2015 CVEs (page 5)
Page 5 of 88 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-9529 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Stripe extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1… |
CVE-2015-9528 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Software Licensing extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1… |
CVE-2015-9527 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Simple Shipping extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x b… |
CVE-2015-9526 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Reviews extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2… |
CVE-2015-9525 | Medium | 6.1 | 2019-10-23 | The Easy Digital Downloads (EDD) Recurring Payments extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1… |
CVE-2015-9501 | Medium | 6.1 | 2019-10-22 | The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web root. |
CVE-2015-9500 | Medium | 6.1 | 2019-10-22 | The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js. |
CVE-2015-9499 | Critical | 9.8 | 2019-10-22 | The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive. |
CVE-2015-9498 | High | 8.8 | 2019-10-22 | The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value. |
CVE-2015-9497 | High | 8.8 | 2019-10-22 | The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php. |
CVE-2015-9496 | High | 8.8 | 2019-10-22 | The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FM_form id=' substring. |
CVE-2015-9495 | Medium | 6.1 | 2019-10-22 | The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier. |
CVE-2015-9494 | Medium | 6.1 | 2019-10-22 | The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier. |
CVE-2015-9493 | Medium | 6.1 | 2019-10-22 | The my-wish-list plugin before 1.4.2 for WordPress has multiple XSS issues. |
CVE-2015-9492 | High | 7.5 | 2019-10-11 | The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login… |
CVE-2015-9491 | High | 7.5 | 2019-10-11 | The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login… |
CVE-2015-9490 | High | 7.5 | 2019-10-11 | The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pas… |
CVE-2015-9489 | High | 7.5 | 2019-10-11 | The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login… |
CVE-2015-9488 | High | 7.5 | 2019-10-11 | The ThemeMakers Almera Responsive Portfolio Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (s… |
CVE-2015-9487 | High | 7.5 | 2019-10-11 | The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login… |
CVE-2015-9486 | High | 7.5 | 2019-10-11 | The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, u… |
CVE-2015-9485 | High | 7.5 | 2019-10-11 | The ThemeMakers Accio Responsive Parallax One Page Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive informa… |
CVE-2015-9484 | High | 7.5 | 2019-10-11 | The ThemeMakers Accio One Page Parallax Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user… |
CVE-2015-9483 | High | 7.5 | 2019-10-11 | The ThemeMakers Invento Responsive Gallery/Architecture Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive informa… |
CVE-2015-9482 | High | 7.5 | 2019-10-11 | The ThemeMakers Car Dealer / Auto Dealer Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as use… |
CVE-2015-9481 | High | 7.5 | 2019-10-11 | The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_p… |
CVE-2015-9480 | High | 7.5 | 2019-10-10 | The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter. |
CVE-2015-9479 | Critical | 9.8 | 2019-10-10 | The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb… |
CVE-2015-9478 | Medium | 6.1 | 2019-10-10 | prettyPhoto before 3.1.6 has js/jquery.prettyPhoto.js XSS. |
CVE-2015-9477 | High | 8.8 | 2019-10-10 | The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates. |
CVE-2015-9476 | High | 8.8 | 2019-10-10 | The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates. |
CVE-2015-9475 | High | 8.8 | 2019-10-10 | The Pont theme 1.5 for WordPress has insufficient restrictions on option updates. |
CVE-2015-9474 | High | 8.8 | 2019-10-10 | The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates. |
CVE-2015-9473 | High | 7.5 | 2019-10-10 | The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter. |
CVE-2015-9472 | Medium | 6.1 | 2019-10-10 | The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header. |
CVE-2015-9471 | Critical | 9.8 | 2019-10-10 | The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload. |
CVE-2015-9470 | High | 7.5 | 2019-10-10 | The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter. |
CVE-2015-9469 | Medium | 4.8 | 2019-10-10 | The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id. |
CVE-2015-9468 | Medium | 6.1 | 2019-10-10 | The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action. |
CVE-2015-9467 | Critical | 9.8 | 2019-10-10 | The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter. |
CVE-2015-9466 | Critical | 9.8 | 2019-10-10 | The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HT… |
CVE-2015-9465 | High | 8.8 | 2019-10-10 | The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id parameter. |
CVE-2015-9463 | High | 7.5 | 2019-10-10 | The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path par… |
CVE-2015-9464 | High | 7.5 | 2019-10-10 | The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.ph… |
CVE-2015-9462 | High | 7.2 | 2019-10-10 | The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_category_page SQL injection via the cat_id parameter. |
CVE-2015-9461 | High | 7.2 | 2019-10-10 | The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_portfolio_item_page SQL injection via the item_id parameter. |
CVE-2015-9460 | High | 8.8 | 2019-10-10 | The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter. |
