CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2019-14787 – Newsletters <= 4.6.18 - Cross-Site Scripting via contentarea Parameter
https://notcve.org/view.php?id=CVE-2019-14787
The Tribulant Newsletters plugin before 4.6.19 for WordPress allows XSS via the wp-admin/admin-ajax.php?action=newsletters_load_new_editor contentarea parameter. El plugin Tribulant Newsletters en versiones anteriores a 4.6.19 para WordPress, permite un ataque de tipo XSS por medio del parámetro contentarea de wp-admin/admin-ajax.php?action=newsletters_load_new_editor. • https://wordpress.org/plugins/newsletters-lite/#developers https://wpvulndb.com/vulnerabilities/9447 https://www.pluginvulnerabilities.com/2019/07/01/reflected-cross-site-scripting-xss-vulnerability-in-newsletters • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18017 – Slideshow Gallery <= 1.6.8 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-18017
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter. El plugin Tribulant Slideshow Gallery 1.6.8 para WordPress es vulnerable a un Cross-site scripting (XSS) a través del parámetro wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] o Gallery[title]. • https://ansawaf.blogspot.com/2019/04/xss-and-sqli-in-slideshow-gallery.html https://docs.google.com/document/d/1rwN4hJkD5TJfCa16rsGwzYhzL-ODd2VLkFnPvAIq4Ys/edit?usp=sharing • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18019 – Slideshow Gallery <= 1.6.8 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-18019
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media_file], or Slide[image_url] parameter. El plugin Tribulant Slideshow Gallery 1.6.8 para WordPress es vulnerable a un Cross-site scripting (XSS) a través del parámetro wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media_file], o Slide[image_url]. • https://ansawaf.blogspot.com/2019/04/xss-and-sqli-in-slideshow-gallery.html https://docs.google.com/document/d/1rwN4hJkD5TJfCa16rsGwzYhzL-ODd2VLkFnPvAIq4Ys/edit?usp=sharing • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18018 – Slideshow Gallery <= 1.6.8 - SQL Injection
https://notcve.org/view.php?id=CVE-2018-18018
SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter. El plugin Tribulant Slideshow Gallery 1.6.8 para WordPress es vulnerable a una inyección SQL a través del parámetro wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] o Gallery[title]. • https://ansawaf.blogspot.com/2019/04/xss-and-sqli-in-slideshow-gallery.html https://docs.google.com/document/d/1rwN4hJkD5TJfCa16rsGwzYhzL-ODd2VLkFnPvAIq4Ys/edit?usp=sharing • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20987 – Newsletters <= 4.6.8.5 - Object Injection
https://notcve.org/view.php?id=CVE-2018-20987
The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection. El plugin newsletters-lite en versiones anteriores a la 4.6.8.6 para WordPress tiene inyección de objetos PHP. • https://wordpress.org/plugins/newsletters-lite/#developers https://wpvulndb.com/vulnerabilities/9627 • CWE-502: Deserialization of Untrusted Data •