/motors-car-dealership-classified-listings\/#developers","refsource":"MISC","tags":[]}]";}i:683;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:33:"yith-woocommerce-advanced-reviews";s:19:"versionEndExcluding";s:5:"1.4.0";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:684;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15772";s:4:"slug";s:12:"nd-donations";s:19:"versionEndExcluding";s:3:"1.4";s:11:"description";s:123:"The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.";s:4:"refs";s:641:"[{"url":"https:\/\/threatpost.com\/wordpress-plugins-exploited-in-ongoing-attack-researchers-warn\/147671\/","name":"https:\/\/threatpost.com\/wordpress-plugins-exploited-in-ongoing-attack-researchers-warn\/147671\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/nd-donations\/#developers","name":"https:\/\/wordpress.org\/plugins\/nd-donations\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9493","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9493","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:685;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10955";s:4:"slug";s:14:"cysteme-finder";s:19:"versionEndExcluding";s:3:"1.4";s:11:"description";s:118:"The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.";s:4:"refs";s:367:"[{"url":"https:\/\/wordpress.org\/plugins\/cysteme-finder\/#developers","name":"https:\/\/wordpress.org\/plugins\/cysteme-finder\/#developers","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8612","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8612","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:686;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-12074";s:4:"slug";s:48:"users-customers-import-export-for-wp-woocommerce";s:19:"versionEndExcluding";s:4:"1.39";s:11:"description";s:148:"The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV.";s:4:"refs";s:253:"[{"url":"https:\/\/www.wordfence.com\/blog\/2020\/03\/vulnerability-patched-in-import-export-wordpress-users\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/03\/vulnerability-patched-in-import-export-wordpress-users\/","refsource":"MISC","tags":[]}]";}i:687;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18494";s:4:"slug";s:20:"custom-search-plugin";s:19:"versionEndExcluding";s:4:"1.36";s:11:"description";s:82:"The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.";s:4:"refs";s:223:"[{"url":"https:\/\/wordpress.org\/plugins\/custom-search-plugin\/#developers","name":"https:\/\/wordpress.org\/plugins\/custom-search-plugin\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:688;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18565";s:4:"slug";s:7:"updater";s:19:"versionEndExcluding";s:4:"1.35";s:11:"description";s:69:"The updater plugin before 1.35 for WordPress has multiple XSS issues.";s:4:"refs";s:174:"[{"url":"https:\/\/wordpress.org\/plugins\/updater\/#developers","name":"https:\/\/wordpress.org\/plugins\/updater\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:689;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10971";s:4:"slug";s:16:"MemberSonic Lite";s:19:"versionEndExcluding";s:5:"1.302";s:11:"description";s:147:"The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.";s:4:"refs";s:221:"[{"url":"http:\/\/www.pritect.net\/blog\/membersonic-lite-1-2-unauthenticated-login","name":"http:\/\/www.pritect.net\/blog\/membersonic-lite-1-2-unauthenticated-login","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:690;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10971";s:4:"slug";s:16:"MemberSonic Lite";s:19:"versionEndExcluding";s:5:"1.302";s:11:"description";s:147:"The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.";s:4:"refs";s:221:"[{"url":"http:\/\/www.pritect.net\/blog\/membersonic-lite-1-2-unauthenticated-login","name":"http:\/\/www.pritect.net\/blog\/membersonic-lite-1-2-unauthenticated-login","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:691;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18536";s:4:"slug";s:21:"stop-user-enumeration";s:19:"versionEndExcluding";s:5:"1.3.8";s:11:"description";s:68:"The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.";s:4:"refs";s:202:"[{"url":"https:\/\/wordpress.org\/plugins\/stop-user-enumeration\/#developers","name":"https:\/\/wordpress.org\/plugins\/stop-user-enumeration\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:692;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:27:"yith-woocommerce-gift-cards";s:19:"versionEndExcluding";s:5:"1.3.8";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:693;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:30:"yith-woocommerce-brands-add-on";s:19:"versionEndExcluding";s:5:"1.3.7";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:694;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-15919";s:4:"slug";s:26:"ultimate-form-builder-lite";s:19:"versionEndExcluding";s:5:"1.3.7";s:11:"description";s:149:"The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin-ajax.php.";s:4:"refs";s:793:"[{"url":"http:\/\/www.securityfocus.com\/bid\/101604","name":"101604","refsource":"BID","tags":["Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/ultimate-form-builder-lite\/#developers","name":"https:\/\/wordpress.org\/plugins\/ultimate-form-builder-lite\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8935","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8935","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.wordfence.com\/blog\/2017\/10\/zero-day-vulnerability-ultimate-form-builder-lite\/","name":"https:\/\/www.wordfence.com\/blog\/2017\/10\/zero-day-vulnerability-ultimate-form-builder-lite\/","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:695;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18557";s:4:"slug";s:15:"bws-google-maps";s:19:"versionEndExcluding";s:5:"1.3.6";s:11:"description";s:78:"The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/bws-google-maps\/#developers","name":"https:\/\/wordpress.org\/plugins\/bws-google-maps\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:696;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:29:"yith-woocommerce-social-login";s:19:"versionEndExcluding";s:5:"1.3.6";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:697;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:29:"yith-woocommerce-subscription";s:19:"versionEndExcluding";s:5:"1.3.6";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:698;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:35:"yith-woocommerce-points-and-rewards";s:19:"versionEndExcluding";s:5:"1.3.6";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:699;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-12977";s:4:"slug";s:59:"Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery"";s:19:"versionEndExcluding";s:6:"1.3.51";s:11:"description";s:304:"The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() in photo-gallery.php and edit_tag() in admin/controllers/BWGControllerTags_bwg.php. It is exploitable by administrators via the tag_id parameter.";s:4:"refs";s:441:"[{"url":"https:\/\/github.com\/jgj212\/Advisories\/blob\/master\/photo-gallery.1.3.50-SQL","name":"https:\/\/github.com\/jgj212\/Advisories\/blob\/master\/photo-gallery.1.3.50-SQL","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/photo-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/photo-gallery\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:700;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15647";s:4:"slug";s:10:"groundhogg";s:19:"versionEndExcluding";s:5:"1.3.5";s:11:"description";s:127:"The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.";s:4:"refs";s:778:"[{"url":"https:\/\/wordpress.org\/plugins\/groundhogg\/#developers","name":"https:\/\/wordpress.org\/plugins\/groundhogg\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9834","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9834","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2019\/04\/05\/our-proactive-monitoring-caught-an-authenticated-remote-code-execution-rce-vulnerability-being-introduced-in-to-groundhogg","name":"https:\/\/www.pluginvulnerabilities.com\/2019\/04\/05\/our-proactive-monitoring-caught-an-authenticated-remote-code-execution-rce-vulnerability-being-introduced-in-to-groundhogg","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:701;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15866";s:4:"slug";s:13:"crelly-slider";s:19:"versionEndExcluding";s:5:"1.3.5";s:11:"description";s:151:"The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_importSlider.";s:4:"refs";s:490:"[{"url":"https:\/\/blog.nintechnet.com\/arbitrary-file-upload-vulnerability-in-wordpress-crelly-slider-plugin\/","name":"https:\/\/blog.nintechnet.com\/arbitrary-file-upload-vulnerability-in-wordpress-crelly-slider-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/crelly-slider\/#developers","name":"https:\/\/wordpress.org\/plugins\/crelly-slider\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:702;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18502";s:4:"slug";s:10:"subscriber";s:19:"versionEndExcluding";s:5:"1.3.5";s:11:"description";s:73:"The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.";s:4:"refs";s:198:"[{"url":"https:\/\/wordpress.org\/plugins\/subscriber\/#developers","name":"https:\/\/wordpress.org\/plugins\/subscriber\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:703;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10872";s:4:"slug";s:15:"ultimate-member";s:19:"versionEndExcluding";s:6:"1.3.40";s:11:"description";s:81:"The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.";s:4:"refs";s:348:"[{"url":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","name":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9738","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9738","refsource":"MISC","tags":[]}]";}i:704;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10872";s:4:"slug";s:15:"ultimate-member";s:19:"versionEndExcluding";s:6:"1.3.40";s:11:"description";s:81:"The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.";s:4:"refs";s:348:"[{"url":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","name":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9738","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9738","refsource":"MISC","tags":[]}]";}i:705;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:39:"yith-woocommerce-recover-abandoned-cart";s:19:"versionEndExcluding";s:5:"1.3.4";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:706;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-9371";s:4:"slug";s:28:"appointment-booking-calendar";s:19:"versionEndExcluding";s:6:"1.3.35";s:11:"description";s:211:"Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.";s:4:"refs";s:561:"[{"url":"https:\/\/drive.google.com\/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9","name":"https:\/\/drive.google.com\/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/appointment-booking-calendar\/#developers","name":"https:\/\/wordpress.org\/plugins\/appointment-booking-calendar\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.hotdreamweaver.com\/support\/view.php?id=815925","name":"https:\/\/www.hotdreamweaver.com\/support\/view.php?id=815925","refsource":"MISC","tags":[]}]";}i:707;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-9372";s:4:"slug";s:28:"appointment-booking-calendar";s:19:"versionEndExcluding";s:6:"1.3.35";s:11:"description";s:339:"The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.";s:4:"refs";s:561:"[{"url":"https:\/\/drive.google.com\/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9","name":"https:\/\/drive.google.com\/open?id=1NNcYPaJir9SleyVr4cSPqpI2LNM7rtx9","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/appointment-booking-calendar\/#developers","name":"https:\/\/wordpress.org\/plugins\/appointment-booking-calendar\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.hotdreamweaver.com\/support\/view.php?id=815925","name":"https:\/\/www.hotdreamweaver.com\/support\/view.php?id=815925","refsource":"MISC","tags":[]}]";}i:708;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-11738";s:4:"slug";s:10:"duplicator";s:19:"versionEndExcluding";s:6:"1.3.28";s:11:"description";s:196:"The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.";s:4:"refs";s:501:"[{"url":"https:\/\/snapcreek.com\/duplicator\/docs\/changelog\/?lite","name":"https:\/\/snapcreek.com\/duplicator\/docs\/changelog\/?lite","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/02\/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affects-over-1-million-sites\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/02\/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affects-over-1-million-sites\/","refsource":"MISC","tags":[]}]";}i:709;O:8:"stdClass":6:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:10:"duplicator";s:19:"versionEndExcluding";s:6:"1.3.28";s:11:"description";s:219:"Critical security issue discovered in Duplicator 1.3.27 and below. https://www.wordfence.com/blog/2020/02/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affects-over-1-million-sites/ Credit @Wordfence";s:14:"recommendation";s:38:"Update immediately to 1.3.28 or newer.";s:4:"refs";s:0:"";}i:710;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:34:"yith-woocommerce-badges-management";s:19:"versionEndExcluding";s:6:"1.3.21";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:711;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18546";s:4:"slug";s:13:"jayj-quicktag";s:19:"versionEndExcluding";s:5:"1.3.2";s:11:"description";s:61:"The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.";s:4:"refs";s:210:"[{"url":"https:\/\/wordpress.org\/plugins\/jayj-quicktag\/#developers","name":"https:\/\/wordpress.org\/plugins\/jayj-quicktag\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:712;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-21012";s:4:"slug";s:23:"cf7-invisible-recaptcha";s:19:"versionEndExcluding";s:5:"1.3.2";s:11:"description";s:70:"The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.";s:4:"refs";s:538:"[{"url":"https:\/\/wordpress.org\/plugins\/cf7-invisible-recaptcha\/#developers","name":"https:\/\/wordpress.org\/plugins\/cf7-invisible-recaptcha\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2018\/05\/17\/reflected-cross-site-scripting-xss-vulnerability-in-cf7-invisible-recaptcha\/","name":"https:\/\/www.pluginvulnerabilities.com\/2018\/05\/17\/reflected-cross-site-scripting-xss-vulnerability-in-cf7-invisible-recaptcha\/","refsource":"MISC","tags":[]}]";}i:713;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10950";s:4:"slug";s:4:"sirv";s:19:"versionEndExcluding";s:5:"1.3.2";s:11:"description";s:82:"The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter.";s:4:"refs";s:577:"[{"url":"http:\/\/lenonleite.com.br\/en\/2016\/11\/10\/sirv-1-3-1-plugin-for-wordpress\/","name":"http:\/\/lenonleite.com.br\/en\/2016\/11\/10\/sirv-1-3-1-plugin-for-wordpress\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/sirv\/#developers","name":"https:\/\/wordpress.org\/plugins\/sirv\/#developers","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8673","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8673","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:714;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10950";s:4:"slug";s:4:"sirv";s:19:"versionEndExcluding";s:5:"1.3.2";s:11:"description";s:82:"The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter.";s:4:"refs";s:577:"[{"url":"http:\/\/lenonleite.com.br\/en\/2016\/11\/10\/sirv-1-3-1-plugin-for-wordpress\/","name":"http:\/\/lenonleite.com.br\/en\/2016\/11\/10\/sirv-1-3-1-plugin-for-wordpress\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/sirv\/#developers","name":"https:\/\/wordpress.org\/plugins\/sirv\/#developers","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8673","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8673","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:715;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9304";s:4:"slug";s:15:"ultimate-member";s:19:"versionEndExcluding";s:6:"1.3.18";s:11:"description";s:78:"The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.";s:4:"refs";s:208:"[{"url":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","name":"https:\/\/wordpress.org\/plugins\/ultimate-member\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:716;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18543";s:4:"slug";s:13:"invite-anyone";s:19:"versionEndExcluding";s:6:"1.3.16";s:11:"description";s:110:"The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.";s:4:"refs";s:210:"[{"url":"https:\/\/wordpress.org\/plugins\/invite-anyone\/#developers","name":"https:\/\/wordpress.org\/plugins\/invite-anyone\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:717;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18544";s:4:"slug";s:13:"invite-anyone";s:19:"versionEndExcluding";s:6:"1.3.16";s:11:"description";s:74:"The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.";s:4:"refs";s:210:"[{"url":"https:\/\/wordpress.org\/plugins\/invite-anyone\/#developers","name":"https:\/\/wordpress.org\/plugins\/invite-anyone\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:718;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18545";s:4:"slug";s:13:"invite-anyone";s:19:"versionEndExcluding";s:6:"1.3.16";s:11:"description";s:119:"The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.";s:4:"refs";s:210:"[{"url":"https:\/\/wordpress.org\/plugins\/invite-anyone\/#developers","name":"https:\/\/wordpress.org\/plugins\/invite-anyone\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:719;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9356";s:4:"slug";s:10:"wp-vipergb";s:19:"versionEndExcluding";s:6:"1.3.16";s:11:"description";s:139:"The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460.";s:4:"refs";s:479:"[{"url":"https:\/\/make.wordpress.org\/plugins\/2015\/04\/20\/fixing-add_query_arg-and-remove_query_arg-usage\/","name":"https:\/\/make.wordpress.org\/plugins\/2015\/04\/20\/fixing-add_query_arg-and-remove_query_arg-usage\/","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-vipergb\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-vipergb\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:720;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:27:"yith-woocommerce-quick-view";s:19:"versionEndExcluding";s:6:"1.3.15";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:721;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:36:"yith-woocommerce-added-to-cart-popup";s:19:"versionEndExcluding";s:6:"1.3.13";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:722;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:31:"yith-woocommerce-zoom-magnifier";s:19:"versionEndExcluding";s:6:"1.3.12";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:723;O:8:"stdClass":5:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:10:"groundhogg";s:19:"versionEndExcluding";s:9:"1.3.11.13";s:11:"description";s:232:"Wordpress Groundhogg plugin with a version lower than 1.3.11.13 is affected by an Authenticated SQL Injection vulnerability.

