stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2015-9382 (severity: MEDIUM, weakness: CWE-125)
FreeType before 2.6.1 has a buffer over-read in skip_comment in psaux/psobjs.c because ps_parser_skip_PS_token is mishandled in an FT_New_Memory_Face operation.
CVE-2015-9383 (severity: MEDIUM, weakness: CWE-125)
FreeType before 2.6.2 has a heap-based buffer over-read in tt_cmap14_validate in sfnt/ttcmap.c.
CVE-2015-9384 (severity: MEDIUM, weakness: CWE-79)
The relevant plugin before 1.0.8 for WordPress has XSS.
CVE-2015-9385 (severity: MEDIUM, weakness: CWE-79)
The quotes-and-tips plugin before 1.20 for WordPress has XSS.
CVE-2015-9386 (severity: MEDIUM, weakness: CWE-79)
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.
CVE-2015-9387 (severity: MEDIUM, weakness: CWE-352)
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF.
CVE-2015-9388 (severity: MEDIUM, weakness: CWE-352)
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.
CVE-2015-9389 (severity: MEDIUM, weakness: CWE-79)
The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name.
CVE-2015-9390 (severity: MEDIUM, weakness: CWE-269)
The admin-management-xtended plugin before 2.4.0.1 for WordPress has privilege escalation because wp_ajax functions are mishandled.
CVE-2015-9391 (severity: MEDIUM, weakness: CWE-79)
The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter.
CVE-2015-9392 (severity: MEDIUM, weakness: CWE-79)
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.
CVE-2015-9393 (severity: MEDIUM, weakness: CWE-79)
The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.
CVE-2015-9394 (severity: HIGH, weakness: CWE-352)
The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.
CVE-2015-9395 (severity: HIGH, weakness: CWE-89)
The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.
CVE-2015-9396 (severity: MEDIUM, weakness: CWE-79)
The auto-thickbox-plus plugin through 1.9 for WordPress has wp-content/plugins/auto-thickbox-plus/download.min.php?file= XSS.
CVE-2015-9397 (severity: MEDIUM, weakness: CWE-79)
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.
CVE-2015-9398 (severity: HIGH, weakness: CWE-89)
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.
CVE-2015-9399 (severity: HIGH, weakness: CWE-89)
The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graph_trend.php type SQL injection.
CVE-2015-9400 (severity: HIGH, weakness: CWE-89)
The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.
CVE-2015-9401 (severity: MEDIUM, weakness: CWE-79)
The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.
CVE-2015-9402 (severity: HIGH, weakness: CWE-434)
The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.
CVE-2015-9403 (severity: MEDIUM, weakness: CWE-79)
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.
CVE-2015-9404 (severity: MEDIUM, weakness: CWE-79)
The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS.
CVE-2015-9405 (severity: MEDIUM, weakness: CWE-79)
The wp-piwik plugin before 1.0.5 for WordPress has XSS.
CVE-2015-9406 (severity: HIGH, weakness: CWE-22)
Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files parameter to css/css.php.
CVE-2015-9407 (severity: MEDIUM, weakness: CWE-79)
The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.
CVE-2015-9408 (severity: MEDIUM, weakness: CWE-352)
The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.
CVE-2015-9409 (severity: MEDIUM, weakness: CWE-352)
The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.
CVE-2015-9410 (severity: MEDIUM, weakness: CWE-79)
The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.
CVE-2015-9411 (severity: MEDIUM, weakness: CWE-79)
The Postmatic plugin before 1.4.6 for WordPress has XSS.
CVE-2015-9412 (severity: MEDIUM, weakness: CWE-79)
The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.
CVE-2015-9413 (severity: MEDIUM, weakness: CWE-352)
The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter.
CVE-2015-9414 (severity: MEDIUM, weakness: CWE-79)
The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/get_album_item.php?size parameter.
CVE-2015-9415 (severity: HIGH, weakness: CWE-20)
The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion.
CVE-2015-9416 (severity: MEDIUM, weakness: CWE-79)
The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.
CVE-2015-9417 (severity: MEDIUM, weakness: CWE-352)
The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.
CVE-2015-9418 (severity: MEDIUM, weakness: CWE-352)
The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes.
CVE-2015-9419 (severity: MEDIUM, weakness: CWE-79)
The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section.
CVE-2015-9420 (severity: MEDIUM, weakness: CWE-79)
The soundcloud-is-gold plugin before 2.3.2 for WordPress has XSS via the wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter.
CVE-2015-9421 (severity: MEDIUM, weakness: CWE-352)
The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.
CVE-2015-9422 (severity: MEDIUM, weakness: CWE-352)
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has CSRF with resultant XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load plugnedit_width, pnemedcount, PlugneditBGColor, PlugneditEditorMargin, or plugneditcontent parameters.
CVE-2015-9423 (severity: MEDIUM, weakness: CWE-79)
The PlugNedit Adaptive Editor plugin before 6.2.0 for WordPress has XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load PlugneditBGColor, PlugneditEditorMargin, plugnedit_width, pnemedcount, or plugneditcontent parameters.
