rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-9430 
The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T00:53:56.000Z
CVE-2015-9431 
The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T01:06:12.000Z
CVE-2015-9432 
The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T01:07:44.000Z
CVE-2015-9433 
The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc. in wp-admin/options-general.php?page=wp-social-bookmarking-light%2Fmodules%2Fadmin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T01:09:22.000Z
CVE-2015-9434 
The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T01:12:31.000Z
CVE-2015-9435 
The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T01:14:07.000Z
CVE-2015-9436 
The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T01:15:52.000Z
CVE-2015-9437 
The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T01:18:30.000Z
CVE-2015-9438 
The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T01:22:16.000Z
CVE-2015-9439 
The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T02:11:14.000Z
CVE-2015-9440 
The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T03:31:23.000Z
CVE-2015-9441 
The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T03:53:39.000Z
CVE-2015-9442 
The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T03:51:45.000Z
CVE-2015-9443 
The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T03:51:00.000Z
CVE-2015-9444 
The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T03:48:42.000Z
CVE-2015-9445 
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T03:44:04.000Z
CVE-2015-9446 
The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T03:40:48.000Z
CVE-2015-9447 
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T03:39:11.000Z
CVE-2015-9448 
The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T03:33:49.000Z
CVE-2015-9449 
The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-26T00:55:16.000Z
CVE-2015-9450 
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T14:14:35.000Z
CVE-2015-9451 
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T14:17:49.000Z
CVE-2015-9452 
The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T14:19:48.000Z
CVE-2015-9453 
The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T14:21:26.000Z
CVE-2015-9454 
The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T14:22:47.000Z
CVE-2015-9455 
The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T14:25:06.000Z
CVE-2015-9456 
The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file theme_1, theme_1_file, or theme_1_file_contents parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T14:27:05.000Z
CVE-2015-9457 
The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T15:48:17.000Z
CVE-2015-9458 
The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pk_stt2_db_get_popular_terms count parameter exploitable via CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T15:49:34.000Z
CVE-2015-9459 
The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T15:50:33.000Z
CVE-2015-9460 
The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T15:52:24.000Z
CVE-2015-9461 
The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_portfolio_item_page SQL injection via the item_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T15:54:01.000Z
CVE-2015-9462 
The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_category_page SQL injection via the cat_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T15:55:43.000Z
CVE-2015-9463 
The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:08:44.000Z
CVE-2015-9464 
The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:00:41.000Z
CVE-2015-9465 
The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:01:50.000Z
CVE-2015-9466 
The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTP_FORWARDED_FOR, or HTTP_FORWARDED variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:03:18.000Z
CVE-2015-9467 
The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:04:19.000Z
CVE-2015-9468 
The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:05:36.000Z
CVE-2015-9469 
The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:06:54.000Z
CVE-2015-9470 
The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:08:10.000Z
CVE-2015-9471 
The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:11:59.000Z
CVE-2015-9472 
The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:13:21.000Z
CVE-2015-9473 
The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:14:40.000Z
CVE-2015-9474 
The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:15:39.000Z
CVE-2015-9475 
The Pont theme 1.5 for WordPress has insufficient restrictions on option updates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:16:10.000Z
CVE-2015-9476 
The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:16:52.000Z
CVE-2015-9477 
The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:17:25.000Z
CVE-2015-9478 
prettyPhoto before 3.1.6 has js/jquery.prettyPhoto.js XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:19:15.000Z
CVE-2015-9479 
The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:20:53.000Z
CVE-2015-9480 
The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-10T16:22:28.000Z
CVE-2015-9481 
The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T17:57:59.000Z
CVE-2015-9482 
The ThemeMakers Car Dealer / Auto Dealer Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T17:58:34.000Z
CVE-2015-9483 
The ThemeMakers Invento Responsive Gallery/Architecture Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T17:59:14.000Z
CVE-2015-9484 
The ThemeMakers Accio One Page Parallax Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T18:00:10.000Z
CVE-2015-9485 
The ThemeMakers Accio Responsive Parallax One Page Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T18:00:44.000Z
CVE-2015-9486 
The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T18:01:30.000Z
CVE-2015-9487 
The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T18:02:30.000Z
CVE-2015-9488 
The ThemeMakers Almera Responsive Portfolio Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T18:03:03.000Z
CVE-2015-9489 
The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T18:03:37.000Z
CVE-2015-9490 
The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T18:04:09.000Z
CVE-2015-9491 
The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T18:04:46.000Z
CVE-2015-9492 
The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T18:05:14.000Z
CVE-2015-9493 
The my-wish-list plugin before 1.4.2 for WordPress has multiple XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T19:13:49.000Z
CVE-2015-9494 
The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T19:19:48.000Z
CVE-2015-9495 
The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T19:24:56.000Z
CVE-2015-9496 
The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FM_form id=' substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T20:27:04.000Z
CVE-2015-9497 
The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T20:34:15.000Z
CVE-2015-9498 
The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T20:36:32.000Z
CVE-2015-9499 
The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T20:45:49.000Z
CVE-2015-9500 
The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T20:52:08.000Z
CVE-2015-9501 
The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-22T21:01:17.000Z
CVE-2015-9502 
The Auberge theme before 1.4.5 for WordPress has XSS via the genericons/example.html anchor identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T16:10:03.000Z
CVE-2015-9503 
The Modern theme before 1.4.2 for WordPress has XSS via the genericons/example.html anchor identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T16:11:58.000Z
CVE-2015-9504 
The weeklynews theme before 2.2.9 for WordPress has XSS via the s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T16:13:16.000Z
CVE-2015-9505 
The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7 for WordPress has XSS because add_query_arg is misused.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T16:13:41.000Z
CVE-2015-9506 
The Easy Digital Downloads (EDD) Amazon S3 extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T16:13:25.000Z
CVE-2015-9507 
The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T16:13:05.000Z
CVE-2015-9508 
The Easy Digital Downloads (EDD) Commissions extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T16:12:35.000Z
CVE-2015-9509 
The Easy Digital Downloads (EDD) Content Restriction extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T16:12:19.000Z
CVE-2015-9510 
The Easy Digital Downloads (EDD) Cross-sell Upsell extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T16:12:02.000Z
CVE-2015-9511 
The Easy Digital Downloads (EDD) Conditional Success Redirects extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T16:11:30.000Z
CVE-2015-9512 
The Easy Digital Downloads (EDD) CSV Manager extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-23T16:11:09.000Z