https://nitesculucian.github.io/2019/10/23/groundhogg-1-3-2-authentificated-sql-injection-vulnerability/";s:4:"refs";s:41:"https://wordpress.org/plugins/groundhogg/";}i:724;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:29:"yith-woocommerce-waiting-list";s:19:"versionEndExcluding";s:6:"1.3.11";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:725;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9494";s:4:"slug";s:19:"indieweb-post-kinds";s:19:"versionEndExcluding";s:7:"1.3.1.1";s:11:"description";s:118:"The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier.";s:4:"refs";s:141:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/7982","name":"https:\/\/wpvulndb.com\/vulnerabilities\/7982","refsource":"MISC","tags":[]}]";}i:726;O:8:"stdClass":5:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:15:"email-templates";s:19:"versionEndExcluding";s:7:"1.3.1.1";s:11:"description";s:88:"https://blog.nintechnet.com/multiple-wordpress-plugins-vulnerable-to-html-injection/

";s:4:"refs";s:0:"";}i:727;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2012-5469";s:4:"slug";s:19:"Portable phpMyAdmin";s:19:"versionEndExcluding";s:5:"1.3.1";s:11:"description";s:218:"The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct request to wp-content/plugins/portable-phpmyadmin/wp-pma-mod.";s:4:"refs";s:416:"[{"url":"http:\/\/archives.neohapsis.com\/archives\/bugtraq\/2012-12\/0092.html","name":"20121212 'portable-phpMyAdmin (WordPress Plugin)' Authentication Bypass (CVE-2012-5469)","refsource":"BUGTRAQ","tags":["Exploit"]},{"url":"http:\/\/wordpress.org\/extend\/plugins\/portable-phpmyadmin\/changelog\/","name":"http:\/\/wordpress.org\/extend\/plugins\/portable-phpmyadmin\/changelog\/","refsource":"MISC","tags":[]}]";}i:728;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10912";s:4:"slug";s:19:"universal-analytics";s:19:"versionEndExcluding";s:5:"1.3.1";s:11:"description";s:66:"The universal-analytics plugin before 1.3.1 for WordPress has XSS.";s:4:"refs";s:198:"[{"url":"https:\/\/wordpress.org\/plugins\/universal-analytics\/#developers","name":"https:\/\/wordpress.org\/plugins\/universal-analytics\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:729;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10912";s:4:"slug";s:19:"universal-analytics";s:19:"versionEndExcluding";s:5:"1.3.1";s:11:"description";s:66:"The universal-analytics plugin before 1.3.1 for WordPress has XSS.";s:4:"refs";s:198:"[{"url":"https:\/\/wordpress.org\/plugins\/universal-analytics\/#developers","name":"https:\/\/wordpress.org\/plugins\/universal-analytics\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:730;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18585";s:4:"slug";s:13:"posts-in-page";s:19:"versionEndExcluding";s:5:"1.3.0";s:11:"description";s:103:"The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.";s:4:"refs";s:520:"[{"url":"https:\/\/wordpress.org\/plugins\/posts-in-page\/#developers","name":"https:\/\/wordpress.org\/plugins\/posts-in-page\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2017\/02\/13\/authenticated-local-file-inclusion-lfi-vulnerability-in-posts-in-page\/","name":"https:\/\/www.pluginvulnerabilities.com\/2017\/02\/13\/authenticated-local-file-inclusion-lfi-vulnerability-in-posts-in-page\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:731;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-24063";s:4:"slug";s:5:"canto";s:19:"versionEndExcluding";s:5:"1.3.0";s:11:"description";s:86:"The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.";s:4:"refs";s:657:"[{"url":"https:\/\/gist.github.com\/Hakooraevil\/264cb21034f946eee62371e9111c36bb","name":"https:\/\/gist.github.com\/Hakooraevil\/264cb21034f946eee62371e9111c36bb","refsource":"MISC","tags":[]},{"url":"https:\/\/github.com\/CantoDAM\/Canto-Wordpress-Plugin","name":"https:\/\/github.com\/CantoDAM\/Canto-Wordpress-Plugin","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/canto\/#developers","name":"https:\/\/wordpress.org\/plugins\/canto\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.canto.com\/integrations\/wordpress\/","name":"https:\/\/www.canto.com\/integrations\/wordpress\/","refsource":"MISC","tags":[]}]";}i:732;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18533";s:4:"slug";s:21:"rimons-twitter-widget";s:19:"versionEndExcluding";s:3:"1.3";s:11:"description";s:66:"The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.";s:4:"refs";s:202:"[{"url":"https:\/\/wordpress.org\/plugins\/rimons-twitter-widget\/#developers","name":"https:\/\/wordpress.org\/plugins\/rimons-twitter-widget\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:733;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20971";s:4:"slug";s:12:"church-admin";s:19:"versionEndExcluding";s:6:"1.2550";s:11:"description";s:106:"The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.";s:4:"refs";s:208:"[{"url":"https:\/\/wordpress.org\/plugins\/church-admin\/#developers","name":"https:\/\/wordpress.org\/plugins\/church-admin\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:734;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-13125";s:4:"slug";s:18:"ultimate-elementor";s:19:"versionEndExcluding";s:6:"1.24.2";s:11:"description";s:273:"An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled.";s:4:"refs";s:477:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10214","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10214","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/05\/combined-attack-on-elementor-pro-and-ultimate-addons-for-elementor-puts-1-million-sites-at-risk\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/05\/combined-attack-on-elementor-pro-and-ultimate-addons-for-elementor-puts-1-million-sites-at-risk\/","refsource":"MISC","tags":[]}]";}i:735;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-8771";s:4:"slug";s:15:"wp-time-capsule";s:19:"versionEndExcluding";s:7:"1.21.16";s:11:"description";s:215:"The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.";s:4:"refs";s:359:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10010","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10010","refsource":"MISC","tags":[]},{"url":"https:\/\/www.webarxsecurity.com\/vulnerability-infinitewp-client-wp-time-capsule\/","name":"https:\/\/www.webarxsecurity.com\/vulnerability-infinitewp-client-wp-time-capsule\/","refsource":"MISC","tags":[]}]";}i:736;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9385";s:4:"slug";s:15:"quotes-and-tips";s:19:"versionEndExcluding";s:4:"1.20";s:11:"description";s:61:"The quotes-and-tips plugin before 1.20 for WordPress has XSS.";s:4:"refs";s:375:"[{"url":"https:\/\/wordpress.org\/plugins\/quotes-and-tips\/#developers","name":"https:\/\/wordpress.org\/plugins\/quotes-and-tips\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8359","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8359","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:737;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:42:"yith-desktop-notifications-for-woocommerce";s:19:"versionEndExcluding";s:5:"1.2.8";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:738;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-14846";s:4:"slug";s:23:"Mondula Multi Step Form";s:19:"versionEndExcluding";s:5:"1.2.8";s:11:"description";s:114:"The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php.";s:4:"refs";s:779:"[{"url":"https:\/\/ansawaf.blogspot.com\/2018\/10\/cve-2018-14846-multiple-stored-xss-in.html","name":"https:\/\/ansawaf.blogspot.com\/2018\/10\/cve-2018-14846-multiple-stored-xss-in.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/","name":"https:\/\/cwatch.comodo.com\/blog\/website-security\/vulnerability-found-in-multiple-stored-xss-form-in-wordpress-version-1-2-5\/","refsource":"MISC","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9186","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9186","refsource":"MISC","tags":["Exploit","Patch","Third Party Advisory"]}]";}i:739;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9456";s:4:"slug";s:28:"orbisius-child-theme-creator";s:19:"versionEndExcluding";s:5:"1.2.8";s:11:"description";s:264:"The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file theme_1, theme_1_file, or theme_1_file_contents parameter.";s:4:"refs";s:647:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_28c91eee00e8e4b5868ebc58b5b1f730.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_28c91eee00e8e4b5868ebc58b5b1f730.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/orbisius-child-theme-creator\/#developers","name":"https:\/\/wordpress.org\/plugins\/orbisius-child-theme-creator\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8315","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8315","refsource":"CONFIRM","tags":["Exploit","Third Party Advisory"]}]";}i:740;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9432";s:4:"slug";s:31:"alpine-photo-tile-for-instagram";s:19:"versionEndExcluding";s:7:"1.2.7.6";s:11:"description";s:197:"The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.";s:4:"refs";s:657:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_8af3902b4f3a5d06304937c7eab1ee35.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_8af3902b4f3a5d06304937c7eab1ee35.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/alpine-photo-tile-for-instagram\/#developers","name":"https:\/\/wordpress.org\/plugins\/alpine-photo-tile-for-instagram\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8268","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8268","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:741;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18535";s:4:"slug";s:11:"smokesignal";s:19:"versionEndExcluding";s:5:"1.2.7";s:11:"description";s:58:"The smokesignal plugin before 1.2.7 for WordPress has XSS.";s:4:"refs";s:182:"[{"url":"https:\/\/wordpress.org\/plugins\/smokesignal\/#developers","name":"https:\/\/wordpress.org\/plugins\/smokesignal\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:742;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11004";s:4:"slug";s:22:"Elegant Themes Monarch";s:19:"versionEndExcluding";s:5:"1.2.7";s:11:"description";s:86:"The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.";s:4:"refs";s:469:"[{"url":"http:\/\/www.pritect.net\/blog\/elegant-themes-security-vulnerability","name":"http:\/\/www.pritect.net\/blog\/elegant-themes-security-vulnerability","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wptavern.com\/critical-security-vulnerability-discovered-in-elegant-themes-products","name":"https:\/\/wptavern.com\/critical-security-vulnerability-discovered-in-elegant-themes-products","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:743;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11004";s:4:"slug";s:22:"Elegant Themes Monarch";s:19:"versionEndExcluding";s:5:"1.2.7";s:11:"description";s:86:"The Elegant Themes Monarch plugin before 1.2.7 for WordPress has privilege escalation.";s:4:"refs";s:469:"[{"url":"http:\/\/www.pritect.net\/blog\/elegant-themes-security-vulnerability","name":"http:\/\/www.pritect.net\/blog\/elegant-themes-security-vulnerability","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wptavern.com\/critical-security-vulnerability-discovered-in-elegant-themes-products","name":"https:\/\/wptavern.com\/critical-security-vulnerability-discovered-in-elegant-themes-products","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:744;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20963";s:4:"slug";s:21:"contact-form-to-email";s:19:"versionEndExcluding";s:6:"1.2.66";s:11:"description";s:69:"The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.";s:4:"refs";s:209:"[{"url":"https:\/\/wordpress.org\/plugins\/contact-form-to-email\/#developers","name":"https:\/\/wordpress.org\/plugins\/contact-form-to-email\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:745;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20964";s:4:"slug";s:21:"contact-form-to-email";s:19:"versionEndExcluding";s:6:"1.2.66";s:11:"description";s:70:"The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.";s:4:"refs";s:209:"[{"url":"https:\/\/wordpress.org\/plugins\/contact-form-to-email\/#developers","name":"https:\/\/wordpress.org\/plugins\/contact-form-to-email\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:746;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9646";s:4:"slug";s:21:"contact-form-to-email";s:19:"versionEndExcluding";s:6:"1.2.66";s:11:"description";s:163:"The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition area."";s:4:"refs";s:692:"[{"url":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/7","name":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/7","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-contact-form-email-xss-csrf\/","name":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-contact-form-email-xss-csrf\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/contact-form-to-email\/#developers","name":"https:\/\/wordpress.org\/plugins\/contact-form-to-email\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:747;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10877";s:4:"slug";s:9:"wp-editor";s:19:"versionEndExcluding";s:7:"1.2.6.3";s:11:"description";s:74:"The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.";s:4:"refs";s:196:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-editor\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-editor\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:748;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10877";s:4:"slug";s:9:"wp-editor";s:19:"versionEndExcluding";s:7:"1.2.6.3";s:11:"description";s:74:"The wp-editor plugin before 1.2.6.3 for WordPress has multiple XSS issues.";s:4:"refs";s:196:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-editor\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-editor\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:749;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10736";s:4:"slug";s:40:""Social Pug - Easy Social Share Buttons"";s:19:"versionEndExcluding";s:5:"1.2.6";s:11:"description";s:164:"The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_message_class parameter.";s:4:"refs";s:405:"[{"url":"https:\/\/advisories.dxw.com\/advisories\/reflected-xss-in-social-pug-easy-social-share-buttons-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can\/","name":"https:\/\/advisories.dxw.com\/advisories\/reflected-xss-in-social-pug-easy-social-share-buttons-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:750;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:44:"yith-paypal-express-checkout-for-woocommerce";s:19:"versionEndExcluding";s:5:"1.2.6";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:751;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10885";s:4:"slug";s:9:"wp-editor";s:19:"versionEndExcluding";s:5:"1.2.6";s:11:"description";s:57:"The wp-editor plugin before 1.2.6 for WordPress has CSRF.";s:4:"refs";s:178:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-editor\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-editor\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:752;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10885";s:4:"slug";s:9:"wp-editor";s:19:"versionEndExcluding";s:5:"1.2.6";s:11:"description";s:57:"The wp-editor plugin before 1.2.6 for WordPress has CSRF.";s:4:"refs";s:178:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-editor\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-editor\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:753;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10886";s:4:"slug";s:9:"wp-editor";s:19:"versionEndExcluding";s:5:"1.2.6";s:11:"description";s:74:"The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.";s:4:"refs";s:202:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-editor\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-editor\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:754;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10886";s:4:"slug";s:9:"wp-editor";s:19:"versionEndExcluding";s:5:"1.2.6";s:11:"description";s:74:"The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.";s:4:"refs";s:202:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-editor\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-editor\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:755;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18575";s:4:"slug";s:12:"newstatpress";s:19:"versionEndExcluding";s:5:"1.2.5";s:11:"description";s:82:"The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.";s:4:"refs";s:207:"[{"url":"https:\/\/wordpress.org\/plugins\/newstatpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/newstatpress\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:756;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10382";s:4:"slug";s:16:"feature-comments";s:19:"versionEndExcluding";s:5:"1.2.5";s:11:"description";s:99:"The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.";s:4:"refs";s:192:"[{"url":"https:\/\/wordpress.org\/plugins\/feature-comments\/#developers","name":"https:\/\/wordpress.org\/plugins\/feature-comments\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:757;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15776";s:4:"slug";s:40:"simple-301-redirects-addon-bulk-uploader";s:19:"versionEndExcluding";s:5:"1.2.5";s:11:"description";s:148:"The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CSV file.";s:4:"refs";s:697:"[{"url":"https:\/\/threatpost.com\/wordpress-plugins-exploited-in-ongoing-attack-researchers-warn\/147671\/","name":"https:\/\/threatpost.com\/wordpress-plugins-exploited-in-ongoing-attack-researchers-warn\/147671\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/simple-301-redirects-addon-bulk-uploader\/#developers","name":"https:\/\/wordpress.org\/plugins\/simple-301-redirects-addon-bulk-uploader\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9503","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9503","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:758;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15818";s:4:"slug";s:40:"simple-301-redirects-addon-bulk-uploader";s:19:"versionEndExcluding";s:5:"1.2.5";s:11:"description";s:170:"The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301export or action=bulk301clearlist.";s:4:"refs";s:749:"[{"url":"https:\/\/blog.nintechnet.com\/unauthenticated-option-changes-in-wordpress-simple-301-redirects-addon-bulk-uploader-plugin\/","name":"https:\/\/blog.nintechnet.com\/unauthenticated-option-changes-in-wordpress-simple-301-redirects-addon-bulk-uploader-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/simple-301-redirects-addon-bulk-uploader\/#developers","name":"https:\/\/wordpress.org\/plugins\/simple-301-redirects-addon-bulk-uploader\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9503","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9503","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:759;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9380";s:4:"slug";s:13:"photo-gallery";s:19:"versionEndExcluding";s:6:"1.2.42";s:11:"description";s:62:"The photo-gallery plugin before 1.2.42 for WordPress has CSRF.";s:4:"refs";s:614:"[{"url":"https:\/\/wordpress.org\/plugins\/photo-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/photo-gallery\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/support\/topic\/this-plugin-is-reported-as-vulnerable\/","name":"https:\/\/wordpress.org\/support\/topic\/this-plugin-is-reported-as-vulnerable\/","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/7225","name":"https:\/\/wpvulndb.com\/vulnerabilities\/7225","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:760;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15895";s:4:"slug";s:14:"search-exclude";s:19:"versionEndExcluding";s:5:"1.2.4";s:11:"description";s:116:"search-exclude.php in the "Search Exclude" plugin before 1.2.4 for WordPress allows unauthenticated options changes.";s:4:"refs";s:594:"[{"url":"https:\/\/blog.nintechnet.com\/settings-change-vulnerability-in-wordpress-search-exclude-plugin\/","name":"https:\/\/blog.nintechnet.com\/settings-change-vulnerability-in-wordpress-search-exclude-plugin\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/search-exclude\/#developers","name":"https:\/\/wordpress.org\/plugins\/search-exclude\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9870","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9870","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:761;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9342";s:4:"slug";s:11:"wp-rollback";s:19:"versionEndExcluding";s:5:"1.2.3";s:11:"description";s:58:"The wp-rollback plugin before 1.2.3 for WordPress has XSS.";s:4:"refs";s:182:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-rollback\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-rollback\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:762;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9343";s:4:"slug";s:11:"wp-rollback";s:19:"versionEndExcluding";s:5:"1.2.3";s:11:"description";s:59:"The wp-rollback plugin before 1.2.3 for WordPress has CSRF.";s:4:"refs";s:182:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-rollback\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-rollback\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:763;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20984";s:4:"slug";s:15:"patreon-connect";s:19:"versionEndExcluding";s:5:"1.2.2";s:11:"description";s:75:"The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/patreon-connect\/#developers","name":"https:\/\/wordpress.org\/plugins\/patreon-connect\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:764;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-14063";s:4:"slug";s:20:"tc-custom-javascript";s:19:"versionEndExcluding";s:5:"1.2.2";s:11:"description";s:316:"A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript via the tccj-content parameter. This is displayed in the page footer of every front-end page and executed in the browser of visitors.";s:4:"refs";s:447:"[{"url":"https:\/\/wordpress.org\/plugins\/tc-custom-javascript\/#developers","name":"https:\/\/wordpress.org\/plugins\/tc-custom-javascript\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/07\/high-severity-vulnerability-patched-in-tc-custom-javascript\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/07\/high-severity-vulnerability-patched-in-tc-custom-javascript\/","refsource":"MISC","tags":[]}]";}i:765;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15114";s:4:"slug";s:22:"formcraft-form-builder";s:19:"versionEndExcluding";s:5:"1.2.2";s:11:"description";s:70:"The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.";s:4:"refs";s:228:"[{"url":"https:\/\/wordpress.org\/plugins\/formcraft-form-builder\/#developers","name":"https:\/\/wordpress.org\/plugins\/formcraft-form-builder\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:766;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2012-6718";s:4:"slug";s:8:"sharebar";s:19:"versionEndExcluding";s:5:"1.2.2";s:11:"description";s:93:"The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491.";s:4:"refs";s:199:"[{"url":"https:\/\/wordpress.org\/plugins\/sharebar\/#developers","name":"https:\/\/wordpress.org\/plugins\/sharebar\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:767;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2012-6719";s:4:"slug";s:8:"sharebar";s:19:"versionEndExcluding";s:5:"1.2.2";s:11:"description";s:65:"The sharebar plugin before 1.2.2 for WordPress has SQL injection.";s:4:"refs";s:199:"[{"url":"https:\/\/wordpress.org\/plugins\/sharebar\/#developers","name":"https:\/\/wordpress.org\/plugins\/sharebar\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:768;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:37:"yith-woocommerce-bulk-product-editing";s:19:"versionEndExcluding";s:6:"1.2.15";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:769;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:28:"yith-woocommerce-pdf-invoice";s:19:"versionEndExcluding";s:6:"1.2.13";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:770;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:31:"yith-woocommerce-order-tracking";s:19:"versionEndExcluding";s:6:"1.2.11";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:771;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:43:"yith-woocommerce-frequently-bought-together";s:19:"versionEndExcluding";s:6:"1.2.11";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:772;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18564";s:4:"slug";s:6:"sender";s:19:"versionEndExcluding";s:5:"1.2.1";s:11:"description";s:69:"The sender plugin before 1.2.1 for WordPress has multiple XSS issues.";s:4:"refs";s:172:"[{"url":"https:\/\/wordpress.org\/plugins\/sender\/#developers","name":"https:\/\/wordpress.org\/plugins\/sender\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:773;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18576";s:4:"slug";s:14:"event-notifier";s:19:"versionEndExcluding";s:5:"1.2.1";s:11:"description";s:87:"The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/event-notifier\/#developers","name":"https:\/\/wordpress.org\/plugins\/event-notifier\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:774;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:30:"yith-pre-order-for-woocommerce";s:19:"versionEndExcluding";s:5:"1.2.1";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:775;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18490";s:4:"slug";s:18:"contact-form-multi";s:19:"versionEndExcluding";s:5:"1.2.1";s:11:"description";s:81:"The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.";s:4:"refs";s:219:"[{"url":"https:\/\/wordpress.org\/plugins\/contact-form-multi\/#developers","name":"https:\/\/wordpress.org\/plugins\/contact-form-multi\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:776;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10394";s:4:"slug";s:12:"rich-counter";s:19:"versionEndExcluding";s:5:"1.2.0";s:11:"description";s:100:"The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header.";s:4:"refs";s:184:"[{"url":"https:\/\/wordpress.org\/plugins\/rich-counter\/#developers","name":"https:\/\/wordpress.org\/plugins\/rich-counter\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:777;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:38:"yith-woocommerce-questions-and-answers";s:19:"versionEndExcluding";s:5:"1.2.0";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:778;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15820";s:4:"slug";s:25:"login-or-logout-menu-item";s:19:"versionEndExcluding";s:5:"1.2.0";s:11:"description";s:122:"The login-or-logout-menu-item plugin before 1.2.0 for WordPress has no requirement for lolmi_save_settings authentication.";s:4:"refs";s:689:"[{"url":"https:\/\/blog.nintechnet.com\/unauthenticated-options-change-in-wordpress-login-or-logout-menu-item-plugin\/","name":"https:\/\/blog.nintechnet.com\/unauthenticated-options-change-in-wordpress-login-or-logout-menu-item-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/login-or-logout-menu-item\/#developers","name":"https:\/\/wordpress.org\/plugins\/login-or-logout-menu-item\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9500","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9500","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:779;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-15811";s:4:"slug";s:13:"Pootle Button";s:19:"versionEndExcluding";s:5:"1.2.0";s:11:"description";s:151:"The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php.";s:4:"refs";s:695:"[{"url":"https:\/\/packetstormsecurity.com\/files\/144582\/WordPress-Pootle-Button-1.1.1-Cross-Site-Scripting.html","name":"https:\/\/packetstormsecurity.com\/files\/144582\/WordPress-Pootle-Button-1.1.1-Cross-Site-Scripting.html","refsource":"MISC","tags":["Third Party Advisory","VDB Entry"]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/1745805\/pootle-button\/tags\/","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/1745805\/pootle-button\/tags\/","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8930","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8930","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:780;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9429";s:4:"slug";s:21:"yith-maintenance-mode";s:19:"versionEndExcluding";s:5:"1.2.0";s:11:"description";s:164:"The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter.";s:4:"refs";s:637:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_3a14a77571c73684103e0f517a92d757.