WordPress

The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.

The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.

The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.

The wp-rollback plugin before 1.2.3 for WordPress has CSRF.

The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.

The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.

The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.

The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n.

The GoDaddy godaddy-email-marketing-sign-up-forms plugin before 1.1.3 for WordPress has CSRF.

The wp-customer-reviews plugin before 3.0.9 for WordPress has CSRF in the admin tools.

The eelv-newsletter plugin before 4.6.1 for WordPress has CSRF in the address book.

The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.

The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.

The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.

The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.

The user-domain-whitelist plugin before 1.5 for WordPress has CSRF.

The user-access-manager plugin before 1.2 for WordPress has CSRF.

The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.

The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.

The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.

The js-jobs plugin before 1.0.7 for WordPress has CSRF.

The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.

The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.

The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.

The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.

The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.

The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.

wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value.

An issue was discovered in the svg-vector-icon-plugin (aka WP SVG Icons) plugin through 3.2.1 for WordPress. wp-admin/admin.php?page=wp-svg-icons-custom-set mishandles Custom Icon uploads. CSRF leads to upload of a ZIP archive containing a .php file.

The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.

The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.

The responsive-menu plugin before 3.1.4 for WordPress has no CSRF protection mechanism for the admin interface.

The newsletter-by-supsystic plugin before 1.1.8 for WordPress has CSRF.

The custom-sidebars plugin before 3.0.8.1 for WordPress has CSRF.

The custom-sidebars plugin before 3.1.0 for WordPress has CSRF related to set location, import actions, and export actions.

The wp-editor plugin before 1.2.6 for WordPress has CSRF.

The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.

The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.

The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.

The wp-statistics plugin before 12.0.8 for WordPress has SQL injection.

The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.

The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.

The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.

The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.

The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.

An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter.

Cross-site request forgery (CSRF) vulnerability in Custom CSS Pro 1.0.3 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.