Skip to content
OpenAdvisories

Archive

August 2019

Vulnerabilities first published in this month (UTC), newest first.

← July 2019 2019 / August September 2019 →
  1. 1162
  2. 2182
  3. 32
  4. 4 
  5. 560
  6. 664
  7. 776
  8. 859
  9. 954
  10. 104
  11. 113
  12. 1247
  13. 1368
  14. 14176
  15. 1556
  16. 1645
  17. 175
  18. 1817
  19. 1942
  20. 20197
  21. 21115
  22. 22111
  23. 2377
  24. 24 
  25. 252
  26. 26121
  27. 2762
  28. 2870
  29. 2997
  30. 3033
  31. 31 
All Critical High Medium Low Exploited only Public exploit

2,007 results · Feed

  • Unscored —
    CVE-2017-18582

    The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.

  • Unscored —
    CVE-2017-18581

    The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.

  • Unscored —
    CVE-2018-20985 Scanner template

    The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pa…

  • Unscored —
    CVE-2017-18580 Scanner template EPSS 12%

    The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or us…

  • Unscored —
    CVE-2019-15322

    The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.

  • Unscored —
    CVE-2018-20984

    The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.

  • Unscored —
    CVE-2019-15321

    The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.

  • Unscored —
    CVE-2019-15320

    The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.

  • Unscored —
    CVE-2019-15319

    The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.

  • Unscored —
    CVE-2016-10927

    The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.

  • Unscored —
    CVE-2016-10926

    The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.

  • Unscored —
    CVE-2014-10385

    The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.

  • Unscored —
    CVE-2014-10384

    The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.

  • Unscored —
    CVE-2014-10383

    The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.

  • Unscored —
    CVE-2018-20983

    The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.

  • Unscored —
    CVE-2008-7321

    The tubepress plugin before 1.6.5 for WordPress has XSS.

  • Unscored —
    CVE-2013-7482

    The reflex-gallery plugin before 1.4.3 for WordPress has XSS.

  • Unscored —
    CVE-2016-10925

    The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.

  • Unscored —
    CVE-2017-18577

    The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.

  • Unscored —
    CVE-2016-10924 Public exploit Scanner template EPSS 12%

    The ebook-download plugin before 1.2 for WordPress has directory traversal.

  • Unscored —
    CVE-2017-18576

    The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.

  • Unscored —
    CVE-2016-10923

    The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.

  • Unscored —
    CVE-2016-10922

    The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.

  • Unscored —
    CVE-2017-18575

    The newstatpress plugin before 1.2.5 for WordPress has multiple stored XSS issues.

  • Unscored —
    CVE-2018-20982

    The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library …

  • Unscored —
    CVE-2013-7481

    The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.

  • Unscored —
    CVE-2019-15318

    The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field.

  • Unscored —
    CVE-2017-18574

    The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.

  • Unscored —
    CVE-2018-20981

    The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Exp…

  • Unscored —
    CVE-2009-5158

    The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API t…

  • Unscored —
    CVE-2018-20980

    The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.

  • Unscored —
    CVE-2018-20979

    The contact-form-7 plugin before 5.0.4 for WordPress has privilege escalation because of capability_type mishandling in…

  • Unscored —
    CVE-2017-18573

    The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.

  • Unscored —
    CVE-2016-10921

    The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.

  • Unscored —
    CVE-2016-10920

    The gnucommerce plugin before 0.5.7-BETA for WordPress has XSS.

  • Unscored —
    CVE-2017-18572

    The gnucommerce plugin before 1.4.2 for WordPress has XSS.

  • Unscored —
    CVE-2012-6716

    The events-manager plugin before 5.1.7 for WordPress has XSS via JSON call links.

  • Unscored —
    CVE-2013-7480

    The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas.

  • Unscored —
    CVE-2013-7479

    The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field.

  • Unscored —
    CVE-2013-7478

    The events-manager plugin before 5.5 for WordPress has XSS via EM_Ticket::get_post.