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_3a14a77571c73684103e0f517a92d757.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/yith-maintenance-mode\/#developers","name":"https:\/\/wordpress.org\/plugins\/yith-maintenance-mode\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8285","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8285","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:781;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-7412";s:4:"slug";s:13:"ps-phpcaptcha";s:19:"versionEndExcluding";s:5:"1.2.0";s:11:"description";s:96:"The PS PHPCaptcha WP plugin before v1.2.0 for WordPress mishandles sanitization of input values.";s:4:"refs";s:533:"[{"url":"https:\/\/metamorfosec.com\/Files\/Advisories\/METS-2019-003-Denial_of_Service_in_PS_PHPCaptcha_WP_before_v1.2.0.txt","name":"https:\/\/metamorfosec.com\/Files\/Advisories\/METS-2019-003-Denial_of_Service_in_PS_PHPCaptcha_WP_before_v1.2.0.txt","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/ps-phpcaptcha\/#developers","name":"https:\/\/wordpress.org\/plugins\/ps-phpcaptcha\/#developers","refsource":"MISC","tags":["Product","Release Notes","Third Party Advisory"]}]";}i:782;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10976";s:4:"slug";s:11:"safe-editor";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:98:"The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.";s:4:"refs";s:348:"[{"url":"https:\/\/wordpress.org\/plugins\/safe-editor\/#developers","name":"https:\/\/wordpress.org\/plugins\/safe-editor\/#developers","refsource":"MISC","tags":["Product"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8497","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8497","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:783;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10976";s:4:"slug";s:11:"safe-editor";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:98:"The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.";s:4:"refs";s:348:"[{"url":"https:\/\/wordpress.org\/plugins\/safe-editor\/#developers","name":"https:\/\/wordpress.org\/plugins\/safe-editor\/#developers","refsource":"MISC","tags":["Product"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8497","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8497","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:784;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10984";s:4:"slug";s:8:"echosign";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:84:"The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.";s:4:"refs";s:618:"[{"url":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/echosign-plugin-for-wordpress-xss-vulnerability\/","name":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/echosign-plugin-for-wordpress-xss-vulnerability\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/echosign\/#developers","name":"https:\/\/wordpress.org\/plugins\/echosign\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8465","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8465","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:785;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10984";s:4:"slug";s:8:"echosign";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:84:"The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.";s:4:"refs";s:618:"[{"url":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/echosign-plugin-for-wordpress-xss-vulnerability\/","name":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/echosign-plugin-for-wordpress-xss-vulnerability\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/echosign\/#developers","name":"https:\/\/wordpress.org\/plugins\/echosign\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8465","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8465","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:786;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10985";s:4:"slug";s:8:"echosign";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:102:"The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.";s:4:"refs";s:618:"[{"url":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/echosign-plugin-for-wordpress-xss-vulnerability\/","name":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/echosign-plugin-for-wordpress-xss-vulnerability\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/echosign\/#developers","name":"https:\/\/wordpress.org\/plugins\/echosign\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8465","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8465","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:787;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10985";s:4:"slug";s:8:"echosign";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:102:"The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.";s:4:"refs";s:618:"[{"url":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/echosign-plugin-for-wordpress-xss-vulnerability\/","name":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/echosign-plugin-for-wordpress-xss-vulnerability\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/echosign\/#developers","name":"https:\/\/wordpress.org\/plugins\/echosign\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8465","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8465","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:788;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2013-7476";s:4:"slug";s:13:"simple-fields";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:82:"The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.";s:4:"refs";s:210:"[{"url":"https:\/\/wordpress.org\/plugins\/simple-fields\/#developers","name":"https:\/\/wordpress.org\/plugins\/simple-fields\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:789;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2011-5328";s:4:"slug";s:19:"user-access-manager";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:65:"The user-access-manager plugin before 1.2 for WordPress has CSRF.";s:4:"refs";s:198:"[{"url":"https:\/\/wordpress.org\/plugins\/user-access-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/user-access-manager\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:790;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9332";s:4:"slug";s:9:"uninstall";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:129:"The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.";s:4:"refs";s:178:"[{"url":"https:\/\/wordpress.org\/plugins\/uninstall\/#developers","name":"https:\/\/wordpress.org\/plugins\/uninstall\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:791;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-3844";s:4:"slug";s:20:"TinyMCE Color Picker";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:246:"The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecified vectors.  NOTE: some of these details are obtained from third party information.";s:4:"refs";s:274:"[{"url":"http:\/\/secunia.com\/advisories\/58095","name":"58095","refsource":"SECUNIA","tags":[]},{"url":"http:\/\/wordpress.org\/plugins\/tinymce-colorpicker\/changelog","name":"http:\/\/wordpress.org\/plugins\/tinymce-colorpicker\/changelog","refsource":"MISC","tags":[]}]";}i:792;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-35135";s:4:"slug";s:26:"ultimate-category-excluder";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:106:"The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF.";s:4:"refs";s:359:"[{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2434070","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2434070","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/ultimate-category-excluder\/#developers","name":"https:\/\/wordpress.org\/plugins\/ultimate-category-excluder\/#developers","refsource":"MISC","tags":[]}]";}i:793;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15822";s:4:"slug";s:25:"wps-child-theme-generator";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:106:"The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.";s:4:"refs";s:637:"[{"url":"https:\/\/secupress.me\/blog\/wps-child-theme-generator-v1-1-multiples-vulnerabilities\/","name":"https:\/\/secupress.me\/blog\/wps-child-theme-generator-v1-1-multiples-vulnerabilities\/","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wps-child-theme-generator\/#developers","name":"https:\/\/wordpress.org\/plugins\/wps-child-theme-generator\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9470","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9470","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:794;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10924";s:4:"slug";s:14:"ebook-download";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:75:"The ebook-download plugin before 1.2 for WordPress has directory traversal.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/ebook-download\/#developers","name":"https:\/\/wordpress.org\/plugins\/ebook-download\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:795;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10924";s:4:"slug";s:14:"ebook-download";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:75:"The ebook-download plugin before 1.2 for WordPress has directory traversal.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/ebook-download\/#developers","name":"https:\/\/wordpress.org\/plugins\/ebook-download\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:796;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9448";s:4:"slug";s:9:"sendpress";s:19:"versionEndExcluding";s:3:"1.2";s:11:"description";s:122:"The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter.";s:4:"refs";s:596:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_8a2f7613577ea8e613ec274aeec14527.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_8a2f7613577ea8e613ec274aeec14527.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/sendpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/sendpress\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8324","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8324","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:797;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15827";s:4:"slug";s:37:"onesignal-free-web-push-notifications";s:19:"versionEndExcluding";s:6:"1.17.8";s:11:"description";s:113:"The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.";s:4:"refs";s:631:"[{"url":"https:\/\/wordpress.org\/plugins\/onesignal-free-web-push-notifications\/#developers","name":"https:\/\/wordpress.org\/plugins\/onesignal-free-web-push-notifications\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9478","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9478","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.zeroscience.mk\/en\/vulnerabilities\/ZSL-2019-5530.php","name":"https:\/\/www.zeroscience.mk\/en\/vulnerabilities\/ZSL-2019-5530.php","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:798;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10949";s:4:"slug";s:18:"Relevanssi Premium";s:19:"versionEndExcluding";s:8:"1.14.6.1";s:11:"description";s:116:"The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.";s:4:"refs";s:443:"[{"url":"https:\/\/advisories.dxw.com\/advisories\/sql-injection-and-unserialization-vulnerability-in-relevanssi-premium-could-allow-admins-to-execute-arbitrary-code-in-some-circumstances\/","name":"https:\/\/advisories.dxw.com\/advisories\/sql-injection-and-unserialization-vulnerability-in-relevanssi-premium-could-allow-admins-to-execute-arbitrary-code-in-some-circumstances\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:799;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10949";s:4:"slug";s:18:"Relevanssi Premium";s:19:"versionEndExcluding";s:8:"1.14.6.1";s:11:"description";s:116:"The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.";s:4:"refs";s:443:"[{"url":"https:\/\/advisories.dxw.com\/advisories\/sql-injection-and-unserialization-vulnerability-in-relevanssi-premium-could-allow-admins-to-execute-arbitrary-code-in-some-circumstances\/","name":"https:\/\/advisories.dxw.com\/advisories\/sql-injection-and-unserialization-vulnerability-in-relevanssi-premium-could-allow-admins-to-execute-arbitrary-code-in-some-circumstances\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:800;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15326";s:4:"slug";s:31:"import-users-from-csv-with-meta";s:19:"versionEndExcluding";s:8:"1.14.2.1";s:11:"description";s:97:"The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.";s:4:"refs";s:384:"[{"url":"https:\/\/wordpress.org\/plugins\/import-users-from-csv-with-meta\/#developers","name":"https:\/\/wordpress.org\/plugins\/import-users-from-csv-with-meta\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9392","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9392","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:801;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15327";s:4:"slug";s:31:"import-users-from-csv-with-meta";s:19:"versionEndExcluding";s:8:"1.14.1.3";s:11:"description";s:99:"The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.";s:4:"refs";s:222:"[{"url":"https:\/\/wordpress.org\/plugins\/import-users-from-csv-with-meta\/#developers","name":"https:\/\/wordpress.org\/plugins\/import-users-from-csv-with-meta\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:802;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15328";s:4:"slug";s:31:"import-users-from-csv-with-meta";s:19:"versionEndExcluding";s:8:"1.14.0.3";s:11:"description";s:81:"The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.";s:4:"refs";s:474:"[{"url":"https:\/\/plugins.trac.wordpress.org\/browser\/import-users-from-csv-with-meta?rev=2050450","name":"https:\/\/plugins.trac.wordpress.org\/browser\/import-users-from-csv-with-meta?rev=2050450","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/import-users-from-csv-with-meta\/#developers","name":"https:\/\/wordpress.org\/plugins\/import-users-from-csv-with-meta\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:803;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15329";s:4:"slug";s:31:"import-users-from-csv-with-meta";s:19:"versionEndExcluding";s:8:"1.14.0.3";s:11:"description";s:82:"The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.";s:4:"refs";s:474:"[{"url":"https:\/\/plugins.trac.wordpress.org\/browser\/import-users-from-csv-with-meta?rev=2050450","name":"https:\/\/plugins.trac.wordpress.org\/browser\/import-users-from-csv-with-meta?rev=2050450","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/import-users-from-csv-with-meta\/#developers","name":"https:\/\/wordpress.org\/plugins\/import-users-from-csv-with-meta\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:804;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-11590";s:4:"slug";s:16:"10Web Form Maker";s:19:"versionEndExcluding";s:6:"1.13.5";s:11:"description";s:310:"The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.";s:4:"refs";s:596:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2019\/Apr\/36","name":"http:\/\/seclists.org\/fulldisclosure\/2019\/Apr\/36","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/04\/05\/11","name":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/04\/05\/11","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/form-maker\/#developers","name":"https:\/\/wordpress.org\/plugins\/form-maker\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:805;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-11591";s:4:"slug";s:22:"WebDorado Contact Form";s:19:"versionEndExcluding";s:6:"1.13.5";s:11:"description";s:316:"The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.";s:4:"refs";s:752:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2019\/Apr\/37","name":"http:\/\/seclists.org\/fulldisclosure\/2019\/Apr\/37","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/04\/05\/12","name":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/04\/05\/12","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/contact-form-maker\/#developers","name":"https:\/\/wordpress.org\/plugins\/contact-form-maker\/#developers","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9252","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9252","refsource":"MISC","tags":[]}]";}i:806;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18593";s:4:"slug";s:11:"updraftplus";s:19:"versionEndExcluding";s:6:"1.13.5";s:11:"description";s:130:"The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.";s:4:"refs";s:189:"[{"url":"https:\/\/wordpress.org\/plugins\/updraftplus\/#developers","name":"https:\/\/wordpress.org\/plugins\/updraftplus\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:807;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-10866";s:4:"slug";s:10:"form-maker";s:19:"versionEndExcluding";s:6:"1.13.3";s:11:"description";s:243:"In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.";s:4:"refs";s:542:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2019\/May\/8","name":"http:\/\/seclists.org\/fulldisclosure\/2019\/May\/8","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/form-maker\/#developers","name":"https:\/\/wordpress.org\/plugins\/form-maker\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9286","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9286","refsource":"MISC","tags":[]}]";}i:808;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-0890";s:4:"slug";s:42:"BestWebSoft Google Captcha (aka reCAPTCHA)";s:19:"versionEndExcluding";s:4:"1.13";s:11:"description";s:204:"The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.";s:4:"refs";s:434:"[{"url":"http:\/\/jvn.jp\/en\/jp\/JVN55063777\/index.html","name":"JVN#55063777","refsource":"JVN","tags":["Vendor Advisory"]},{"url":"http:\/\/jvndb.jvn.jp\/jvndb\/JVNDB-2015-000030","name":"JVNDB-2015-000030","refsource":"JVNDB","tags":["Vendor Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/google-captcha\/changelog\/","name":"https:\/\/wordpress.org\/plugins\/google-captcha\/changelog\/","refsource":"CONFIRM","tags":[]}]";}i:809;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15832";s:4:"slug";s:37:"visitors-traffic-real-time-statistics";s:19:"versionEndExcluding";s:4:"1.13";s:11:"description";s:84:"The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF.";s:4:"refs";s:429:"[{"url":"https:\/\/wordpress.org\/plugins\/visitors-traffic-real-time-statistics\/#developers","name":"https:\/\/wordpress.org\/plugins\/visitors-traffic-real-time-statistics\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9420","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9420","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:810;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-15812";s:4:"slug";s:17:"Easy Appointments";s:19:"versionEndExcluding";s:6:"1.12.0";s:11:"description";s:106:"The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.";s:4:"refs";s:357:"[{"url":"https:\/\/wordpress.org\/plugins\/easy-appointments\/#developers","name":"https:\/\/wordpress.org\/plugins\/easy-appointments\/#developers","refsource":"MISC","tags":["Issue Tracking"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8937","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8937","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:811;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15831";s:4:"slug";s:37:"visitors-traffic-real-time-statistics";s:19:"versionEndExcluding";s:4:"1.12";s:11:"description";s:105:"The visitors-traffic-real-time-statistics plugin before 1.12 for WordPress has CSRF in the settings page.";s:4:"refs";s:419:"[{"url":"https:\/\/wordpress.org\/plugins\/visitors-traffic-real-time-statistics\/#developers","name":"https:\/\/wordpress.org\/plugins\/visitors-traffic-real-time-statistics\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9420","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9420","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:812;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16521";s:4:"slug";s:19:"broken-link-checker";s:19:"versionEndExcluding";s:6:"1.11.9";s:11:"description";s:402:"The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by providing an XSS payload in the s_filter GET parameter in a filter_id=search request. NOTE: this is an end-of-life product.";s:4:"refs";s:992:"[{"url":"http:\/\/www.openwall.com\/lists\/oss-security\/2019\/10\/16\/3","name":"[oss-security] 20191016 [SBA-ADV-20190913-02] CVE-2019-16521: WordPress Plugin - Broken Link Checker <= 1.11.8 - Reflected XSS","refsource":"MLIST","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/github.com\/sbaresearch\/advisories\/tree\/public\/2019\/SBA-ADV-20190913-02_WordPress_Plugin_Broken_Link_Checker","name":"https:\/\/github.com\/sbaresearch\/advisories\/tree\/public\/2019\/SBA-ADV-20190913-02_WordPress_Plugin_Broken_Link_Checker","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/broken-link-checker\/#developers","name":"https:\/\/wordpress.org\/plugins\/broken-link-checker\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9917","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9917","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:813;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17207";s:4:"slug";s:19:"broken-link-checker";s:19:"versionEndExcluding";s:6:"1.11.9";s:11:"description";s:344:"A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the wp-admin/tools.php?page=view-broken-links s_filter parameter in a search action.";s:4:"refs";s:905:"[{"url":"http:\/\/packetstormsecurity.com\/files\/154875\/WordPress-Broken-Link-Checker-1.11.8-Cross-Site-Scripting.html","name":"http:\/\/packetstormsecurity.com\/files\/154875\/WordPress-Broken-Link-Checker-1.11.8-Cross-Site-Scripting.html","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http:\/\/seclists.org\/fulldisclosure\/2019\/Oct\/31","name":"20191015 Reflected XSS via Broken Link Checker v.1.11.8 WordPress Plugin","refsource":"FULLDISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/broken-link-checker\/#developers","name":"https:\/\/wordpress.org\/plugins\/broken-link-checker\/#developers","refsource":"MISC","tags":["Product"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9917","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9917","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:814;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9426";s:4:"slug";s:17:"manual-image-crop";s:19:"versionEndExcluding";s:4:"1.11";s:11:"description";s:157:"The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.";s:4:"refs";s:629:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_7c87194ce1dcf0642135d17a71ed91cd.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_7c87194ce1dcf0642135d17a71ed91cd.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/manual-image-crop\/#developers","name":"https:\/\/wordpress.org\/plugins\/manual-image-crop\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8297","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8297","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:815;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-14071";s:4:"slug";s:10:"geo-mashup";s:19:"versionEndExcluding";s:6:"1.10.4";s:11:"description";s:116:"The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input.";s:4:"refs";s:731:"[{"url":"https:\/\/github.com\/cyberhobo\/wordpress-geo-mashup\/blob\/master\/readme.txt","name":"https:\/\/github.com\/cyberhobo\/wordpress-geo-mashup\/blob\/master\/readme.txt","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/github.com\/cyberhobo\/wordpress-geo-mashup\/commit\/838e2fe15a2328f5ae3dfc75d90e420509286f2f","name":"https:\/\/github.com\/cyberhobo\/wordpress-geo-mashup\/commit\/838e2fe15a2328f5ae3dfc75d90e420509286f2f","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/github.com\/cyberhobo\/wordpress-geo-mashup\/issues\/817","name":"https:\/\/github.com\/cyberhobo\/wordpress-geo-mashup\/issues\/817","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:816;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-14071";s:4:"slug";s:10:"geo-mashup";s:19:"versionEndExcluding";s:6:"1.10.4";s:11:"description";s:116:"The Geo Mashup plugin before 1.10.4 for WordPress has insufficient sanitization of post editor and other user input.";s:4:"refs";s:731:"[{"url":"https:\/\/github.com\/cyberhobo\/wordpress-geo-mashup\/blob\/master\/readme.txt","name":"https:\/\/github.com\/cyberhobo\/wordpress-geo-mashup\/blob\/master\/readme.txt","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/github.com\/cyberhobo\/wordpress-geo-mashup\/commit\/838e2fe15a2328f5ae3dfc75d90e420509286f2f","name":"https:\/\/github.com\/cyberhobo\/wordpress-geo-mashup\/commit\/838e2fe15a2328f5ae3dfc75d90e420509286f2f","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/github.com\/cyberhobo\/wordpress-geo-mashup\/issues\/817","name":"https:\/\/github.com\/cyberhobo\/wordpress-geo-mashup\/issues\/817","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:817;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15830";s:4:"slug";s:7:"icegram";s:19:"versionEndExcluding";s:7:"1.10.29";s:11:"description";s:68:"The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS.";s:4:"refs";s:593:"[{"url":"https:\/\/blog.sucuri.net\/2019\/07\/icegram-persistent-cross-site-scripting.html","name":"https:\/\/blog.sucuri.net\/2019\/07\/icegram-persistent-cross-site-scripting.html","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/icegram\/#developers","name":"https:\/\/wordpress.org\/plugins\/icegram\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9440","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9440","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:818;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2018-5658";s:4:"slug";s:27:"responsive-coming-soon-page";s:19:"versionEndExcluding";s:5:"1.1.9";s:11:"description";s:175:"An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. CSRF exists via wp-admin/admin.php.

