CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-9233 – CP Contact Form with PayPal < 1.1.6 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2015-9233
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php. Las versiones anteriores a la 1.1.6 del plugin cp-contact-form-with-paypal (también llamado CP Contact Form with PayPal) para WordPress tienen Cross-Site Request Forgery (CSRF) con Cross-Site Scripting (XSS) resultante. Esto está relacionado con cp_contactformpp.php y cp_contactformpp_admin_int_list.inc.php. • http://seclists.org/fulldisclosure/2015/Jul/49 http://seclists.org/oss-sec/2015/q3/88 https://wordpress.org/plugins/cp-contact-form-with-paypal/#developers • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-9346 – Polls CP < 1.0.5 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-9346
The cp-polls plugin before 1.0.5 for WordPress has XSS. El plugin cp-polls antes de 1.0.5 para WordPress tiene XSS. The cp-polls plugin before 1.0.5 for WordPress has XSS via the 'name' parameter. • https://wordpress.org/plugins/cp-polls/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-10099 – CP Appointment Calendar Plugin dex_appointments.php dex_process_ready_to_go_appointment sql injection
https://notcve.org/view.php?id=CVE-2015-10099
A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress. This affects the function dex_process_ready_to_go_appointment of the file dex_appointments.php. The manipulation of the argument itemnumber leads to sql injection. It is possible to initiate the attack remotely. The patch is named e29a9cdbcb0f37d887dd302a05b9e8bf213da01d. • https://github.com/wp-plugins/cp-appointment-calendar/commit/e29a9cdbcb0f37d887dd302a05b9e8bf213da01d https://vuldb.com/?ctiid.225351 https://vuldb.com/?id.225351 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2014-125091 – codepeople cp-polls Plugin cp-admin-int-message-list.inc.php sql injection
https://notcve.org/view.php?id=CVE-2014-125091
A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical. This vulnerability affects unknown code of the file cp-admin-int-message-list.inc.php. The manipulation of the argument lu leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. • https://github.com/wp-plugins/cp-polls/commit/6d7168cbf12d1c183bacc5cd5678f6f5b0d518d2 https://github.com/wp-plugins/cp-polls/releases/tag/1.0.2 https://vuldb.com/?ctiid.222268 https://vuldb.com/?id.222268 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-10395 – Polls CP < 1.0.1 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2014-10395
The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list. El plugin cp-polls antes de 1.0.1 para WordPress tiene XSS en la lista de votos. The Polls CP plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser. • https://wordpress.org/plugins/cp-polls/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •