2015 CVEs (page 6)
Page 6 of 88 — CVEs published in 2015, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-9407 | Medium | 6.1 | 2019-09-20 | The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS. |
CVE-2015-9405 | Medium | 6.1 | 2019-09-20 | The wp-piwik plugin before 1.0.5 for WordPress has XSS. |
CVE-2015-9404 | Medium | 6.1 | 2019-09-20 | The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS. |
CVE-2015-9403 | Medium | 6.1 | 2019-09-20 | The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS. |
CVE-2015-9402 | High | 8.8 | 2019-09-20 | The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload. |
CVE-2015-9401 | Medium | 4.8 | 2019-09-20 | The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS. |
CVE-2015-9400 | High | 8.8 | 2019-09-20 | The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection. |
CVE-2015-9399 | High | 7.2 | 2019-09-20 | The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection. |
CVE-2015-9398 | High | 8.8 | 2019-09-20 | The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection. |
CVE-2015-9397 | Medium | 5.4 | 2019-09-20 | The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS. |
CVE-2015-9396 | Medium | 6.1 | 2019-09-20 | The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS. |
CVE-2015-9395 | High | 8.8 | 2019-09-20 | The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action. |
CVE-2015-9394 | High | 8.8 | 2019-09-20 | The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php. |
CVE-2015-9393 | Medium | 5.4 | 2019-09-20 | The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter. |
CVE-2015-9392 | Medium | 5.4 | 2019-09-20 | The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter. |
CVE-2015-9391 | Medium | 6.1 | 2019-09-20 | The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter. |
CVE-2015-9390 | Medium | 4.3 | 2019-09-20 | The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled. |
CVE-2015-9389 | Medium | 5.4 | 2019-09-20 | The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name. |
CVE-2015-9388 | Medium | 6.5 | 2019-09-20 | The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS. |
CVE-2015-9387 | Medium | 6.5 | 2019-09-20 | The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF. |
CVE-2015-9386 | Medium | 6.1 | 2019-09-20 | The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation. |
CVE-2015-9385 | Medium | 6.1 | 2019-09-20 | The quotes-and-tips plugin before 1.20 for WordPress has XSS. |
CVE-2015-9384 | Medium | 6.1 | 2019-09-20 | The relevant plugin before 1.0.8 for WordPress has XSS. |
CVE-2015-9383 | Medium | 6.5 | 2019-09-03 | FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c. |
CVE-2015-9382 | Medium | 6.5 | 2019-09-03 | FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation. |
CVE-2015-9381 | High | 8.8 | 2019-09-03 | FreeType before 2.6.1 has a heap-based buffer over-read in T1_Get_Private_Dict in type1/t1parse.c. |
CVE-2015-9380 | High | 8.8 | 2019-08-30 | The photo-gallery plugin before 1.2.42 for WordPress has CSRF. |
CVE-2015-9359 | Medium | 6.1 | 2019-08-28 | The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9379 | Medium | 6.1 | 2019-08-28 | iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9378 | Medium | 6.1 | 2019-08-28 | iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9377 | Medium | 6.1 | 2019-08-28 | iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9376 | Medium | 6.1 | 2019-08-28 | iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9375 | Medium | 6.1 | 2019-08-28 | Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9374 | Medium | 6.1 | 2019-08-28 | Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9373 | Medium | 6.1 | 2019-08-28 | PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9372 | Medium | 6.1 | 2019-08-28 | Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9371 | Medium | 6.1 | 2019-08-28 | Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9370 | Medium | 6.1 | 2019-08-28 | Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9369 | Medium | 6.1 | 2019-08-28 | Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9368 | Medium | 6.1 | 2019-08-28 | Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9367 | Medium | 6.1 | 2019-08-28 | Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9366 | Medium | 6.1 | 2019-08-28 | Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9365 | Medium | 6.1 | 2019-08-28 | Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9364 | Medium | 6.1 | 2019-08-28 | 2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9363 | Medium | 6.1 | 2019-08-28 | iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9362 | Medium | 6.1 | 2019-08-28 | The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9361 | Medium | 6.1 | 2019-08-28 | The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9360 | Medium | 6.1 | 2019-08-28 | The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9358 | Medium | 6.1 | 2019-08-28 | The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg(). |
CVE-2015-9357 | Medium | 6.1 | 2019-08-28 | The akismet plugin before 3.1.5 for WordPress has XSS. |
CVE-2015-9356 | Medium | 6.1 | 2019-08-28 | The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg(), a different issue than CVE-2014-9460. |
CVE-2015-9355 | Medium | 6.1 | 2019-08-28 | The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area. |
CVE-2015-9354 | Medium | 4.8 | 2019-08-28 | The gigpress plugin before 2.3.11 for WordPress has XSS. |
CVE-2015-9353 | High | 7.2 | 2019-08-28 | The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066. |
CVE-2015-9352 | Critical | 9.8 | 2019-08-27 | The wp-polls plugin before 2.72 for WordPress has SQL injection. |
CVE-2015-9351 | Critical | 9.8 | 2019-08-27 | The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button. |
CVE-2015-9350 | Medium | 6.1 | 2019-08-27 | The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button. |
CVE-2015-9348 | High | 7.5 | 2019-08-27 | The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs. |
CVE-2015-9349 | Medium | 6.1 | 2019-08-27 | The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser. |
CVE-2015-9347 | Medium | 6.1 | 2019-08-27 | The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors. |
CVE-2015-9346 | Medium | 6.1 | 2019-08-27 | The cp-polls plugin before 1.0.5 for WordPress has XSS. |
CVE-2015-9345 | High | 7.5 | 2019-08-27 | The link-log plugin before 2.0 for WordPress has HTTP Response Splitting. |
CVE-2015-9344 | Critical | 9.8 | 2019-08-27 | The link-log plugin before 2.1 for WordPress has SQL injection. |
CVE-2015-9343 | High | 8.8 | 2019-08-27 | The wp-rollback plugin before 1.2.3 for WordPress has CSRF. |
CVE-2015-9342 | Medium | 6.1 | 2019-08-27 | The wp-rollback plugin before 1.2.3 for WordPress has XSS. |
CVE-2015-9340 | High | 7.5 | 2019-08-22 | The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess… |
CVE-2015-9339 | High | 7.5 | 2019-08-22 | The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files. |
CVE-2015-9338 | High | 7.5 | 2019-08-22 | The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files. |
CVE-2015-9334 | Critical | 9.8 | 2019-08-22 | The email-newsletter plugin through 20.15 for WordPress has SQL injection. |
CVE-2015-9341 | High | 7.5 | 2019-08-22 | The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files. |
CVE-2015-9337 | High | 7.5 | 2019-08-22 | The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX. |
CVE-2015-9336 | Medium | 6.1 | 2019-08-22 | The clean-login plugin before 1.5.1 for WordPress has reflected XSS. |
CVE-2015-9335 | Critical | 9.8 | 2019-08-22 | The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling. |
CVE-2015-9333 | Critical | 9.8 | 2019-08-22 | The cforms2 plugin before 14.6.10 for WordPress has SQL injection. |
CVE-2015-9328 | Medium | 6.1 | 2019-08-21 | The profile-builder plugin before 2.2.5 for WordPress has XSS. |
CVE-2015-9327 | Medium | 6.1 | 2019-08-21 | The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS. |
CVE-2015-9321 | Medium | 6.1 | 2019-08-21 | The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg. |
CVE-2015-9320 | Medium | 6.1 | 2019-08-20 | The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg. |
CVE-2015-9319 | Medium | 6.1 | 2019-08-20 | The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser. |
CVE-2015-9332 | Medium | 6.5 | 2019-08-20 | The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI. |
CVE-2015-9331 | High | 7.5 | 2019-08-20 | The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit. |
CVE-2015-9330 | Critical | 9.8 | 2019-08-20 | The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection. |
CVE-2015-9329 | Medium | 6.1 | 2019-08-20 | The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS. |
CVE-2015-9318 | High | 7.5 | 2019-08-20 | The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies. |
CVE-2015-9317 | Medium | 6.1 | 2019-08-20 | The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages. |
CVE-2015-9324 | Critical | 9.8 | 2019-08-16 | The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection. |
CVE-2015-9323 | Critical | 9.8 | 2019-08-16 | The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection. |
CVE-2015-9322 | High | 8.8 | 2019-08-16 | The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF. |
CVE-2015-9326 | Critical | 9.8 | 2019-08-16 | The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection. |
CVE-2015-9325 | Critical | 9.8 | 2019-08-16 | The visitors-online plugin before 0.4 for WordPress has SQL injection. |
CVE-2015-9310 | Critical | 9.8 | 2019-08-14 | The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues. |
CVE-2015-9309 | High | 8.8 | 2019-08-14 | The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature. |
CVE-2015-9308 | High | 8.8 | 2019-08-14 | The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature. |
CVE-2015-9307 | High | 8.8 | 2019-08-14 | The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature. |
CVE-2015-9316 | Critical | 9.8 | 2019-08-14 | The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id paramete… |
CVE-2015-9315 | Critical | 9.8 | 2019-08-14 | The newstatpress plugin before 1.0.1 for WordPress has SQL injection. |
CVE-2015-9314 | Medium | 6.1 | 2019-08-14 | The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header. |
CVE-2015-9313 | Critical | 9.8 | 2019-08-14 | The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element. |
CVE-2015-9312 | Medium | 6.1 | 2019-08-14 | The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element. |
CVE-2015-9311 | Medium | 6.1 | 2019-08-14 | The newstatpress plugin before 1.0.6 for WordPress has reflected XSS. |