Ref: https://wpvulndb.com//vulnerabilities//9322";s:4:"refs";s:441:"[{"url":"https:\/\/github.com\/d4wner\/Vulnerabilities-Report\/blob\/master\/responsive-coming-soon-page.md","name":"https:\/\/github.com\/d4wner\/Vulnerabilities-Report\/blob\/master\/responsive-coming-soon-page.md","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9010","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9010","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:819;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9421";s:4:"slug";s:20:"olevmedia-shortcodes";s:19:"versionEndExcluding";s:5:"1.1.9";s:11:"description";s:150:"The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.";s:4:"refs";s:635:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_d9e466122cd9a6ca27db840cca277cdb.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_d9e466122cd9a6ca27db840cca277cdb.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/olevmedia-shortcodes\/#developers","name":"https:\/\/wordpress.org\/plugins\/olevmedia-shortcodes\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8338","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8338","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:820;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16525";s:4:"slug";s:9:"checklist";s:19:"versionEndExcluding";s:5:"1.1.9";s:11:"description";s:202:"An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code.";s:4:"refs";s:842:"[{"url":"https:\/\/packetstormsecurity.com\/files\/154436\/WordPress-Checklist-1.1.5-Cross-Site-Scripting.html","name":"https:\/\/packetstormsecurity.com\/files\/154436\/WordPress-Checklist-1.1.5-Cross-Site-Scripting.html","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/2155029\/","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/2155029\/","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/checklist\/#developers","name":"https:\/\/wordpress.org\/plugins\/checklist\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9877","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9877","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:821;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-7104";s:4:"slug";s:12:"chained-quiz";s:19:"versionEndExcluding";s:7:"1.1.8.2";s:11:"description";s:122:"The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.";s:4:"refs";s:143:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10029","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10029","refsource":"MISC","tags":[]}]";}i:822;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:42:"yith-custom-thank-you-page-for-woocommerce";s:19:"versionEndExcluding";s:5:"1.1.8";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:823;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18512";s:4:"slug";s:23:"newsletter-by-supsystic";s:19:"versionEndExcluding";s:5:"1.1.8";s:11:"description";s:71:"The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.";s:4:"refs";s:230:"[{"url":"https:\/\/wordpress.org\/plugins\/newsletter-by-supsystic\/#developers","name":"https:\/\/wordpress.org\/plugins\/newsletter-by-supsystic\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:824;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10380";s:4:"slug";s:15:"profile-builder";s:19:"versionEndExcluding";s:6:"1.1.66";s:11:"description";s:88:"The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/profile-builder\/#developers","name":"https:\/\/wordpress.org\/plugins\/profile-builder\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:825;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-14092";s:4:"slug";s:27:"payment-form-for-paypal-pro";s:19:"versionEndExcluding";s:6:"1.1.65";s:11:"description";s:99:"The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.";s:4:"refs";s:529:"[{"url":"https:\/\/wordpress.dwbooster.com\/forms\/payment-form-for-paypal-pro","name":"https:\/\/wordpress.dwbooster.com\/forms\/payment-form-for-paypal-pro","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/payment-form-for-paypal-pro\/#developers","name":"https:\/\/wordpress.org\/plugins\/payment-form-for-paypal-pro\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10287","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10287","refsource":"MISC","tags":[]}]";}i:826;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-21005";s:4:"slug";s:15:"bbp-move-topics";s:19:"versionEndExcluding";s:5:"1.1.6";s:11:"description";s:73:"The bbp-move-topics plugin before 1.1.6 for WordPress has code injection.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/bbp-move-topics\/#developers","name":"https:\/\/wordpress.org\/plugins\/bbp-move-topics\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:827;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-21006";s:4:"slug";s:15:"bbp-move-topics";s:19:"versionEndExcluding";s:5:"1.1.6";s:11:"description";s:63:"The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/bbp-move-topics\/#developers","name":"https:\/\/wordpress.org\/plugins\/bbp-move-topics\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:828;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9233";s:4:"slug";s:61:"cp-contact-form-with-paypal (aka CP Contact Form with PayPal)";s:19:"versionEndExcluding";s:5:"1.1.6";s:11:"description";s:205:"The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php.";s:4:"refs";s:615:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2015\/Jul\/49","name":"http:\/\/seclists.org\/fulldisclosure\/2015\/Jul\/49","refsource":"MISC","tags":["Mailing List","Third Party Advisory","VDB Entry"]},{"url":"http:\/\/seclists.org\/oss-sec\/2015\/q3\/88","name":"http:\/\/seclists.org\/oss-sec\/2015\/q3\/88","refsource":"MISC","tags":["Mailing List","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/cp-contact-form-with-paypal\/#developers","name":"https:\/\/wordpress.org\/plugins\/cp-contact-form-with-paypal\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:829;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9234";s:4:"slug";s:27:"cp-contact-form-with-paypal";s:19:"versionEndExcluding";s:5:"1.1.6";s:11:"description";s:180:"The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php.";s:4:"refs";s:615:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2015\/Jul\/49","name":"http:\/\/seclists.org\/fulldisclosure\/2015\/Jul\/49","refsource":"MISC","tags":["Mailing List","Third Party Advisory","VDB Entry"]},{"url":"http:\/\/seclists.org\/oss-sec\/2015\/q3\/88","name":"http:\/\/seclists.org\/oss-sec\/2015\/q3\/88","refsource":"MISC","tags":["Mailing List","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/cp-contact-form-with-paypal\/#developers","name":"https:\/\/wordpress.org\/plugins\/cp-contact-form-with-paypal\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:830;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10978";s:4:"slug";s:17:"fossura-tag-miner";s:19:"versionEndExcluding";s:5:"1.1.5";s:11:"description";s:65:"The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.";s:4:"refs";s:356:"[{"url":"https:\/\/wordpress.org\/plugins\/fossura-tag-miner\/#developers","name":"https:\/\/wordpress.org\/plugins\/fossura-tag-miner\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8486","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8486","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:831;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10978";s:4:"slug";s:17:"fossura-tag-miner";s:19:"versionEndExcluding";s:5:"1.1.5";s:11:"description";s:65:"The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF.";s:4:"refs";s:356:"[{"url":"https:\/\/wordpress.org\/plugins\/fossura-tag-miner\/#developers","name":"https:\/\/wordpress.org\/plugins\/fossura-tag-miner\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8486","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8486","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:832;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10979";s:4:"slug";s:17:"fossura-tag-miner";s:19:"versionEndExcluding";s:5:"1.1.5";s:11:"description";s:64:"The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.";s:4:"refs";s:194:"[{"url":"https:\/\/wordpress.org\/plugins\/fossura-tag-miner\/#developers","name":"https:\/\/wordpress.org\/plugins\/fossura-tag-miner\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:833;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10979";s:4:"slug";s:17:"fossura-tag-miner";s:19:"versionEndExcluding";s:5:"1.1.5";s:11:"description";s:64:"The fossura-tag-miner plugin before 1.1.5 for WordPress has XSS.";s:4:"refs";s:194:"[{"url":"https:\/\/wordpress.org\/plugins\/fossura-tag-miner\/#developers","name":"https:\/\/wordpress.org\/plugins\/fossura-tag-miner\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:834;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-17947";s:4:"slug";s:11:"Snazzy Maps";s:19:"versionEndExcluding";s:5:"1.1.5";s:11:"description";s:88:"The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.";s:4:"refs";s:672:"[{"url":"http:\/\/www.defensecode.com\/advisories\/DC-2018-05-006_WordPress_Snazzy_Maps_Plugin_Advisory.pdf","name":"http:\/\/www.defensecode.com\/advisories\/DC-2018-05-006_WordPress_Snazzy_Maps_Plugin_Advisory.pdf","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/seclists.org\/bugtraq\/2018\/Jul\/72","name":"https:\/\/seclists.org\/bugtraq\/2018\/Jul\/72","refsource":"MISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/snazzy-maps\/#developers","name":"https:\/\/wordpress.org\/plugins\/snazzy-maps\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:835;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18488";s:4:"slug";s:12:"Backup Guard";s:19:"versionEndExcluding";s:6:"1.1.47";s:11:"description";s:76:"The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.";s:4:"refs";s:179:"[{"url":"https:\/\/wordpress.org\/plugins\/backup\/#developers","name":"https:\/\/wordpress.org\/plugins\/backup\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:836;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15829";s:4:"slug";s:24:"photoblocks-grid-gallery";s:19:"versionEndExcluding";s:6:"1.1.43";s:11:"description";s:117:"The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.";s:4:"refs";s:377:"[{"url":"https:\/\/wordpress.org\/plugins\/photoblocks-grid-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/photoblocks-grid-gallery\/#developers","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9443","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9443","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:837;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10996";s:4:"slug";s:12:"optinmonster";s:19:"versionEndExcluding";s:7:"1.1.4.6";s:11:"description";s:121:"The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak.";s:4:"refs";s:416:"[{"url":"http:\/\/www.pritect.net\/blog\/optinmonster-1-1-4-6-security-vulnerability","name":"http:\/\/www.pritect.net\/blog\/optinmonster-1-1-4-6-security-vulnerability","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/optinmonster\/#developers","name":"https:\/\/wordpress.org\/plugins\/optinmonster\/#developers","refsource":"MISC","tags":["Product","Release Notes"]}]";}i:838;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15871";s:4:"slug";s:10:"loginpress";s:19:"versionEndExcluding";s:5:"1.1.4";s:11:"description";s:97:"The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings.";s:4:"refs";s:391:"[{"url":"https:\/\/wordpress.org\/plugins\/loginpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/loginpress\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/www.webarxsecurity.com\/loginpress-plugin\/","name":"https:\/\/www.webarxsecurity.com\/loginpress-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:839;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15872";s:4:"slug";s:10:"LoginPress";s:19:"versionEndExcluding";s:5:"1.1.4";s:11:"description";s:93:"The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.";s:4:"refs";s:391:"[{"url":"https:\/\/wordpress.org\/plugins\/loginpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/loginpress\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/www.webarxsecurity.com\/loginpress-plugin\/","name":"https:\/\/www.webarxsecurity.com\/loginpress-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:840;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10903";s:4:"slug";s:45:"GoDaddy godaddy-email-marketing-sign-up-forms";s:19:"versionEndExcluding";s:5:"1.1.3";s:11:"description";s:93:"The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.";s:4:"refs";s:234:"[{"url":"https:\/\/wordpress.org\/plugins\/godaddy-email-marketing-sign-up-forms\/#developers","name":"https:\/\/wordpress.org\/plugins\/godaddy-email-marketing-sign-up-forms\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:841;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10903";s:4:"slug";s:45:"GoDaddy godaddy-email-marketing-sign-up-forms";s:19:"versionEndExcluding";s:5:"1.1.3";s:11:"description";s:93:"The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.";s:4:"refs";s:234:"[{"url":"https:\/\/wordpress.org\/plugins\/godaddy-email-marketing-sign-up-forms\/#developers","name":"https:\/\/wordpress.org\/plugins\/godaddy-email-marketing-sign-up-forms\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:842;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10944";s:4:"slug";s:25:"multisite-post-duplicator";s:19:"versionEndExcluding";s:5:"1.1.3";s:11:"description";s:101:"The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.";s:4:"refs";s:608:"[{"url":"https:\/\/advisories.dxw.com\/advisories\/csrf-vulnerability-in-multisite-post-duplicator-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can-do\/","name":"https:\/\/advisories.dxw.com\/advisories\/csrf-vulnerability-in-multisite-post-duplicator-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can-do\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/multisite-post-duplicator\/#developers","name":"https:\/\/wordpress.org\/plugins\/multisite-post-duplicator\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:843;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10944";s:4:"slug";s:25:"multisite-post-duplicator";s:19:"versionEndExcluding";s:5:"1.1.3";s:11:"description";s:101:"The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF.";s:4:"refs";s:608:"[{"url":"https:\/\/advisories.dxw.com\/advisories\/csrf-vulnerability-in-multisite-post-duplicator-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can-do\/","name":"https:\/\/advisories.dxw.com\/advisories\/csrf-vulnerability-in-multisite-post-duplicator-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can-do\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/multisite-post-duplicator\/#developers","name":"https:\/\/wordpress.org\/plugins\/multisite-post-duplicator\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:844;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15778";s:4:"slug";s:21:"woo-variation-gallery";s:19:"versionEndExcluding";s:6:"1.1.29";s:11:"description";s:69:"The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS.";s:4:"refs";s:802:"[{"url":"https:\/\/wordpress.org\/plugins\/woo-variation-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/woo-variation-gallery\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9852","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9852","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2019\/08\/20\/vulnerablity-details-authenticated-persistent-cross-site-scripting-xss-in-additional-variation-images-for-woocommerce\/","name":"https:\/\/www.pluginvulnerabilities.com\/2019\/08\/20\/vulnerablity-details-authenticated-persistent-cross-site-scripting-xss-in-additional-variation-images-for-woocommerce\/","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:845;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10916";s:4:"slug";s:28:"appointment-booking-calendar";s:19:"versionEndExcluding";s:6:"1.1.24";s:11:"description";s:132:"The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.";s:4:"refs";s:239:"[{"url":"https:\/\/wordpress.org\/plugins\/appointment-booking-calendar\/#developers","name":"https:\/\/wordpress.org\/plugins\/appointment-booking-calendar\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:846;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10916";s:4:"slug";s:28:"appointment-booking-calendar";s:19:"versionEndExcluding";s:6:"1.1.24";s:11:"description";s:132:"The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.";s:4:"refs";s:239:"[{"url":"https:\/\/wordpress.org\/plugins\/appointment-booking-calendar\/#developers","name":"https:\/\/wordpress.org\/plugins\/appointment-booking-calendar\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:847;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18573";s:4:"slug";s:16:"simple-login-log";s:19:"versionEndExcluding";s:5:"1.1.2";s:11:"description";s:73:"The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.";s:4:"refs";s:215:"[{"url":"https:\/\/wordpress.org\/plugins\/simple-login-log\/#developers","name":"https:\/\/wordpress.org\/plugins\/simple-login-log\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:848;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11005";s:4:"slug";s:11:"instalinker";s:19:"versionEndExcluding";s:5:"1.1.2";s:11:"description";s:108:"The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.";s:4:"refs";s:443:"[{"url":"https:\/\/rastating.github.io\/instalinker-reflected-xss-information-disclosure\/","name":"https:\/\/rastating.github.io\/instalinker-reflected-xss-information-disclosure\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/instalinker\/#developers","name":"https:\/\/wordpress.org\/plugins\/instalinker\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]}]";}i:849;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11005";s:4:"slug";s:11:"instalinker";s:19:"versionEndExcluding";s:5:"1.1.2";s:11:"description";s:108:"The instalinker plugin before 1.1.2 for WordPress has includes/instalinker-admin-preview.php?client_id= XSS.";s:4:"refs";s:443:"[{"url":"https:\/\/rastating.github.io\/instalinker-reflected-xss-information-disclosure\/","name":"https:\/\/rastating.github.io\/instalinker-reflected-xss-information-disclosure\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/instalinker\/#developers","name":"https:\/\/wordpress.org\/plugins\/instalinker\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]}]";}i:850;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15842";s:4:"slug";s:31:"easy-pdf-restaurant-menu-upload";s:19:"versionEndExcluding";s:5:"1.1.2";s:11:"description";s:78:"The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.";s:4:"refs";s:240:"[{"url":"https:\/\/wordpress.org\/plugins\/easy-pdf-restaurant-menu-upload\/#developers","name":"https:\/\/wordpress.org\/plugins\/easy-pdf-restaurant-menu-upload\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:851;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18514";s:4:"slug";s:16:"simple-login-log";s:19:"versionEndExcluding";s:5:"1.1.2";s:11:"description";s:73:"The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.";s:4:"refs";s:215:"[{"url":"https:\/\/wordpress.org\/plugins\/simple-login-log\/#developers","name":"https:\/\/wordpress.org\/plugins\/simple-login-log\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:852;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:32:"yith-woocommerce-product-bundles";s:19:"versionEndExcluding";s:6:"1.1.17";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:853;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:40:"yith-product-size-charts-for-woocommerce";s:19:"versionEndExcluding";s:6:"1.1.13";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:854;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:45:"yith-woocommerce-authorizenet-payment-gateway";s:19:"versionEndExcluding";s:6:"1.1.13";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:855;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:29:"yith-woocommerce-best-sellers";s:19:"versionEndExcluding";s:6:"1.1.13";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:856;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9355";s:4:"slug";s:25:"two-factor-authentication";s:19:"versionEndExcluding";s:6:"1.1.10";s:11:"description";s:91:"The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.";s:4:"refs";s:233:"[{"url":"https:\/\/wordpress.org\/plugins\/two-factor-authentication\/#developers","name":"https:\/\/wordpress.org\/plugins\/two-factor-authentication\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:857;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18529";s:4:"slug";s:8:"promobar";s:19:"versionEndExcluding";s:5:"1.1.1";s:11:"description";s:71:"The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.";s:4:"refs";s:176:"[{"url":"https:\/\/wordpress.org\/plugins\/promobar\/#developers","name":"https:\/\/wordpress.org\/plugins\/promobar\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:858;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18554";s:4:"slug";s:17:"analytics-tracker";s:19:"versionEndExcluding";s:5:"1.1.1";s:11:"description";s:83:"The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.";s:4:"refs";s:194:"[{"url":"https:\/\/wordpress.org\/plugins\/analytics-tracker\/#developers","name":"https:\/\/wordpress.org\/plugins\/analytics-tracker\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:859;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11003";s:4:"slug";s:20:"Elegant Themes