Search vulnerabilities

Expected end of text, found ':' (at char 31), (line:1, col:32)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,850

CVE-2016-10964

The dwnldr plugin before 1.01 for WordPress has XSS via the User-Agent HTTP header.

CVSS 3.1 · 6.1 Medium EPSS 1.0% KEV · Not listed
Vendors
Findshorty
Products
Dwnldr
CVE-2016-10962

The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Icegram
Products
Icegram Engage
CVE-2016-10961

The colorway theme before 3.4.2 for WordPress has XSS via the contactName parameter.

CVSS 3.1 · 6.1 Medium EPSS 1.0% KEV · Not listed
Vendors
Inkthemes
Products
Colorway
CVE-2016-10960

The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.

CVSS 3.1 · 8.8 High EPSS 8.7% KEV · Not listed
Vendors
Joomlaserviceprovider
Products
Wsecure
CVE-2016-10959

The estatik plugin before 2.3.1 for WordPress has authenticated arbitrary file upload (exploitable with CSRF) via es_media_images[] to wp-admin/admin-ajax.php.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Estatik
Products
Estatik
CVE-2016-10958

The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Estatik
Products
Estatik
CVE-2016-10957

The Akal theme through 2016-08-22 for WordPress has XSS via the framework/brad-shortcodes/tinymce/preview.php sc parameter.

CVSS 3.1 · 6.1 Medium EPSS 1.0% KEV · Not listed
Vendors
Akal Project
Products
Akal
CVE-2016-10955

The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.

CVSS 3.1 · 9.8 Critical EPSS 2.4% KEV · Not listed
Vendors
Cysteme
Products
Cysteme-finder
CVE-2016-10954

The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed
Vendors
Dynamicpress
Products
Neosense
CVE-2016-10950

The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Sirv
Products
Sirv
CVE-2016-10949

The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Relevanssi
Products
Relevanssi