CVE-2015-9424 (severity: MEDIUM, weakness: CWE-352)
The multicons plugin before 3.0 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter.
CVE-2015-9425 (severity: MEDIUM, weakness: CWE-352)
The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next licensekey parameter.
CVE-2015-9426 (severity: MEDIUM, weakness: CWE-79)
The manual-image-crop plugin before 1.11 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=mic_editor_window postId parameter.
CVE-2015-9427 (severity: MEDIUM, weakness: CWE-352)
The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter.
CVE-2015-9428 (severity: MEDIUM, weakness: CWE-352)
The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters.
CVE-2015-9429 (severity: MEDIUM, weakness: CWE-352)
The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter.
CVE-2015-9430 (severity: MEDIUM, weakness: CWE-79)
The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header.
CVE-2015-9431 (severity: MEDIUM, weakness: CWE-352)
The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config parameter.
CVE-2015-9432 (severity: MEDIUM, weakness: CWE-352)
The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.
CVE-2015-9433 (severity: MEDIUM, weakness: CWE-352)
The wp-social-bookmarking-light plugin before 1.7.10 for WordPress has CSRF with resultant XSS via configuration parameters for Tumblr, Twitter, Facebook, etc. in wp-admin/options-general.php?page=wp-social-bookmarking-light%2Fmodules%2Fadmin.php.
CVE-2015-9434 (severity: MEDIUM, weakness: CWE-352)
The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
CVE-2015-9435 (severity: CRITICAL, weakness: CWE-338)
The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.
CVE-2015-9436 (severity: MEDIUM, weakness: CWE-79)
The dynamic-widgets plugin before 1.5.11 for WordPress has XSS via the wp-admin/admin-ajax.php?action=term_tree prefix or widget_id parameter.
CVE-2015-9437 (severity: MEDIUM, weakness: CWE-352)
The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.
CVE-2015-9438 (severity: MEDIUM, weakness: CWE-79)
The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.
CVE-2015-9439 (severity: MEDIUM, weakness: CWE-79)
The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.
CVE-2015-9440 (severity: MEDIUM, weakness: CWE-352)
The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.
CVE-2015-9441 (severity: MEDIUM, weakness: CWE-352)
The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.
CVE-2015-9442 (severity: MEDIUM, weakness: CWE-352)
The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.
CVE-2015-9443 (severity: MEDIUM, weakness: CWE-352)
The accurate-form-data-real-time-form-validation plugin 1.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=Accu_Data_WP.
CVE-2015-9444 (severity: MEDIUM, weakness: CWE-79)
The altos-connect plugin 1.3.0 for WordPress has XSS via the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/ PATH_SELF.
CVE-2015-9445 (severity: HIGH, weakness: CWE-352)
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.
CVE-2015-9446 (severity: HIGH, weakness: CWE-89)
The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php.
CVE-2015-9447 (severity: MEDIUM, weakness: CWE-352)
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters.
CVE-2015-9448 (severity: HIGH, weakness: CWE-89)
The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter.
CVE-2015-9449 (severity: HIGH, weakness: CWE-89)
The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
CVE-2015-9450 (severity: CRITICAL, weakness: CWE-89)
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_cc pmfb_tid parameter.
CVE-2015-9451 (severity: CRITICAL, weakness: CWE-89)
The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
CVE-2015-9452 (severity: CRITICAL, weakness: CWE-89)
The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter.
CVE-2015-9453 (severity: MEDIUM, weakness: CWE-79)
The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.
CVE-2015-9454 (severity: HIGH, weakness: CWE-89)
The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.
CVE-2015-9455 (severity: HIGH, weakness: CWE-352)
The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action.
CVE-2015-9456 (severity: MEDIUM, weakness: CWE-732)
The orbisius-child-theme-creator plugin before 1.2.8 for WordPress has incorrect access control for file modification via the wp-admin/admin-ajax.php?action=orbisius_ctc_theme_editor_ajax&sub_cmd=save_file theme_1, theme_1_file, or theme_1_file_contents parameter.
CVE-2015-9457 (severity: HIGH, weakness: CWE-89)
The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter.
CVE-2015-9458 (severity: HIGH, weakness: CWE-89)
The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pk_stt2_db_get_popular_terms count parameter exploitable via CSRF.
CVE-2015-9459 (severity: MEDIUM, weakness: CWE-79)
The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.
CVE-2015-9460 (severity: HIGH, weakness: CWE-89)
The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter.
CVE-2015-9461 (severity: HIGH, weakness: CWE-89)
The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_portfolio_item_page SQL injection via the item_id parameter.
CVE-2015-9462 (severity: HIGH, weakness: CWE-89)
The awesome-filterable-portfolio plugin before 1.9 for WordPress has afp_get_new_category_page SQL injection via the cat_id parameter.
CVE-2015-9463 (severity: HIGH, weakness: CWE-22)
The s3bubble-amazon-s3-audio-streaming plugin 2.0 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.
CVE-2015-9464 (severity: HIGH, weakness: CWE-22)
The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter.
CVE-2015-9465 (severity: HIGH, weakness: CWE-89)
The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id parameter.