Bloom";s:19:"versionEndExcluding";s:5:"1.1.1";s:11:"description";s:84:"The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation.";s:4:"refs";s:469:"[{"url":"http:\/\/www.pritect.net\/blog\/elegant-themes-security-vulnerability","name":"http:\/\/www.pritect.net\/blog\/elegant-themes-security-vulnerability","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wptavern.com\/critical-security-vulnerability-discovered-in-elegant-themes-products","name":"https:\/\/wptavern.com\/critical-security-vulnerability-discovered-in-elegant-themes-products","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:860;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-11003";s:4:"slug";s:20:"Elegant Themes Bloom";s:19:"versionEndExcluding";s:5:"1.1.1";s:11:"description";s:84:"The Elegant Themes Bloom plugin before 1.1.1 for WordPress has privilege escalation.";s:4:"refs";s:469:"[{"url":"http:\/\/www.pritect.net\/blog\/elegant-themes-security-vulnerability","name":"http:\/\/www.pritect.net\/blog\/elegant-themes-security-vulnerability","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wptavern.com\/critical-security-vulnerability-discovered-in-elegant-themes-products","name":"https:\/\/wptavern.com\/critical-security-vulnerability-discovered-in-elegant-themes-products","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:861;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9321";s:4:"slug";s:17:"shortcode-factory";s:19:"versionEndExcluding";s:5:"1.1.1";s:11:"description";s:82:"The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.";s:4:"refs";s:194:"[{"url":"https:\/\/wordpress.org\/plugins\/shortcode-factory\/#developers","name":"https:\/\/wordpress.org\/plugins\/shortcode-factory\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:862;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9335";s:4:"slug";s:14:"limit-attempts";s:19:"versionEndExcluding";s:5:"1.1.1";s:11:"description";s:98:"The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/limit-attempts\/#developers","name":"https:\/\/wordpress.org\/plugins\/limit-attempts\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:863;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18500";s:4:"slug";s:19:"social-buttons-pack";s:19:"versionEndExcluding";s:5:"1.1.1";s:11:"description";s:82:"The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.";s:4:"refs";s:216:"[{"url":"https:\/\/wordpress.org\/plugins\/social-buttons-pack\/#developers","name":"https:\/\/wordpress.org\/plugins\/social-buttons-pack\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:864;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18518";s:4:"slug";s:8:"bws-smtp";s:19:"versionEndExcluding";s:5:"1.1.0";s:11:"description";s:71:"The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.";s:4:"refs";s:176:"[{"url":"https:\/\/wordpress.org\/plugins\/bws-smtp\/#developers","name":"https:\/\/wordpress.org\/plugins\/bws-smtp\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:865;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18532";s:4:"slug";s:6:"realty";s:19:"versionEndExcluding";s:5:"1.1.0";s:11:"description";s:69:"The realty plugin before 1.1.0 for WordPress has multiple XSS issues.";s:4:"refs";s:172:"[{"url":"https:\/\/wordpress.org\/plugins\/realty\/#developers","name":"https:\/\/wordpress.org\/plugins\/realty\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:866;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18555";s:4:"slug";s:11:"booking-sms";s:19:"versionEndExcluding";s:5:"1.1.0";s:11:"description";s:58:"The booking-sms plugin before 1.1.0 for WordPress has XSS.";s:4:"refs";s:182:"[{"url":"https:\/\/wordpress.org\/plugins\/booking-sms\/#developers","name":"https:\/\/wordpress.org\/plugins\/booking-sms\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:867;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9498";s:4:"slug";s:14:"wps-hide-login";s:19:"versionEndExcluding";s:3:"1.1";s:11:"description";s:96:"The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value.";s:4:"refs";s:316:"[{"url":"https:\/\/wordpress.org\/plugins\/wps-hide-login\/#developers","name":"https:\/\/wordpress.org\/plugins\/wps-hide-login\/#developers","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8011","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8011","refsource":"MISC","tags":[]}]";}i:868;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-15810";s:4:"slug";s:33:"PopCash.Net Code Integration Tool";s:19:"versionEndExcluding";s:3:"1.1";s:11:"description";s:122:"The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php.";s:4:"refs";s:759:"[{"url":"https:\/\/packetstormsecurity.com\/files\/144583\/WordPress-PopCash.Net-Publisher-Code-Integration-1.0-Cross-Site-Scripting.html","name":"https:\/\/packetstormsecurity.com\/files\/144583\/WordPress-PopCash.Net-Publisher-Code-Integration-1.0-Cross-Site-Scripting.html","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/popcashnet-code-integration-tool\/#developers","name":"https:\/\/wordpress.org\/plugins\/popcashnet-code-integration-tool\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8936","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8936","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:869;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9428";s:4:"slug";s:12:"wplegalpages";s:19:"versionEndExcluding";s:3:"1.1";s:11:"description";s:244:"The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters.";s:4:"refs";s:619:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_4e7cf11876edb93517405b69cb033741.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_4e7cf11876edb93517405b69cb033741.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wplegalpages\/#developers","name":"https:\/\/wordpress.org\/plugins\/wplegalpages\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8291","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8291","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:870;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10910";s:4:"slug";s:11:"formbuilder";s:19:"versionEndExcluding";s:4:"1.06";s:11:"description";s:73:"The formbuilder plugin before 1.06 for WordPress has multiple XSS issues.";s:4:"refs";s:182:"[{"url":"https:\/\/wordpress.org\/plugins\/formbuilder\/#developers","name":"https:\/\/wordpress.org\/plugins\/formbuilder\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:871;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18015";s:4:"slug";s:22:"ILLID Share This Image";s:19:"versionEndExcluding";s:4:"1.04";s:11:"description";s:101:"The ILLID Share This Image plugin before 1.04 for WordPress has XSS via the sharer.php url parameter.";s:4:"refs";s:908:"[{"url":"https:\/\/packetstormsecurity.com\/files\/145464\/WordPress-Share-This-Image-1.03-Cross-Site-Scripting.html","name":"https:\/\/packetstormsecurity.com\/files\/145464\/WordPress-Share-This-Image-1.03-Cross-Site-Scripting.html","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/share-this-image\/#developers","name":"https:\/\/wordpress.org\/plugins\/share-this-image\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wordpress.org\/support\/topic\/share-this-image-1-03-cross-site-scripting\/","name":"https:\/\/wordpress.org\/support\/topic\/share-this-image-1-03-cross-site-scripting\/","refsource":"MISC","tags":["Exploit","Issue Tracking"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8991","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8991","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:872;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10964";s:4:"slug";s:6:"dwnldr";s:19:"versionEndExcluding";s:4:"1.01";s:11:"description";s:83:"The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header.";s:4:"refs";s:407:"[{"url":"https:\/\/rastating.github.io\/dwnldr-1-0-stored-xss-disclosure\/","name":"https:\/\/rastating.github.io\/dwnldr-1-0-stored-xss-disclosure\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/dwnldr\/#developers","name":"https:\/\/wordpress.org\/plugins\/dwnldr\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:873;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10991";s:4:"slug";s:11:"imdb-widget";s:19:"versionEndExcluding";s:5:"1.0.9";s:11:"description";s:75:"The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion.";s:4:"refs";s:344:"[{"url":"https:\/\/wordpress.org\/plugins\/imdb-widget\/#developers","name":"https:\/\/wordpress.org\/plugins\/imdb-widget\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8426","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8426","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:874;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10991";s:4:"slug";s:11:"imdb-widget";s:19:"versionEndExcluding";s:5:"1.0.9";s:11:"description";s:75:"The imdb-widget plugin before 1.0.9 for WordPress has Local File Inclusion.";s:4:"refs";s:344:"[{"url":"https:\/\/wordpress.org\/plugins\/imdb-widget\/#developers","name":"https:\/\/wordpress.org\/plugins\/imdb-widget\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8426","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8426","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:875;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15644";s:4:"slug";s:12:"zoho-salesiq";s:19:"versionEndExcluding";s:5:"1.0.9";s:11:"description";s:66:"The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.";s:4:"refs";s:337:"[{"url":"https:\/\/wordpress.org\/plugins\/zoho-salesiq\/#developers","name":"https:\/\/wordpress.org\/plugins\/zoho-salesiq\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9433","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9433","refsource":"MISC","tags":["Broken Link"]}]";}i:876;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15645";s:4:"slug";s:12:"zoho-salesiq";s:19:"versionEndExcluding";s:5:"1.0.9";s:11:"description";s:60:"The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.";s:4:"refs";s:337:"[{"url":"https:\/\/wordpress.org\/plugins\/zoho-salesiq\/#developers","name":"https:\/\/wordpress.org\/plugins\/zoho-salesiq\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9433","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9433","refsource":"MISC","tags":["Broken Link"]}]";}i:877;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17072";s:4:"slug";s:23:"new-contact-form-widget";s:19:"versionEndExcluding";s:5:"1.0.9";s:11:"description";s:150:"The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.";s:4:"refs";s:436:"[{"url":"https:\/\/gist.github.com\/rezaduty\/18afedba24bb1e5835010bd2de67cece","name":"https:\/\/gist.github.com\/rezaduty\/18afedba24bb1e5835010bd2de67cece","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/new-contact-form-widget\/#description","name":"https:\/\/wordpress.org\/plugins\/new-contact-form-widget\/#description","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:878;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18579";s:4:"slug";s:9:"corner-ad";s:19:"versionEndExcluding";s:5:"1.0.8";s:11:"description";s:56:"The corner-ad plugin before 1.0.8 for WordPress has XSS.";s:4:"refs";s:178:"[{"url":"https:\/\/wordpress.org\/plugins\/corner-ad\/#developers","name":"https:\/\/wordpress.org\/plugins\/corner-ad\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:879;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9348";s:4:"slug";s:14:"sell-downloads";s:19:"versionEndExcluding";s:5:"1.0.8";s:11:"description";s:123:"The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/sell-downloads\/#developers","name":"https:\/\/wordpress.org\/plugins\/sell-downloads\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:880;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9384";s:4:"slug";s:8:"relevant";s:19:"versionEndExcluding";s:5:"1.0.8";s:11:"description";s:55:"The relevant plugin before 1.0.8 for WordPress has XSS.";s:4:"refs";s:361:"[{"url":"https:\/\/wordpress.org\/plugins\/relevant\/#developers","name":"https:\/\/wordpress.org\/plugins\/relevant\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8361","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8361","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:881;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-17070";s:4:"slug";s:21:"liquid-speech-balloon";s:19:"versionEndExcluding";s:5:"1.0.8";s:11:"description";s:122:"The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer.";s:4:"refs";s:430:"[{"url":"https:\/\/gist.github.com\/rezaduty\/18afedba24bb1e5835010bd2de67cece","name":"https:\/\/gist.github.com\/rezaduty\/18afedba24bb1e5835010bd2de67cece","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/liquid-speech-balloon\/#developers","name":"https:\/\/wordpress.org\/plugins\/liquid-speech-balloon\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:882;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18527";s:4:"slug";s:10:"pagination";s:19:"versionEndExcluding";s:5:"1.0.7";s:11:"description";s:73:"The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.";s:4:"refs";s:180:"[{"url":"https:\/\/wordpress.org\/plugins\/pagination\/#developers","name":"https:\/\/wordpress.org\/plugins\/pagination\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:883;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20974";s:4:"slug";s:7:"js-jobs";s:19:"versionEndExcluding";s:5:"1.0.7";s:11:"description";s:55:"The js-jobs plugin before 1.0.7 for WordPress has CSRF.";s:4:"refs";s:198:"[{"url":"https:\/\/wordpress.org\/plugins\/js-jobs\/#developers","name":"https:\/\/wordpress.org\/plugins\/js-jobs\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:884;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18562";s:4:"slug";s:16:"error-log-viewer";s:19:"versionEndExcluding";s:5:"1.0.6";s:11:"description";s:79:"The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.";s:4:"refs";s:192:"[{"url":"https:\/\/wordpress.org\/plugins\/error-log-viewer\/#developers","name":"https:\/\/wordpress.org\/plugins\/error-log-viewer\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:885;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9311";s:4:"slug";s:12:"newstatpress";s:19:"versionEndExcluding";s:5:"1.0.6";s:11:"description";s:69:"The newstatpress plugin before 1.0.6 for WordPress has reflected XSS.";s:4:"refs";s:207:"[{"url":"https:\/\/wordpress.org\/plugins\/newstatpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/newstatpress\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:886;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18542";s:4:"slug";s:19:"zendesk-help-center";s:19:"versionEndExcluding";s:5:"1.0.5";s:11:"description";s:82:"The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.";s:4:"refs";s:222:"[{"url":"https:\/\/wordpress.org\/plugins\/zendesk-help-center\/#developers","name":"https:\/\/wordpress.org\/plugins\/zendesk-help-center\/#developers","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"]}]";}i:887;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9312";s:4:"slug";s:12:"newstatpress";s:19:"versionEndExcluding";s:5:"1.0.5";s:11:"description";s:85:"The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element.";s:4:"refs";s:207:"[{"url":"https:\/\/wordpress.org\/plugins\/newstatpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/newstatpress\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:888;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9313";s:4:"slug";s:12:"newstatpress";s:19:"versionEndExcluding";s:5:"1.0.5";s:11:"description";s:95:"The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.";s:4:"refs";s:207:"[{"url":"https:\/\/wordpress.org\/plugins\/newstatpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/newstatpress\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:889;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9346";s:4:"slug";s:8:"cp-polls";s:19:"versionEndExcluding";s:5:"1.0.5";s:11:"description";s:55:"The cp-polls plugin before 1.0.5 for WordPress has XSS.";s:4:"refs";s:176:"[{"url":"https:\/\/wordpress.org\/plugins\/cp-polls\/#developers","name":"https:\/\/wordpress.org\/plugins\/cp-polls\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:890;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9405";s:4:"slug";s:8:"wp-piwik";s:19:"versionEndExcluding";s:5:"1.0.5";s:11:"description";s:55:"The wp-piwik plugin before 1.0.5 for WordPress has XSS.";s:4:"refs";s:627:"[{"url":"https:\/\/github.com\/braekling\/WP-Matomo\/commit\/5110bfdb437a9f19b185ba8af33776fcb5e19940","name":"https:\/\/github.com\/braekling\/WP-Matomo\/commit\/5110bfdb437a9f19b185ba8af33776fcb5e19940","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/wp-piwik\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-piwik\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8216","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8216","refsource":"MISC","tags":["Patch","Third Party Advisory"]}]";}i:891;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18516";s:4:"slug";s:12:"bws-linkedin";s:19:"versionEndExcluding";s:5:"1.0.5";s:11:"description";s:75:"The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.";s:4:"refs";s:184:"[{"url":"https:\/\/wordpress.org\/plugins\/bws-linkedin\/#developers","name":"https:\/\/wordpress.org\/plugins\/bws-linkedin\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:892;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18517";s:4:"slug";s:13:"bws-pinterest";s:19:"versionEndExcluding";s:5:"1.0.5";s:11:"description";s:76:"The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.";s:4:"refs";s:186:"[{"url":"https:\/\/wordpress.org\/plugins\/bws-pinterest\/#developers","name":"https:\/\/wordpress.org\/plugins\/bws-pinterest\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:893;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10992";s:4:"slug";s:11:"music-store";s:19:"versionEndExcluding";s:6:"1.0.43";s:11:"description";s:136:"The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.";s:4:"refs";s:555:"[{"url":"https:\/\/packetstormsecurity.com\/files\/136445\/","name":"https:\/\/packetstormsecurity.com\/files\/136445\/","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/music-store\/#developers","name":"https:\/\/wordpress.org\/plugins\/music-store\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8429","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8429","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:894;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10992";s:4:"slug";s:11:"music-store";s:19:"versionEndExcluding";s:6:"1.0.43";s:11:"description";s:136:"The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.";s:4:"refs";s:555:"[{"url":"https:\/\/packetstormsecurity.com\/files\/136445\/","name":"https:\/\/packetstormsecurity.com\/files\/136445\/","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/music-store\/#developers","name":"https:\/\/wordpress.org\/plugins\/music-store\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8429","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8429","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:895;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-11515";s:4:"slug";s:16:"seo-by-rank-math";s:19:"versionEndExcluding";s:6:"1.0.41";s:11:"description";s:380:"The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the attacker to create a new URI with an arbitrary name (e.g., the /exampleredirect URI).";s:4:"refs";s:675:"[{"url":"https:\/\/rankmath.com\/changelog\/","name":"https:\/\/rankmath.com\/changelog\/","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wordpress.org\/plugins\/seo-by-rank-math\/#developers","name":"https:\/\/wordpress.org\/plugins\/seo-by-rank-math\/#developers","refsource":"MISC","tags":["Product"]},{"url":"https:\/\/www.wordfence.com\/blog\/2020\/03\/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/03\/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:896;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18568";s:4:"slug";s:15:"my-wp-translate";s:19:"versionEndExcluding";s:5:"1.0.4";s:11:"description";s:62:"The my-wp-translate plugin before 1.0.4 for WordPress has XSS.