CVE-2015-9459 | Medium | 6.1 | 2019-10-10 | The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter. |
CVE-2015-9458 | High | 7.2 | 2019-10-10 | The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pk_stt2_db_get_popular_terms count parameter exploitable via CSRF. |
CVE-2015-9457 | High | 7.2 | 2019-10-10 | The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter. |
CVE-2015-9456 | Medium | 6.5 | 2019-10-07 | The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=or… |
CVE-2015-9455 | High | 8.1 | 2019-10-07 | The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parame… |
CVE-2015-9454 | High | 8.8 | 2019-10-07 | The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter. |
CVE-2015-9453 | Medium | 6.1 | 2019-10-07 | The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist. |
CVE-2015-9452 | Critical | 9.8 | 2019-10-07 | The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter. |
CVE-2015-9451 | Critical | 9.8 | 2019-10-07 | The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid param… |
CVE-2015-9450 | Critical | 9.8 | 2019-10-07 | The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter. |
CVE-2015-9448 | High | 8.8 | 2019-09-26 | The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter. |
CVE-2015-9447 | Medium | 6.5 | 2019-09-26 | The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters. |
CVE-2015-9446 | High | 8.8 | 2019-09-26 | The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php. |
CVE-2015-9445 | High | 8.8 | 2019-09-26 | The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation. |
CVE-2015-9444 | Medium | 6.1 | 2019-09-26 | The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF. |
CVE-2015-9443 | Medium | 6.5 | 2019-09-26 | The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP. |
CVE-2015-9442 | Medium | 6.5 | 2019-09-26 | The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin. |
CVE-2015-9441 | Medium | 6.5 | 2019-09-26 | The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php. |
CVE-2015-9440 | Medium | 6.5 | 2019-09-26 | The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new. |
CVE-2015-9439 | Medium | 4.8 | 2019-09-26 | The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter. |
CVE-2015-9438 | Medium | 5.4 | 2019-09-26 | The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance paramete… |
CVE-2015-9437 | Medium | 6.5 | 2019-09-26 | The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter. |
CVE-2015-9436 | Medium | 5.4 | 2019-09-26 | The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter. |
CVE-2015-9435 | Critical | 9.8 | 2019-09-26 | The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers. |
CVE-2015-9434 | Medium | 6.5 | 2019-09-26 | The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or t… |
CVE-2015-9433 | Medium | 6.5 | 2019-09-26 | The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc… |
CVE-2015-9432 | Medium | 6.5 | 2019-09-26 | The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile… |
CVE-2015-9431 | Medium | 6.5 | 2019-09-26 | The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json… |
CVE-2015-9449 | High | 7.2 | 2019-09-26 | The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter. |
CVE-2015-9430 | Medium | 6.1 | 2019-09-26 | The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header. |
CVE-2015-9429 | Medium | 6.5 | 2019-09-26 | The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page param… |
CVE-2015-9428 | Medium | 6.5 | 2019-09-26 | The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone… |
CVE-2015-9427 | Medium | 6.5 | 2019-09-26 | The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter. |
CVE-2015-9426 | Medium | 4.6 | 2019-09-26 | The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter. |
CVE-2015-9425 | Medium | 5.4 | 2019-09-26 | The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallock… |
CVE-2015-9424 | Medium | 6.5 | 2019-09-26 | The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or adm… |
CVE-2015-9423 | Medium | 5.4 | 2019-09-26 | The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditB… |
CVE-2015-9422 | Medium | 6.5 | 2019-09-26 | The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_di… |
CVE-2015-9421 | Medium | 6.5 | 2019-09-26 | The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter. |
CVE-2015-9420 | Medium | 6.1 | 2019-09-26 | The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter. |
CVE-2015-9419 | Medium | 6.1 | 2019-09-26 | The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section. |
CVE-2015-9418 | Medium | 4.3 | 2019-09-26 | The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes. |
CVE-2015-9417 | Medium | 6.5 | 2019-09-26 | The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS. |
CVE-2015-9416 | Medium | 6.1 | 2019-09-26 | The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header. |
CVE-2015-9415 | High | 7.5 | 2019-09-26 | The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion. |
CVE-2015-9414 | Medium | 6.1 | 2019-09-26 | The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter. |
CVE-2015-9413 | Medium | 6.5 | 2019-09-26 | The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter. |
CVE-2015-9412 | Medium | 6.1 | 2019-09-26 | The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter. |
CVE-2015-9411 | Medium | 6.1 | 2019-09-26 | The Postmatic plugin before 1.4.6 for WordPress has XSS. |
CVE-2015-9410 | Medium | 5.4 | 2019-09-26 | The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter. |
CVE-2015-9409 | Medium | 6.5 | 2019-09-25 | The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php. |
CVE-2015-9406 | High | 7.5 | 2019-09-20 | Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files… |
CVE-2015-9408 | Medium | 6.5 | 2019-09-20 | The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS. |