CVE-2015-9466 (severity: CRITICAL, weakness: CWE-89)
The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTP_FORWARDED_FOR, or HTTP_FORWARDED variable.
CVE-2015-9467 (severity: CRITICAL, weakness: CWE-89)
The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter.
CVE-2015-9468 (severity: MEDIUM, weakness: CWE-79)
The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action.
CVE-2015-9469 (severity: MEDIUM, weakness: CWE-79)
The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id.
CVE-2015-9470 (severity: HIGH, weakness: CWE-22)
The history-collection plugin through 1.1.1 for WordPress has directory traversal via the download.php var parameter.
CVE-2015-9471 (severity: CRITICAL, weakness: CWE-434)
The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload.
CVE-2015-9472 (severity: MEDIUM, weakness: CWE-79)
The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header.
CVE-2015-9473 (severity: HIGH, weakness: CWE-22)
The estrutura-basica theme through 2015-09-13 for WordPress has directory traversal via the scripts/download.php arquivo parameter.
CVE-2015-9474 (severity: HIGH, weakness: CWE-276)
The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates.
CVE-2015-9475 (severity: HIGH, weakness: CWE-276)
The Pont theme 1.5 for WordPress has insufficient restrictions on option updates.
CVE-2015-9476 (severity: HIGH, weakness: CWE-276)
The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates.
CVE-2015-9477 (severity: HIGH, weakness: CWE-276)
The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates.
CVE-2015-9478 (severity: MEDIUM, weakness: CWE-79)
prettyPhoto before 3.1.6 has js/jquery.prettyPhoto.js XSS.
CVE-2015-9479 (severity: CRITICAL, weakness: CWE-434)
The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php.
CVE-2015-9480 (severity: HIGH, weakness: CWE-22)
The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter.
CVE-2015-9481 (severity: HIGH, weakness: CWE-200)
The ThemeMakers Diplomat | Political theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
CVE-2015-9482 (severity: HIGH, weakness: CWE-200)
The ThemeMakers Car Dealer / Auto Dealer Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
CVE-2015-9483 (severity: HIGH, weakness: CWE-200)
The ThemeMakers Invento Responsive Gallery/Architecture Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
CVE-2015-9484 (severity: HIGH, weakness: CWE-200)
The ThemeMakers Accio One Page Parallax Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
CVE-2015-9485 (severity: HIGH, weakness: CWE-200)
The ThemeMakers Accio Responsive Parallax One Page Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
CVE-2015-9486 (severity: HIGH, weakness: CWE-200)
The ThemeMakers Axioma Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
CVE-2015-9487 (severity: HIGH, weakness: CWE-200)
The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
CVE-2015-9488 (severity: HIGH, weakness: CWE-200)
The ThemeMakers Almera Responsive Portfolio Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
CVE-2015-9489 (severity: HIGH, weakness: CWE-200)
The ThemeMakers Goodnex Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
CVE-2015-9490 (severity: HIGH, weakness: CWE-200)
The ThemeMakers GamesTheme Premium theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
CVE-2015-9491 (severity: HIGH, weakness: CWE-200)
The ThemeMakers Blessing Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
CVE-2015-9492 (severity: HIGH, weakness: CWE-200)
The ThemeMakers SmartIT Premium Responsive theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
CVE-2015-9493 (severity: MEDIUM, weakness: CWE-79)
The my-wish-list plugin before 1.4.2 for WordPress has multiple XSS issues.
CVE-2015-9494 (severity: MEDIUM, weakness: CWE-79)
The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier.
CVE-2015-9495 (severity: MEDIUM, weakness: CWE-79)
The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier.
CVE-2015-9496 (severity: HIGH, weakness: CWE-89)
The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FM_form id=' substring.
CVE-2015-9497 (severity: HIGH, weakness: CWE-352)
The ad-inserter plugin before 1.5.3 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=ad-inserter.php.
CVE-2015-9498 (severity: HIGH, weakness: CWE-352)
The wps-hide-login plugin before 1.1 for WordPress has CSRF that affects saving an option value.
CVE-2015-9499 (severity: CRITICAL, weakness: CWE-434)
The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive.
CVE-2015-9500 (severity: MEDIUM, weakness: CWE-79)
The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js.
CVE-2015-9501 (severity: MEDIUM, weakness: CWE-79)
The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web root.
CVE-2015-9502 (severity: MEDIUM, weakness: CWE-79)
The Auberge theme before 1.4.5 for WordPress has XSS via the genericons/example.html anchor identifier.
CVE-2015-9503 (severity: MEDIUM, weakness: CWE-79)
The Modern theme before 1.4.2 for WordPress has XSS via the genericons/example.html anchor identifier.
CVE-2015-9504 (severity: MEDIUM, weakness: CWE-79)
The weeklynews theme before 2.2.9 for WordPress has XSS via the s parameter.
CVE-2015-9505 (severity: MEDIUM, weakness: CWE-79)
The Easy Digital Downloads (EDD) core component 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7 for WordPress has XSS because add_query_arg is misused.
CVE-2015-9506 (severity: MEDIUM, weakness: CWE-79)
The Easy Digital Downloads (EDD) Amazon S3 extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.