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/my-wp-translate\/#developers","name":"https:\/\/wordpress.org\/plugins\/my-wp-translate\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:897;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18569";s:4:"slug";s:15:"my-wp-translate";s:19:"versionEndExcluding";s:5:"1.0.4";s:11:"description";s:63:"The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/my-wp-translate\/#developers","name":"https:\/\/wordpress.org\/plugins\/my-wp-translate\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:898;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9314";s:4:"slug";s:12:"newstatpress";s:19:"versionEndExcluding";s:5:"1.0.4";s:11:"description";s:89:"The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.";s:4:"refs";s:207:"[{"url":"https:\/\/wordpress.org\/plugins\/newstatpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/newstatpress\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:899;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9362";s:4:"slug";s:14:"Post Connector";s:19:"versionEndExcluding";s:5:"1.0.4";s:11:"description";s:104:"The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().";s:4:"refs";s:203:"[{"url":"https:\/\/www.barrykooij.com\/several-security-updates-released\/","name":"https:\/\/www.barrykooij.com\/several-security-updates-released\/","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:900;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-7228";s:4:"slug";s:22:"calculated-fields-form";s:19:"versionEndExcluding";s:7:"1.0.354";s:11:"description";s:189:"The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an authenticated user.";s:4:"refs";s:483:"[{"url":"https:\/\/spider-security.co.uk\/blog-cve-2020-7228","name":"https:\/\/spider-security.co.uk\/blog-cve-2020-7228","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/calculated-fields-form\/#developers","name":"https:\/\/wordpress.org\/plugins\/calculated-fields-form\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10043","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10043","refsource":"MISC","tags":[]}]";}i:901;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10986";s:4:"slug";s:11:"tweet-wheel";s:19:"versionEndExcluding";s:7:"1.0.3.3";s:11:"description";s:133:"The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret.";s:4:"refs";s:588:"[{"url":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/tweet-wheel-xss-vulnerability\/","name":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/tweet-wheel-xss-vulnerability\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/tweet-wheel\/#developers","name":"https:\/\/wordpress.org\/plugins\/tweet-wheel\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8464","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8464","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:902;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10986";s:4:"slug";s:11:"tweet-wheel";s:19:"versionEndExcluding";s:7:"1.0.3.3";s:11:"description";s:133:"The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret.";s:4:"refs";s:588:"[{"url":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/tweet-wheel-xss-vulnerability\/","name":"https:\/\/0x62626262.wordpress.com\/2016\/04\/21\/tweet-wheel-xss-vulnerability\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/tweet-wheel\/#developers","name":"https:\/\/wordpress.org\/plugins\/tweet-wheel\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8464","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8464","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:903;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9495";s:4:"slug";s:17:"syndication-links";s:19:"versionEndExcluding";s:5:"1.0.3";s:11:"description";s:114:"The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier.";s:4:"refs";s:322:"[{"url":"https:\/\/wordpress.org\/plugins\/syndication-links\/#developers","name":"https:\/\/wordpress.org\/plugins\/syndication-links\/#developers","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/7981","name":"https:\/\/wpvulndb.com\/vulnerabilities\/7981","refsource":"MISC","tags":[]}]";}i:904;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9347";s:4:"slug";s:9:"wp-plotly";s:19:"versionEndExcluding";s:5:"1.0.3";s:11:"description";s:67:"The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.";s:4:"refs";s:178:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-plotly\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-plotly\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:905;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15834";s:4:"slug";s:24:"webp-converter-for-media";s:19:"versionEndExcluding";s:5:"1.0.3";s:11:"description";s:72:"The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF.";s:4:"refs";s:378:"[{"url":"https:\/\/wordpress.org\/plugins\/webp-converter-for-media\/#developers","name":"https:\/\/wordpress.org\/plugins\/webp-converter-for-media\/#developers","refsource":"MISC","tags":["Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9400","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9400","refsource":"MISC","tags":["Patch","Third Party Advisory"]}]";}i:906;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-5484";s:4:"slug";s:9:"wp-plotly";s:19:"versionEndExcluding";s:5:"1.0.3";s:11:"description";s:173:"Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via a post.";s:4:"refs";s:633:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2015\/Jul\/68","name":"http:\/\/seclists.org\/fulldisclosure\/2015\/Jul\/68","refsource":"MISC","tags":[]},{"url":"https:\/\/security.dxw.com\/advisories\/stored-xss-in-plotly-allows-less-privileged-users-to-insert-arbitrary-javascript-into-posts\/","name":"https:\/\/security.dxw.com\/advisories\/stored-xss-in-plotly-allows-less-privileged-users-to-insert-arbitrary-javascript-into-posts\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/wp-plotly\/changelog\/","name":"https:\/\/wordpress.org\/plugins\/wp-plotly\/changelog\/","refsource":"MISC","tags":[]}]";}i:907;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15864";s:4:"slug";s:19:"breadcrumbs-by-menu";s:19:"versionEndExcluding";s:5:"1.0.3";s:11:"description";s:66:"The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.";s:4:"refs";s:386:"[{"url":"https:\/\/wordpress.org\/plugins\/breadcrumbs-by-menu\/#developers","name":"https:\/\/wordpress.org\/plugins\/breadcrumbs-by-menu\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9338","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9338","refsource":"MISC","tags":["Patch","Third Party Advisory"]}]";}i:908;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15865";s:4:"slug";s:19:"breadcrumbs-by-menu";s:19:"versionEndExcluding";s:5:"1.0.3";s:11:"description";s:67:"The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.";s:4:"refs";s:386:"[{"url":"https:\/\/wordpress.org\/plugins\/breadcrumbs-by-menu\/#developers","name":"https:\/\/wordpress.org\/plugins\/breadcrumbs-by-menu\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9338","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9338","refsource":"MISC","tags":["Patch","Third Party Advisory"]}]";}i:909;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10908";s:4:"slug";s:29:"booking-calendar-contact-form";s:19:"versionEndExcluding";s:6:"1.0.24";s:11:"description";s:77:"The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.";s:4:"refs";s:218:"[{"url":"https:\/\/wordpress.org\/plugins\/booking-calendar-contact-form\/#developers","name":"https:\/\/wordpress.org\/plugins\/booking-calendar-contact-form\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:910;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10909";s:4:"slug";s:29:"booking-calendar-contact-form";s:19:"versionEndExcluding";s:6:"1.0.24";s:11:"description";s:87:"The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.";s:4:"refs";s:218:"[{"url":"https:\/\/wordpress.org\/plugins\/booking-calendar-contact-form\/#developers","name":"https:\/\/wordpress.org\/plugins\/booking-calendar-contact-form\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:911;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10908";s:4:"slug";s:29:"booking-calendar-contact-form";s:19:"versionEndExcluding";s:6:"1.0.24";s:11:"description";s:77:"The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.";s:4:"refs";s:218:"[{"url":"https:\/\/wordpress.org\/plugins\/booking-calendar-contact-form\/#developers","name":"https:\/\/wordpress.org\/plugins\/booking-calendar-contact-form\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:912;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-16251";s:4:"slug";s:43:"yith-advanced-refund-system-for-woocommerce";s:19:"versionEndExcluding";s:6:"1.0.12";s:11:"description";s:131:"plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes.";s:4:"refs";s:391:"[{"url":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","name":"https:\/\/blog.nintechnet.com\/authenticated-settings-change-vulnerability-in-yit-plugin-framework\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9932","refsource":"MISC","tags":[]}]";}i:913;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2014-10395";s:4:"slug";s:8:"cp-polls";s:19:"versionEndExcluding";s:5:"1.0.1";s:11:"description";s:73:"The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.";s:4:"refs";s:176:"[{"url":"https:\/\/wordpress.org\/plugins\/cp-polls\/#developers","name":"https:\/\/wordpress.org\/plugins\/cp-polls\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:914;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9315";s:4:"slug";s:12:"newstatpress";s:19:"versionEndExcluding";s:5:"1.0.1";s:11:"description";s:69:"The newstatpress plugin before 1.0.1 for WordPress has SQL injection.";s:4:"refs";s:207:"[{"url":"https:\/\/wordpress.org\/plugins\/newstatpress\/#developers","name":"https:\/\/wordpress.org\/plugins\/newstatpress\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:915;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10921";s:4:"slug";s:21:"gallery-photo-gallery";s:19:"versionEndExcluding";s:5:"1.0.1";s:11:"description";s:78:"The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.";s:4:"refs";s:225:"[{"url":"https:\/\/wordpress.org\/plugins\/gallery-photo-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/gallery-photo-gallery\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:916;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10921";s:4:"slug";s:21:"gallery-photo-gallery";s:19:"versionEndExcluding";s:5:"1.0.1";s:11:"description";s:78:"The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.";s:4:"refs";s:225:"[{"url":"https:\/\/wordpress.org\/plugins\/gallery-photo-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/gallery-photo-gallery\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:917;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18537";s:4:"slug";s:15:"visitors-online";s:19:"versionEndExcluding";s:5:"1.0.0";s:11:"description";s:78:"The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/visitors-online\/#developers","name":"https:\/\/wordpress.org\/plugins\/visitors-online\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:918;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10892";s:4:"slug";s:12:"chained-quiz";s:19:"versionEndExcluding";s:3:"1.0";s:11:"description";s:73:"The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.";s:4:"refs";s:207:"[{"url":"https:\/\/wordpress.org\/plugins\/chained-quiz\/#developers","name":"https:\/\/wordpress.org\/plugins\/chained-quiz\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:919;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10892";s:4:"slug";s:12:"chained-quiz";s:19:"versionEndExcluding";s:3:"1.0";s:11:"description";s:73:"The chained-quiz plugin before 1.0 for WordPress has multiple XSS issues.";s:4:"refs";s:207:"[{"url":"https:\/\/wordpress.org\/plugins\/chained-quiz\/#developers","name":"https:\/\/wordpress.org\/plugins\/chained-quiz\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:920;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9415";s:4:"slug";s:12:"bj-lazy-load";s:19:"versionEndExcluding";s:3:"1.0";s:11:"description";s:75:"The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.";s:4:"refs";s:373:"[{"url":"https:\/\/wordpress.org\/plugins\/bj-lazy-load\/#developers","name":"https:\/\/wordpress.org\/plugins\/bj-lazy-load\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8174","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8174","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:921;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-20988";s:4:"slug";s:7:"wpgform";s:19:"versionEndExcluding";s:4:"0.94";s:11:"description";s:91:"The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.";s:4:"refs";s:174:"[{"url":"https:\/\/wordpress.org\/plugins\/wpgform\/#developers","name":"https:\/\/wordpress.org\/plugins\/wpgform\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:922;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-9414";s:4:"slug";s:14:"W3 Total Cache";s:19:"versionEndExcluding";s:7:"0.9.4.1";s:11:"description";s:402:"The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and hijack the authentication of administrators for requests that change the mobile site redirect URI via the mobile_groups[*][redirect] parameter and an empty _wpnonce parameter in the w3tc_mobile page to wp-admin/admin.php.";s:4:"refs";s:1655:"[{"url":"http:\/\/mazinahmed1.blogspot.com\/2014\/12\/w3-total-caches-w3totalfail.html","name":"http:\/\/mazinahmed1.blogspot.com\/2014\/12\/w3-total-caches-w3totalfail.html","refsource":"MISC","tags":["Exploit"]},{"url":"http:\/\/packetstormsecurity.com\/files\/129512\/W3-Total-Cache-0.9.4-Cross-Site-Request-Forgery.html","name":"http:\/\/packetstormsecurity.com\/files\/129512\/W3-Total-Cache-0.9.4-Cross-Site-Request-Forgery.html","refsource":"MISC","tags":["Exploit"]},{"url":"http:\/\/seclists.org\/fulldisclosure\/2014\/Dec\/67","name":"20141216 W3TotalFail: W3 Total Cache v 0.9.4 CSRF Vulnerability that Leads to Full Deface","refsource":"FULLDISC","tags":["Exploit"]},{"url":"http:\/\/secunia.com\/advisories\/61562","name":"61562","refsource":"SECUNIA","tags":[]},{"url":"http:\/\/www.securityfocus.com\/archive\/1\/534250\/100\/0\/threaded","name":"20141216 W3TotalFail: W3 Total Cache v 0.9.4 CSRF Vulnerability that Leads to Full Deface","refsource":"BUGTRAQ","tags":[]},{"url":"https:\/\/exchange.xforce.ibmcloud.com\/vulnerabilities\/99352","name":"w3totalcache-wordpress-wpnonce-csrf(99352)","refsource":"XF","tags":[]},{"url":"https:\/\/github.com\/wp-plugins\/w3-total-cache\/commit\/9a1cc9f70558282e135eb3120d271448c75b28dd#diff-86a10b31ab115483fe8111bedac14d15","name":"https:\/\/github.com\/wp-plugins\/w3-total-cache\/commit\/9a1cc9f70558282e135eb3120d271448c75b28dd#diff-86a10b31ab115483fe8111bedac14d15","refsource":"CONFIRM","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/w3-total-cache\/changelog\/","name":"https:\/\/wordpress.org\/plugins\/w3-total-cache\/changelog\/","refsource":"CONFIRM","tags":["Vendor Advisory"]}]";}i:923;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9472";s:4:"slug";s:14:"incoming-links";s:19:"versionEndExcluding";s:7:"0.9.10b";s:11:"description";s:105:"The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header.";s:4:"refs";s:591:"[{"url":"https:\/\/plugins.trac.wordpress.org\/changeset\/1080044\/incoming-links","name":"https:\/\/plugins.trac.wordpress.org\/changeset\/1080044\/incoming-links","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/incoming-links\/#developers","name":"https:\/\/wordpress.org\/plugins\/incoming-links\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8015","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8015","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:924;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2012-6715";s:4:"slug";s:11:"formbuilder";s:19:"versionEndExcluding";s:5:"0.9.1";s:11:"description";s:79:"The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.";s:4:"refs";s:182:"[{"url":"https:\/\/wordpress.org\/plugins\/formbuilder\/#developers","name":"https:\/\/wordpress.org\/plugins\/formbuilder\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:925;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9465";s:4:"slug";s:24:"yet-another-stars-rating";s:19:"versionEndExcluding";s:5:"0.9.1";s:11:"description";s:142:"The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id parameter.";s:4:"refs";s:633:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_041b796c7533880df03a43895fed5f00.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_041b796c7533880df03a43895fed5f00.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/yet-another-stars-rating\/#developers","name":"https:\/\/wordpress.org\/plugins\/yet-another-stars-rating\/#developers","refsource":"MISC","tags":["Product","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8309","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8309","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:926;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9316";s:4:"slug";s:16:"wp-fastest-cache";s:19:"versionEndExcluding";s:7:"0.8.4.9";s:11:"description";s:161:"The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter.";s:4:"refs";s:399:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-fastest-cache\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-fastest-cache\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/www.exploit-db.com\/exploits\/38678","name":"https:\/\/www.exploit-db.com\/exploits\/38678","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]}]";}i:927;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2020-7239";s:4:"slug";s:19:"conversation-watson";s:19:"versionEndExcluding";s:6:"0.8.21";s:11:"description";s:160:"The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent.";s:4:"refs";s:353:"[{"url":"https:\/\/wordpress.org\/plugins\/conversation-watson\/#developers","name":"https:\/\/wordpress.org\/plugins\/conversation-watson\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/www.hooperlabs.xyz\/disclosures\/cve-2020-7239.php","name":"https:\/\/www.hooperlabs.xyz\/disclosures\/cve-2020-7239.php","refsource":"MISC","tags":[]}]";}i:928;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18534";s:4:"slug";s:17:"share-on-diaspora";s:19:"versionEndExcluding";s:5:"0.7.2";s:11:"description";s:98:"The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.";s:4:"refs";s:194:"[{"url":"https:\/\/wordpress.org\/plugins\/share-on-diaspora\/#developers","name":"https:\/\/wordpress.org\/plugins\/share-on-diaspora\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:929;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2012-6713";s:4:"slug";s:11:"job-manager";s:19:"versionEndExcluding";s:6:"0.7.19";s:11:"description";s:75:"The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues.";s:4:"refs";s:205:"[{"url":"https:\/\/wordpress.org\/plugins\/job-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/job-manager\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:930;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10969";s:4:"slug";s:11:"supportflow";s:19:"versionEndExcluding";s:3:"0.7";s:11:"description";s:86:"The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title.";s:4:"refs";s:454:"[{"url":"https:\/\/github.com\/SupportFlow\/supportflow\/commit\/c08d376072f093b650c49dcb44124f43ea0177b1","name":"https:\/\/github.com\/SupportFlow\/supportflow\/commit\/c08d376072f093b650c49dcb44124f43ea0177b1","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/supportflow\/#developers","name":"https:\/\/wordpress.org\/plugins\/supportflow\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:931;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10969";s:4:"slug";s:11:"supportflow";s:19:"versionEndExcluding";s:3:"0.7";s:11:"description";s:86:"The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title.";s:4:"refs";s:454:"[{"url":"https:\/\/github.com\/SupportFlow\/supportflow\/commit\/c08d376072f093b650c49dcb44124f43ea0177b1","name":"https:\/\/github.com\/SupportFlow\/supportflow\/commit\/c08d376072f093b650c49dcb44124f43ea0177b1","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/supportflow\/#developers","name":"https:\/\/wordpress.org\/plugins\/supportflow\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:932;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10970";s:4:"slug";s:11:"supportflow";s:19:"versionEndExcluding";s:3:"0.7";s:11:"description";s:77:"The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt.";s:4:"refs";s:461:"[{"url":"https:\/\/github.com\/SupportFlow\/supportflow\/commit\/c507cc863d161f87c28d0682714bf188ffac1a67","name":"https:\/\/github.com\/SupportFlow\/supportflow\/commit\/c507cc863d161f87c28d0682714bf188ffac1a67","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/supportflow\/#developers","name":"https:\/\/wordpress.org\/plugins\/supportflow\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:933;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10970";s:4:"slug";s:11:"supportflow";s:19:"versionEndExcluding";s:3:"0.7";s:11:"description";s:77:"The supportflow plugin before 0.7 for WordPress has XSS via a ticket excerpt.";s:4:"refs";s:461:"[{"url":"https:\/\/github.com\/SupportFlow\/supportflow\/commit\/c507cc863d161f87c28d0682714bf188ffac1a67","name":"https:\/\/github.com\/SupportFlow\/supportflow\/commit\/c507cc863d161f87c28d0682714bf188ffac1a67","refsource":"MISC","tags":["Patch","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/supportflow\/#developers","name":"https:\/\/wordpress.org\/plugins\/supportflow\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:934;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14205";s:4:"slug";s:15:"adaptive-images";s:19:"versionEndExcluding";s:6:"0.6.67";s:11:"description";s:253:"A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php.";s:4:"refs";s:1053:"[{"url":"https:\/\/github.com\/markgruffer\/markgruffer.github.io\/blob\/master\/_posts\/2019-07-19-adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.markdown","name":"https:\/\/github.com\/markgruffer\/markgruffer.github.io\/blob\/master\/_posts\/2019-07-19-adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.markdown","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/markgruffer.github.io\/2019\/07\/19\/adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.html","name":"https:\/\/markgruffer.github.io\/2019\/07\/19\/adaptive-images-for-wordpress-0-6-66-lfi-rce-file-deletion.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/adaptive-images\/#developers","name":"https:\/\/wordpress.org\/plugins\/adaptive-images\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9468","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9468","refsource":"MISC","tags":[]}]";}i:935;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9430";s:4:"slug";s:10:"crazy-bone";s:19:"versionEndExcluding";s:5:"0.6.0";s:11:"description";s:88:"The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header.";s:4:"refs";s:608:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_e22c10161b1e2e4e54facf2d17e723c3.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_e22c10161b1e2e4e54facf2d17e723c3.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/crazy-bone\/#developers","name":"https:\/\/wordpress.org\/plugins\/crazy-bone\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8281","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8281","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:936;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9453";s:4:"slug";s:19:"broken-link-manager";s:19:"versionEndExcluding";s:5:"0.6.0";s:11:"description";s:137:"The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.";s:4:"refs";s:626:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_b677bb83a6c1495f85f76faa5b13011d.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_b677bb83a6c1495f85f76faa5b13011d.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/broken-link-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/broken-link-manager\/#developers","refsource":"MISC","tags":["Product","Release Notes"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8333","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8333","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:937;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18561";s:4:"slug";s:20:"embed-comment-images";s:19:"versionEndExcluding";s:3:"0.6";s:11:"description";s:65:"The embed-comment-images plugin before 0.6 for WordPress has XSS.";s:4:"refs";s:200:"[{"url":"https:\/\/wordpress.org\/plugins\/embed-comment-images\/#developers","name":"https:\/\/wordpress.org\/plugins\/embed-comment-images\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:938;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10920";s:4:"slug";s:11:"gnucommerce";s:19:"versionEndExcluding";s:10:"0.5.7-BETA";s:11:"description";s:63:"The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.";s:4:"refs";s:205:"[{"url":"https:\/\/wordpress.org\/plugins\/gnucommerce\/#developers","name":"https:\/\/wordpress.org\/plugins\/gnucommerce\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:939;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10920";s:4:"slug";s:11:"gnucommerce";s:19:"versionEndExcluding";s:10:"0.5.7-BETA";s:11:"description";s:63:"The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.";s:4:"refs";s:205:"[{"url":"https:\/\/wordpress.org\/plugins\/gnucommerce\/#developers","name":"https:\/\/wordpress.org\/plugins\/gnucommerce\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:940;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10983";s:4:"slug";s:5:"ghost";s:19:"versionEndExcluding";s:5:"0.5.6";s:11:"description";s:133:"The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.";s:4:"refs";s:364:"[{"url":"https:\/\/packetstormsecurity.com\/files\/136887\/","name":"https:\/\/packetstormsecurity.com\/files\/136887\/","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/ghost\/#developers","name":"https:\/\/wordpress.org\/plugins\/ghost\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:941;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10983";s:4:"slug";s:5:"ghost";s:19:"versionEndExcluding";s:5:"0.5.6";s:11:"description";s:133:"The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.";s:4:"refs";s:364:"[{"url":"https:\/\/packetstormsecurity.com\/files\/136887\/","name":"https:\/\/packetstormsecurity.com\/files\/136887\/","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/ghost\/#developers","name":"https:\/\/wordpress.org\/plugins\/ghost\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:942;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10934";s:4:"slug";s:11:"check-email";s:19:"versionEndExcluding";s:5:"0.5.2";s:11:"description";s:58:"The check-email plugin before 0.5.2 for WordPress has XSS.";s:4:"refs";s:182:"[{"url":"https:\/\/wordpress.org\/plugins\/check-email\/#developers","name":"https:\/\/wordpress.org\/plugins\/check-email\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:943;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10934";s:4:"slug";s:11:"check-email";s:19:"versionEndExcluding";s:5:"0.5.2";s:11:"description";s:58:"The check-email plugin before 0.5.2 for WordPress has XSS.";s:4:"refs";s:182:"[{"url":"https:\/\/wordpress.org\/plugins\/check-email\/#developers","name":"https:\/\/wordpress.org\/plugins\/check-email\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:944;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9467";s:4:"slug";s:19:"broken-link-manager";s:19:"versionEndExcluding";s:5:"0.5.0";s:11:"description";s:124:"The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter.";s:4:"refs";s:629:"[{"url":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_604dd4c86dca013f6e5e89751352f36d.html","name":"http:\/\/cinu.pl\/research\/wp-plugins\/mail_604dd4c86dca013f6e5e89751352f36d.html","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/broken-link-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/broken-link-manager\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/8320","name":"https:\/\/wpvulndb.com\/vulnerabilities\/8320","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:945;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10897";s:4:"slug";s:14:"sermon-browser";s:19:"versionEndExcluding";s:7:"0.45.16";s:11:"description";s:79:"The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/sermon-browser\/#developers","name":"https:\/\/wordpress.org\/plugins\/sermon-browser\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:946;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2016-10897";s:4:"slug";s:14:"sermon-browser";s:19:"versionEndExcluding";s:7:"0.45.16";s:11:"description";s:79:"The sermon-browser plugin before 0.45.16 for WordPress has multiple XSS issues.";s:4:"refs";s:188:"[{"url":"https:\/\/wordpress.org\/plugins\/sermon-browser\/#developers","name":"https:\/\/wordpress.org\/plugins\/sermon-browser\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:947;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2015-9325";s:4:"slug";s:15:"visitors-online";s:19:"versionEndExcluding";s:3:"0.4";s:11:"description";s:70:"The visitors-online plugin before 0.4 for WordPress has SQL injection.";s:4:"refs";s:190:"[{"url":"https:\/\/wordpress.org\/plugins\/visitors-online\/#developers","name":"https:\/\/wordpress.org\/plugins\/visitors-online\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:948;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9880";s:4:"slug";s:10:"wp-graphql";s:19:"versionEndExcluding";s:5:"0.2.4";s:11:"description";s:235:"An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role, and username.";s:4:"refs";s:1219:"[{"url":"http:\/\/packetstormsecurity.com\/files\/153025\/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html","name":"http:\/\/packetstormsecurity.com\/files\/153025\/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/github.com\/pentestpartners\/snippets\/blob\/master\/wp-graphql0.2.3_exploit.py","name":"https:\/\/github.com\/pentestpartners\/snippets\/blob\/master\/wp-graphql0.2.3_exploit.py","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/github.com\/wp-graphql\/wp-graphql\/releases\/tag\/v0.3.0","name":"https:\/\/github.com\/wp-graphql\/wp-graphql\/releases\/tag\/v0.3.0","refsource":"CONFIRM","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9282","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9282","refsource":"MISC","tags":["Vendor Advisory"]},{"url":"https:\/\/www.pentestpartners.com\/security-blog\/pwning-wordpress-graphql\/","name":"https:\/\/www.pentestpartners.com\/security-blog\/pwning-wordpress-graphql\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:949;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9881";s:4:"slug";s:10:"wp-graphql";s:19:"versionEndExcluding";s:5:"0.2.4";s:11:"description";s:171:"The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.";s:4:"refs";s:1240:"[{"url":"http:\/\/packetstormsecurity.com\/files\/153025\/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html","name":"http:\/\/packetstormsecurity.com\/files\/153025\/WordPress-WPGraphQL-0.2.3-Authentication-Bypass-Information-Disclosure.html","refsource":"MISC","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/github.com\/pentestpartners\/snippets\/blob\/master\/wp-graphql0.2.3_exploit.py","name":"https:\/\/github.com\/pentestpartners\/snippets\/blob\/master\/wp-graphql0.2.3_exploit.py","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/github.com\/wp-graphql\/wp-graphql\/releases\/tag\/v0.3.0","name":"https:\/\/github.com\/wp-graphql\/wp-graphql\/releases\/tag\/v0.3.0","refsource":"CONFIRM","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9282","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9282","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/www.pentestpartners.com\/security-blog\/pwning-wordpress-graphql\/","name":"https:\/\/www.pentestpartners.com\/security-blog\/pwning-wordpress-graphql\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:950;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15110";s:4:"slug";s:20:"wp-front-end-profile";s:19:"versionEndExcluding";s:5:"0.2.2";s:11:"description";s:67:"The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.";s:4:"refs";s:200:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-front-end-profile\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-front-end-profile\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:951;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15111";s:4:"slug";s:20:"wp-front-end-profile";s:19:"versionEndExcluding";s:5:"0.2.2";s:11:"description";s:92:"The wp-front-end-profile plugin before 0.2.2 for WordPress has a privilege escalation issue.";s:4:"refs";s:200:"[{"url":"https:\/\/wordpress.org\/plugins\/wp-front-end-profile\/#developers","name":"https:\/\/wordpress.org\/plugins\/wp-front-end-profile\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:952;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18530";s:4:"slug";s:10:"rating-bws";s:19:"versionEndExcluding";s:3:"0.2";s:11:"description";s:71:"The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.";s:4:"refs";s:180:"[{"url":"https:\/\/wordpress.org\/plugins\/rating-bws\/#developers","name":"https:\/\/wordpress.org\/plugins\/rating-bws\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:953;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18501";s:4:"slug";s:16:"social-login-bws";s:19:"versionEndExcluding";s:3:"0.2";s:11:"description";s:77:"The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.";s:4:"refs";s:210:"[{"url":"https:\/\/wordpress.org\/plugins\/social-login-bws\/#developers","name":"https:\/\/wordpress.org\/plugins\/social-login-bws\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:954;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15837";s:4:"slug";s:12:"webp-express";s:19:"versionEndExcluding";s:6:"0.14.8";s:11:"description";s:67:"The webp-express plugin before 0.14.8 for WordPress has stored XSS.";s:4:"refs";s:382:"[{"url":"https:\/\/wordpress.org\/plugins\/webp-express\/#developers","name":"https:\/\/wordpress.org\/plugins\/webp-express\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9389","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9389","refsource":"MISC","tags":["Exploit","Patch","Third Party Advisory"]}]";}i:955;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-15330";s:4:"slug";s:12:"webp-express";s:19:"versionEndExcluding";s:7:"0.14.11";s:11:"description";s:112:"The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.";s:4:"refs";s:184:"[{"url":"https:\/\/wordpress.org\/plugins\/webp-express\/#developers","name":"https:\/\/wordpress.org\/plugins\/webp-express\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:956;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18558";s:4:"slug";s:16:"bws-testimonials";s:19:"versionEndExcluding";s:5:"0.1.9";s:11:"description";s:79:"The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.";s:4:"refs";s:192:"[{"url":"https:\/\/wordpress.org\/plugins\/bws-testimonials\/#developers","name":"https:\/\/wordpress.org\/plugins\/bws-testimonials\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:957;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18590";s:4:"slug";s:9:"timesheet";s:19:"versionEndExcluding";s:5:"0.1.5";s:11:"description";s:72:"The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.";s:4:"refs";s:178:"[{"url":"https:\/\/wordpress.org\/plugins\/timesheet\/#developers","name":"https:\/\/wordpress.org\/plugins\/timesheet\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:958;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18548";s:4:"slug";s:10:"note-press";s:19:"versionEndExcluding";s:5:"0.1.2";s:11:"description";s:67:"The note-press plugin before 0.1.2 for WordPress has SQL injection.";s:4:"refs";s:198:"[{"url":"https:\/\/wordpress.org\/plugins\/note-press\/#developers","name":"https:\/\/wordpress.org\/plugins\/note-press\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]}]";}i:959;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2017-18493";s:4:"slug";s:17:"custom-admin-page";s:19:"versionEndExcluding";s:5:"0.1.2";s:11:"description";s:80:"The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.";s:4:"refs";s:217:"[{"url":"https:\/\/wordpress.org\/plugins\/custom-admin-page\/#developers","name":"https:\/\/wordpress.org\/plugins\/custom-admin-page\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]}]";}i:960;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2018-21001";s:4:"slug";s:10:"anycomment";s:19:"versionEndExcluding";s:6:"0.0.33";s:11:"description";s:58:"The anycomment plugin before 0.0.33 for WordPress has XSS.";s:4:"refs";s:180:"[{"url":"https:\/\/wordpress.org\/plugins\/anycomment\/#developers","name":"https:\/\/wordpress.org\/plugins\/anycomment\/#developers","refsource":"MISC","tags":["Release Notes"]}]";}i:961;O:8:"stdClass":6:{s:6:"CVE_ID";s:14:"CVE-2020-11516";s:4:"slug";s:25:"contact-form-7-datepicker";s:13:"versionImpact";s:5:"2.6.0";s:11:"description";s:500:"Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session.";s:14:"recommendation";s:132:"This plugin has been closed as of April 1, 2020 and is not available for download. This closure is temporary, pending a full review.";s:4:"refs";s:315:"[{"url":"https:\/\/www.wordfence.com\/blog\/2020\/04\/high-severity-vulnerability-leads-to-closure-of-plugin-with-over-100000-installations\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/04\/high-severity-vulnerability-leads-to-closure-of-plugin-with-over-100000-installations\/","refsource":"MISC","tags":[]}]";}i:962;O:8:"stdClass":6:{s:6:"CVE_ID";s:14:"CVE-2020-11673";s:4:"slug";s:7:"poll-wp";s:13:"versionImpact";s:5:"1.3.4";s:11:"description";s:302:"An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. It allows an unauthenticated user to manipulate polls, e.g., delete, clone, or view a hidden poll. This is due to the usage of the callback wp_ajax_nopriv function in Includes/Total-Soft-Poll-Ajax.php for sensitive operations.";s:14:"recommendation";s:193:"This plugin has been closed as of March 31, 2020 and is not available for download. This closure is temporary, pending a full review. Details: https://wordpress.org/plugins/poll-wp/#description";s:4:"refs";s:395:"[{"url":"https:\/\/gist.github.com\/pak0s\/05a0e517aeff4b1422d1a93f59718459","name":"https:\/\/gist.github.com\/pak0s\/05a0e517aeff4b1422d1a93f59718459","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/poll-wp\/#developers","name":"https:\/\/wordpress.org\/plugins\/poll-wp\/#developers","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:963;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-12075";s:4:"slug";s:35:"data-tables-generator-by-supsystic ";s:13:"versionImpact";s:6:"1.9.92";s:11:"description";s:115:"The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks capability checks for AJAX actions.";s:4:"refs";s:289:"[{"url":"https:\/\/www.wordfence.com\/blog\/2020\/03\/vulnerabilities-patched-in-the-data-tables-generator-by-supsystic-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/03\/vulnerabilities-patched-in-the-data-tables-generator-by-supsystic-plugin\/","refsource":"MISC","tags":[]}]";}i:964;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-12076";s:4:"slug";s:35:"data-tables-generator-by-supsystic ";s:13:"versionImpact";s:6:"1.9.92";s:11:"description";s:154:"The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS.";s:4:"refs";s:289:"[{"url":"https:\/\/www.wordfence.com\/blog\/2020\/03\/vulnerabilities-patched-in-the-data-tables-generator-by-supsystic-plugin\/","name":"https:\/\/www.wordfence.com\/blog\/2020\/03\/vulnerabilities-patched-in-the-data-tables-generator-by-supsystic-plugin\/","refsource":"MISC","tags":[]}]";}i:965;O:8:"stdClass":6:{s:6:"CVE_ID";s:14:"CVE-2020-12054";s:4:"slug";s:16:"catch-breadcrumb";s:13:"versionImpact";s:4:"1.57";s:11:"description";s:454:"The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean Enterprise PRO, Bold Photography PRO, Intuitive PRO, Devotepress PRO, Clean Blocks PRO, Foodoholic PRO, Catch Mag PRO, Catch Wedding PRO, and Higher Education PRO.";s:14:"recommendation";s:133:"This plugin has been closed as of April 22, 2020 and is not available for download. This closure is temporary, pending a full review.";s:4:"refs";s:287:"[{"url":"https:\/\/cxsecurity.com\/issue\/WLB-2020040144","name":"https:\/\/cxsecurity.com\/issue\/WLB-2020040144","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10184","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10184","refsource":"MISC","tags":[]}]";}i:966;O:8:"stdClass":6:{s:6:"CVE_ID";s:14:"CVE-2020-11530";s:4:"slug";s:10:"chopslider";s:13:"versionImpact";s:3:"3.4";s:11:"description";s:270:"A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied to get_script/index.php, and allows an attacker to execute arbitrary SQL queries in the context of the WP database user.";s:14:"recommendation";s:120:"No updates to this plugin currently exists, it is recommended you remove this plugin completely and find an alternative.";s:4:"refs";s:682:"[{"url":"http:\/\/packetstormsecurity.com\/files\/157607\/WordPress-ChopSlider-3-SQL-Injection.html","name":"http:\/\/packetstormsecurity.com\/files\/157607\/WordPress-ChopSlider-3-SQL-Injection.html","refsource":"MISC","tags":[]},{"url":"http:\/\/seclists.org\/fulldisclosure\/2020\/May\/26","name":"20200508 ChopSlider3 Wordpress Plugin SQL Injection","refsource":"FULLDISC","tags":[]},{"url":"https:\/\/github.com\/idangerous\/Plugins\/tree\/master\/Chop%20Slider%203","name":"https:\/\/github.com\/idangerous\/Plugins\/tree\/master\/Chop%20Slider%203","refsource":"MISC","tags":[]},{"url":"https:\/\/idangero.us\/","name":"https:\/\/idangero.us\/","refsource":"MISC","tags":[]}]";}i:967;O:8:"stdClass":5:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:12:"wp-html-mail";s:13:"versionImpact";s:7:"2.9.0.3";s:11:"description";s:211:"Multiple plugins offering to convert WordPress’ default plain text emails to HTML format were found to be vulnerable to HTML injection, which could lead to phishing or CSRF attacks targeting the administrator.";s:4:"refs";s:84:"https://blog.nintechnet.com/multiple-wordpress-plugins-vulnerable-to-html-injection/";}i:968;O:8:"stdClass":5:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:14:"zoho-crm-forms";s:13:"versionImpact";s:7:"1.6.9.1";s:11:"description";s:224:"A cross site scripting (XSS) attack can cause arbitrary code (java script) to run in a user’s browser while the browser is connected to a trusted web site. 

ref: https://github.com/cybersecurityworks/Disclosed/issues/16";s:4:"refs";s:115:"https://github.com/cybersecurityworks/Disclosed/issues/16
https://wordpress.org/plugins/zoho-crm-forms/#developers";}i:969;O:8:"stdClass":5:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:12:"about-author";s:13:"versionImpact";s:5:"1.3.9";s:11:"description";s:263:"Wordpress About Author plugin with a version lower or equal with 1.3.9 is affected by an authenticated Stored Cross-site scripting (XSS) vulnerability.

ref: https://nitesculucian.github.io/2019/10/25/about-author-1-3-9-authentificated-stored-xss-vulnerability/";s:4:"refs";s:152:"https://nitesculucian.github.io/2019/10/25/about-author-1-3-9-authentificated-stored-xss-vulnerability/

https://wordpress.org/plugins/about-author/
";}i:970;O:8:"stdClass":5:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:17:"yuzo-related-post";s:13:"versionImpact";s:7:"5.12.94";s:11:"description";s:117:"Yuzo Related Posts has been closed as of March 30, 2019 due to a security issue. No further details have been issued.";s:4:"refs";s:0:"";}i:971;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14796";s:4:"slug";s:39:"mq-woocommerce-products-price-bulk-edit";s:13:"versionImpact";s:3:"2.0";s:11:"description";s:321:"This plugin has been closed as of May 17, 2019 and is not available for download. Reason: Security Issue.

The mq-woocommerce-products-price-bulk-edit (aka Woocommerce Products Price Bulk Edit) plugin 2.0 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=update_options show_products_page_limit parameter.";s:4:"refs";s:877:"[{"url":"https:\/\/wordpress.org\/plugins\/mq-woocommerce-products-price-bulk-edit\/#developers","name":"https:\/\/wordpress.org\/plugins\/mq-woocommerce-products-price-bulk-edit\/#developers","refsource":"MISC","tags":["Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9515","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9515","refsource":"MISC","tags":[]},{"url":"https:\/\/www.pluginvulnerabilities.com\/2019\/05\/16\/is-this-authenticated-persistent-cross-site-scripting-xss-vulnerability-what-hackers-would-be-interested-in-woocommerce-products-price-bulk-edit-for\/","name":"https:\/\/www.pluginvulnerabilities.com\/2019\/05\/16\/is-this-authenticated-persistent-cross-site-scripting-xss-vulnerability-what-hackers-would-be-interested-in-woocommerce-products-price-bulk-edit-for\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:972;O:8:"stdClass":6:{s:6:"CVE_ID";s:0:"";s:4:"slug";s:25:"gravity-forms-sticky-list";s:13:"versionImpact";s:5:"1.5.2";s:11:"description";s:111:"Security issue - Plugin was closed on May 2nd 2019.

