Search vulnerabilities

Expected end of text, found ':' (at char 31), (line:1, col:32)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,850

CVE-2016-10986

The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumer_key, consumer_secret, access_token, and access_token_secret.

CVSS 3.1 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Nerdcow
Products
Tweet Wheel
CVE-2016-10985

The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter.

CVSS 3.1 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Smackcoders
Products
Echo Sign
CVE-2016-10984

The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter.

CVSS 3.1 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Smackcoders
Products
Echo Sign
CVE-2016-10983

The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Ghost
Products
Ghost
CVE-2016-10981

The kento-post-view-counter plugin through 2.8 for WordPress has stored XSS via kento_pvc_numbers_lang, kento_pvc_today_text, or kento_pvc_total_text.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Kentothemes
Products
Kento-post-view-counter
CVE-2016-10976

The safe-editor plugin before 1.2 for WordPress has no se_save authentication, with resultant XSS.

CVSS 3.1 · 6.1 Medium EPSS 1.7% KEV · Not listed
Vendors
Kodebyraaet
Products
Safe Editor
CVE-2016-10973

The Brafton plugin before 3.4.8 for WordPress has XSS via the wp-admin/admin.php?page=BraftonArticleLoader tab parameter to BraftonAdminPage.php.

CVSS 3.1 · 6.1 Medium EPSS 2.0% KEV · Not listed
Vendors
Brafton
Products
Brafton
CVE-2016-10972

The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.

CVSS 3.1 · 9.8 Critical EPSS 10.8% KEV · Not listed
Vendors
Tagdiv
Products
Newspaper
CVE-2016-10971

The MemberSonic Lite plugin before 1.302 for WordPress has incorrect login access control because only knowlewdge of an e-mail address is required.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed
Vendors
Membersonic
Products
Membersonic
CVE-2016-10968

The peepso-core plugin before 1.6.1 for WordPress has PeepSoProfilePreferencesAjax->save() privilege escalation.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Peepso
Products
Peepso