https://wordpress.org/plugins/gravity-forms-sticky-list/";s:14:"recommendation";s:43:"Plugin should be removed from your website.";s:4:"refs";s:0:"";}i:973;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14978";s:4:"slug";s:38:"woocommerce-payu-india-payment-gateway";s:13:"versionImpact";s:5:"2.1.1";s:11:"description";s:228:"/payu/icpcheckout/ in the WooCommerce PayU India Payment Gateway plugin 2.1.1 for WordPress allows Parameter Tampering in the purchaseQuantity=1 parameter, as demonstrated by purchasing an item for lower than the intended price.";s:4:"refs";s:189:"[{"url":"https:\/\/gkaim.com\/cve-2019-14978-vikas-chaudhary\/","name":"https:\/\/gkaim.com\/cve-2019-14978-vikas-chaudhary\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:974;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-14467";s:4:"slug";s:20:"social-photo-gallery";s:13:"versionImpact";s:3:"1.0";s:11:"description";s:203:"The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album, because the file extension is not checked.";s:4:"refs";s:776:"[{"url":"http:\/\/packetstormsecurity.com\/files\/155357\/WordPress-Social-Photo-Gallery-1.0-Remote-Code-Execution.html","name":"http:\/\/packetstormsecurity.com\/files\/155357\/WordPress-Social-Photo-Gallery-1.0-Remote-Code-Execution.html","refsource":"MISC","tags":[]},{"url":"https:\/\/seclists.org\/fulldisclosure\/2019\/Nov\/13","name":"20191115 WordPress Plugin Social Photo Gallery 1.0 - Remote Code Execution","refsource":"FULLDISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/social-photo-gallery\/#developers","name":"https:\/\/wordpress.org\/plugins\/social-photo-gallery\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9952","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9952","refsource":"MISC","tags":[]}]";}i:975;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2020-25380";s:4:"slug";s:11:"bulk-change";s:11:"description";s:224:"Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed.";s:14:"recommendation";s:106:"This plugin has been closed as of June 19, 2020 and is not available for download. Reason: Security Issue.";s:4:"refs";s:195:"[{"url":"https:\/\/zeroaptitude.com\/misha\/wordpress-plugin-bug-hunting-part-2\/","name":"https:\/\/zeroaptitude.com\/misha\/wordpress-plugin-bug-hunting-part-2\/","refsource":"MISC","tags":[]}]";}i:976;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-19198";s:4:"slug";s:17:"scoutnet-kalender";s:13:"versionImpact";s:5:"1.1.0";s:11:"description";s:60:"The Scoutnet Kalender plugin 1.1.0 for WordPress allows XSS.";s:4:"refs";s:697:"[{"url":"http:\/\/packetstormsecurity.com\/files\/155615\/WordPress-Scoutnet-Kalender-1.1.0-Cross-Site-Scripting.html","name":"http:\/\/packetstormsecurity.com\/files\/155615\/WordPress-Scoutnet-Kalender-1.1.0-Cross-Site-Scripting.html","refsource":"MISC","tags":["Exploit","Mitigation","Third Party Advisory","VDB Entry"]},{"url":"https:\/\/wordpress.org\/plugins\/scoutnet-kalender\/#developers","name":"https:\/\/wordpress.org\/plugins\/scoutnet-kalender\/#developers","refsource":"MISC","tags":["Release Notes","Vendor Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9969","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9969","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:977;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2014-4553";s:4:"slug";s:38:"spreadshirt-rss-3d-cube-flash-gallery ";s:13:"versionImpact";s:3:"1.3";s:11:"description";s:189:"Cross-site Scripting (XSS) in the spreadshirt-rss-3d-cube-flash-gallery plugin 2014 for WordPress allows remote attackers to execute arbitrary web script or HTML via unspecified parameters.";s:4:"refs";s:283:"[{"url":"http:\/\/codevigilant.com\/disclosure\/wp-plugin-spreadshirt-rss-3d-cube-flash-gallery-a3-cross-site-scripting-xss\/","name":"http:\/\/codevigilant.com\/disclosure\/wp-plugin-spreadshirt-rss-3d-cube-flash-gallery-a3-cross-site-scripting-xss\/","refsource":"MISC","tags":[]}]";}i:978;O:8:"stdClass":4:{s:6:"CVE_ID";s:14:"CVE-2019-20203";s:4:"slug";s:6:"postie";s:11:"description";s:169:"The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an email message.";s:4:"refs";s:501:"[{"url":"https:\/\/github.com\/V1n1v131r4\/Exploiting-Postie-WordPress-Plugin-\/blob\/master\/README.md","name":"https:\/\/github.com\/V1n1v131r4\/Exploiting-Postie-WordPress-Plugin-\/blob\/master\/README.md","refsource":"MISC","tags":[]},{"url":"https:\/\/postieplugin.com\/","name":"https:\/\/postieplugin.com\/","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/postie\/#developers","name":"https:\/\/wordpress.org\/plugins\/postie\/#developers","refsource":"MISC","tags":[]}]";}i:979;O:8:"stdClass":4:{s:6:"CVE_ID";s:14:"CVE-2019-20180";s:4:"slug";s:6:"ignore";s:11:"description";s:213:"The TablePress plugin 1.9.2 for WordPress allows tablepress[data] CSV injection by Editor users.

Low impact, this can be created by any editor and problem lies in CSV format in general, so the issue is minimal.";s:4:"refs";s:263:"[{"url":"https:\/\/medium.com\/@Pablo0xSantiago\/cve-2019-20180-tablepress-version-1-9-2-csv-injection-65309fcc8be8","name":"https:\/\/medium.com\/@Pablo0xSantiago\/cve-2019-20180-tablepress-version-1-9-2-csv-injection-65309fcc8be8","refsource":"MISC","tags":[]}]";}i:980;O:8:"stdClass":5:{s:6:"CVE_ID";s:14:"CVE-2019-20181";s:4:"slug";s:15:"awesome-support";s:13:"versionImpact";s:5:"5.8.0";s:11:"description";s:87:"The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.";s:4:"refs";s:297:"[{"url":"https:\/\/medium.com\/@Pablo0xSantiago\/cve-2019-20181-awesome-support-wordpress-helpdesk-support-plugin-5-8-0-84a0c022cf53","name":"https:\/\/medium.com\/@Pablo0xSantiago\/cve-2019-20181-awesome-support-wordpress-helpdesk-support-plugin-5-8-0-84a0c022cf53","refsource":"MISC","tags":[]}]";}i:981;O:8:"stdClass":6:{s:6:"CVE_ID";s:13:"CVE-2014-4561";s:4:"slug";s:23:"ultimate-weather-plugin";s:13:"versionImpact";s:1:"1";s:11:"description";s:53:"The ultimate-weather plugin 1.0 for WordPress has XSS";s:14:"recommendation";s:126:"This plugin has been closed and is no longer available for download.

https://wordpress.org/plugins/ultimate-weather-plugin/";s:4:"refs";s:255:"[{"url":"http:\/\/codevigilant.com\/disclosure\/wp-plugin-ultimate-weather-plugin-a3-cross-site-scripting-xss\/","name":"http:\/\/codevigilant.com\/disclosure\/wp-plugin-ultimate-weather-plugin-a3-cross-site-scripting-xss\/","refsource":"MISC","tags":[]}]";}i:982;O:8:"stdClass":6:{s:6:"CVE_ID";s:13:"CVE-2020-6849";s:4:"slug";s:26:"marketo-forms-and-tracking";s:13:"versionImpact";s:5:"1.0.2";s:11:"description";s:133:"The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with resultant XSS.";s:14:"recommendation";s:136:"This plugin has been closed as of December 11, 2019 and is not available for download. This closure is temporary, pending a full review.";s:4:"refs";s:449:"[{"url":"https:\/\/wordpress.org\/plugins\/marketo-forms-and-tracking\/#developers","name":"https:\/\/wordpress.org\/plugins\/marketo-forms-and-tracking\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10031","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10031","refsource":"MISC","tags":[]},{"url":"https:\/\/zeroauth.ltd\/blog\/","name":"https:\/\/zeroauth.ltd\/blog\/","refsource":"MISC","tags":[]}]";}i:983;O:8:"stdClass":6:{s:6:"CVE_ID";s:13:"CVE-2020-8658";s:4:"slug";s:8:"htaccess";s:13:"versionImpact";s:5:"1.8.1";s:11:"description";s:443:"The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attacker is able to direct the victim to a malicious web page that modifies the .htaccess file, and takes control of the website.";s:14:"recommendation";s:188:"This plugin has been closed as of February 6, 2020 and is not available for download. This closure is temporary, pending a full review.

https://wordpress.org/plugins/htaccess/#developer";s:4:"refs";s:559:"[{"url":"https:\/\/github.com\/V1n1v131r4\/Exploiting-WP-Htaccess-by-BestWebSoft-Plugin\/blob\/master\/README.md","name":"https:\/\/github.com\/V1n1v131r4\/Exploiting-WP-Htaccess-by-BestWebSoft-Plugin\/blob\/master\/README.md","refsource":"MISC","tags":[]},{"url":"https:\/\/wordpress.org\/plugins\/htaccess\/#developers","name":"https:\/\/wordpress.org\/plugins\/htaccess\/#developers","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10060","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10060","refsource":"MISC","tags":[]}]";}i:984;O:8:"stdClass":4:{s:6:"CVE_ID";s:13:"CVE-2019-6267";s:4:"slug";s:21:"easy-redirect-manager";s:11:"description";s:189:"The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log viewing at the templates/admin/redirect-log.php URI.";s:4:"refs";s:618:"[{"url":"https:\/\/wordpress.org\/plugins\/easy-redirect-manager\/#developers","name":"https:\/\/wordpress.org\/plugins\/easy-redirect-manager\/#developers","refsource":"MISC","tags":["Product"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9203","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9203","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/www.logicallysecure.com\/blog\/ls-team-discovers-xss-in-wordpress-plugin\/","name":"https:\/\/www.logicallysecure.com\/blog\/ls-team-discovers-xss-in-wordpress-plugin\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:985;O:8:"stdClass":4:{s:6:"CVE_ID";s:13:"CVE-2020-9334";s:4:"slug";s:19:"envira-gallery-lite";s:11:"description";s:258:"A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitation of this vulnerability would allow a authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users.";s:4:"refs";s:385:"[{"url":"https:\/\/wordpress.org\/plugins\/envira-gallery-lite\/#developers","name":"https:\/\/wordpress.org\/plugins\/envira-gallery-lite\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10089","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10089","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:986;O:8:"stdClass":6:{s:6:"CVE_ID";s:13:"CVE-2020-9466";s:4:"slug";s:12:"export-users";s:13:"versionImpact";s:3:"1.5";s:11:"description";s:80:"The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection.";s:14:"recommendation";s:110:"This plugin has been closed as of February 27, 2020 and is not available for download. Reason: Security Issue.";s:4:"refs";s:621:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10094","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10094","refsource":"MISC","tags":[]},{"url":"https:\/\/www.getastra.com\/blog\/911\/plugin-exploit\/csv-injection-in-export-users-to-csv-wordpress-plugin\/","name":"https:\/\/www.getastra.com\/blog\/911\/plugin-exploit\/csv-injection-in-export-users-to-csv-wordpress-plugin\/","refsource":"MISC","tags":[]},{"url":"https:\/\/www.jinsonvarghese.com\/csv-injection-in-export-users-to-csv-plugin\/","name":"https:\/\/www.jinsonvarghese.com\/csv-injection-in-export-users-to-csv-plugin\/","refsource":"MISC","tags":[]}]";}i:987;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9618";s:4:"slug";s:23:"gracemedia-media-player";s:13:"versionImpact";s:3:"1.0";s:11:"description";s:105:"The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.";s:4:"refs";s:821:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2019\/Mar\/26","name":"20190319 WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion","refsource":"FULLDISC","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"http:\/\/seclists.org\/fulldisclosure\/2019\/Mar\/32","name":"20190319 Re: WordPress Plugin GraceMedia Media Player 1.0 - Local File Inclusion","refsource":"FULLDISC","tags":["Mailing List","Third Party Advisory"]},{"url":"https:\/\/wordpress.org\/plugins\/gracemedia-media-player\/#developers","name":"https:\/\/wordpress.org\/plugins\/gracemedia-media-player\/#developers","refsource":"MISC","tags":["Release Notes","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9234","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9234","refsource":"MISC","tags":[]}]";}i:988;O:8:"stdClass":5:{s:6:"CVE_ID";s:13:"CVE-2019-9908";s:4:"slug";s:14:"font-organizer";s:13:"versionImpact";s:5:"2.1.1";s:11:"description";s:98:"The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS.";s:4:"refs";s:829:"[{"url":"http:\/\/seclists.org\/fulldisclosure\/2019\/Mar\/37","name":"20190322 Re: Font_Organizer 2.1.1 - Reflected XSS (WordPress Plugin)","refsource":"FULLDISC","tags":["Mailing List","Third Party Advisory"]},{"url":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/8","name":"https:\/\/lists.openwall.net\/full-disclosure\/2019\/02\/05\/8","refsource":"MISC","tags":["Mailing List","Third Party Advisory"]},{"url":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-font-organizer-xss\/","name":"https:\/\/security-consulting.icu\/blog\/2019\/02\/wordpress-font-organizer-xss\/","refsource":"MISC","tags":["Exploit","Third Party Advisory"]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9239","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9239","refsource":"MISC","tags":["Third Party Advisory"]}]";}i:989;O:8:"stdClass":6:{s:6:"CVE_ID";s:14:"CVE-2020-10817";s:4:"slug";s:35:"custom-searchable-data-entry-system";s:13:"versionImpact";s:5:"1.7.1";s:11:"description";s:174:"The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. NOTE: this product is discontinued.";s:14:"recommendation";s:186:"This plugin has been closed as of March 12, 2020 and is not available for download. This closure is permanent. Details: https://wordpress.org/plugins/custom-searchable-data-entry-system/";s:4:"refs";s:319:"[{"url":"http:\/\/avveng.com\/cve.html","name":"http:\/\/avveng.com\/cve.html","refsource":"MISC","tags":[]},{"url":"https:\/\/plugins.trac.wordpress.org\/log\/custom-searchable-data-entry-system\/","name":"https:\/\/plugins.trac.wordpress.org\/log\/custom-searchable-data-entry-system\/","refsource":"MISC","tags":[]}]";}}s:6:"themes";a:9:{i:0;O:8:"stdClass":7:{s:6:"CVE_ID";s:14:"CVE-2019-15869";s:4:"slug";s:9:"jobcareer";s:13:"versionImpact";s:0:"";s:19:"versionEndExcluding";s:5:"2.5.1";s:11:"description";s:62:"The JobCareer theme before 2.5.1 for WordPress has stored XSS.";s:14:"recommendation";s:0:"";s:4:"refs";s:173:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9322","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9322","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:1;O:8:"stdClass":7:{s:6:"CVE_ID";s:14:"CVE-2019-15870";s:4:"slug";s:7:"carspot";s:13:"versionImpact";s:0:"";s:19:"versionEndExcluding";s:5:"2.1.7";s:11:"description";s:87:"The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.";s:14:"recommendation";s:0:"";s:4:"refs";s:173:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9258","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9258","refsource":"MISC","tags":["Exploit","Third Party Advisory"]}]";}i:2;O:8:"stdClass":7:{s:6:"CVE_ID";s:14:"CVE-2019-19542";s:4:"slug";s:10:"listingpro";s:13:"versionImpact";s:0:"";s:19:"versionEndExcluding";s:8:"2.0.14.5";s:11:"description";s:125:"The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page.";s:14:"recommendation";s:0:"";s:4:"refs";s:141:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9974","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9974","refsource":"MISC","tags":[]}]";}i:3;O:8:"stdClass":7:{s:6:"CVE_ID";s:14:"CVE-2019-19540";s:4:"slug";s:10:"listingpro";s:13:"versionImpact";s:0:"";s:19:"versionEndExcluding";s:8:"2.0.14.2";s:11:"description";s:105:"The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.";s:14:"recommendation";s:0:"";s:4:"refs";s:141:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9974","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9974","refsource":"MISC","tags":[]}]";}i:4;O:8:"stdClass":7:{s:6:"CVE_ID";s:14:"CVE-2019-19541";s:4:"slug";s:10:"listingpro";s:13:"versionImpact";s:0:"";s:19:"versionEndExcluding";s:8:"2.0.14.2";s:11:"description";s:131:"The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page.";s:14:"recommendation";s:0:"";s:4:"refs";s:141:"[{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/9974","name":"https:\/\/wpvulndb.com\/vulnerabilities\/9974","refsource":"MISC","tags":[]}]";}i:5;O:8:"stdClass":7:{s:6:"CVE_ID";s:14:"CVE-2020-17362";s:4:"slug";s:9:"nova-lite";s:13:"versionImpact";s:0:"";s:19:"versionEndExcluding";s:5:"1.3.9";s:11:"description";s:82:"search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS.";s:14:"recommendation";s:0:"";s:4:"refs";s:224:"[{"url":"https:\/\/themes.trac.wordpress.org\/browser\/nova-lite\/1.3.9\/readme.txt?rev=134076","name":"https:\/\/themes.trac.wordpress.org\/browser\/nova-lite\/1.3.9\/readme.txt?rev=134076","refsource":"CONFIRM","tags":[]}]";}i:6;O:8:"stdClass":7:{s:6:"CVE_ID";s:14:"CVE-2019-20209";s:4:"slug";s:8:"easybook";s:13:"versionImpact";s:0:"";s:19:"versionEndExcluding";s:5:"1.2.2";s:11:"description";s:211:"The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Reference (IDOR) via wp-admin/admin-ajax.php to delete any page/post/listing.";s:14:"recommendation";s:0:"";s:4:"refs";s:1517:"[{"url":"https:\/\/cxsecurity.com\/issue\/WLB-2019120110","name":"https:\/\/cxsecurity.com\/issue\/WLB-2019120110","refsource":"MISC","tags":[]},{"url":"https:\/\/cxsecurity.com\/issue\/WLB-2019120111","name":"https:\/\/cxsecurity.com\/issue\/WLB-2019120111","refsource":"MISC","tags":[]},{"url":"https:\/\/cxsecurity.com\/issue\/WLB-2019120112","name":"https:\/\/cxsecurity.com\/issue\/WLB-2019120112","refsource":"MISC","tags":[]},{"url":"https:\/\/themeforest.net\/item\/citybook-directory-listing-wordpress-theme\/21694727","name":"https:\/\/themeforest.net\/item\/citybook-directory-listing-wordpress-theme\/21694727","refsource":"MISC","tags":[]},{"url":"https:\/\/themeforest.net\/item\/easybook-directory-listing-wordpress-theme\/23206622","name":"https:\/\/themeforest.net\/item\/easybook-directory-listing-wordpress-theme\/23206622","refsource":"MISC","tags":[]},{"url":"https:\/\/themeforest.net\/item\/townhub-directory-listing-wordpress-theme\/25019571","name":"https:\/\/themeforest.net\/item\/townhub-directory-listing-wordpress-theme\/25019571","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10013","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10013","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10014","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10014","refsource":"MISC","tags":[]},{"url":"https:\/\/wpvulndb.com\/vulnerabilities\/10018","name":"https:\/\/wpvulndb.com\/vulnerabilities\/10018","refsource":"MISC","tags":[]}]";}i:7;O:8:"stdClass":7:{s:6:"CVE_ID";s:14:"CVE-2019-17230";s:4:"slug";s:7:"onetone";s:13:"versionImpact";s:0:"";s:19:"versionEndExcluding";s:0:"";s:11:"description";s:117:"includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.";s:14:"recommendation";s:196:"This theme is not maintained anymore and the vulnerability has never been fixed. Details: https://blog.nintechnet.com/unauthenticated-stored-xss-vulnerability-in-wordpress-onetone-theme-unpatched/";s:4:"refs";s:271:"[{"url":"https:\/\/blog.nintechnet.com\/unauthenticated-stored-xss-vulnerability-in-wordpress-onetone-theme-unpatched\/","name":"https:\/\/blog.nintechnet.com\/unauthenticated-stored-xss-vulnerability-in-wordpress-onetone-theme-unpatched\/","refsource":"MISC","tags":[]}]";}i:8;O:8:"stdClass":7:{s:6:"CVE_ID";s:14:"CVE-2019-17231";s:4:"slug";s:7:"onetone";s:13:"versionImpact";s:0:"";s:19:"versionEndExcluding";s:0:"";s:11:"description";s:109:"includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.";s:14:"recommendation";s:203:"This theme is not maintained anymore and the vulnerability has never been fixed. - More details: https://blog.nintechnet.com/unauthenticated-stored-xss-vulnerability-in-wordpress-onetone-theme-unpatched/";s:4:"refs";s:271:"[{"url":"https:\/\/blog.nintechnet.com\/unauthenticated-stored-xss-vulnerability-in-wordpress-onetone-theme-unpatched\/","name":"https:\/\/blog.nintechnet.com\/unauthenticated-stored-xss-vulnerability-in-wordpress-onetone-theme-unpatched\/","refsource":"MISC","tags":[]}]";}}s:12:"plugin_vulns";i:990;s:11:"theme_vulns";i:9;s:8:"wp_vulns";i:93;s:7:"updated";s:19:"2021-01-07 17:45:07";s:9:"timestamp";i:1615165784;}