Search
Search Results (10 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-9990 | 2 Smackcoders, Wordpress | 2 Wordpress Helpdesk Integration, Wordpress | 2026-04-21 | 8.1 High |
| The WordPress Helpdesk Integration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.8.10 via the portal_type parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. | ||||
| CVE-2013-3264 | 1 Smackcoders | 1 Wp Ultimate Email Marketer Plugin | 2025-04-11 | N/A |
| The WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress does not properly restrict access to (1) list/edit.php and (2) campaign/editCampaign.php, which allows remote attackers to modify list or campaign data. | ||||
| CVE-2013-3263 | 1 Smackcoders | 1 Wp Ultimate Email Marketer Plugin | 2025-04-11 | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in the WP Ultimate Email Marketer plugin 1.1.0 and possibly earlier for Wordpress allow remote attackers to inject arbitrary web script or HTML via the (1) siteurl parameter to campaign/campaignone.php; the (2) action, (3) campaignname, (4) campaignformat, or (5) emailtemplate parameter to campaign/campaigntwo.php; the (6) listid parameter to list/edit.php; the (7) campaignid or (8) siteurl parameter to campaign/editcampaign.php; the (9) campaignid parameter to campaign/selectlistb4send.php; the (10) campaignid, (11) campaignname, (12) campaignsubject, or (13) selectedcampaigns parameter to campaign/sendCampaign.php; or the (14) campaignid, (15) campaignname, (16) campaignformat, or (17) action parameter to campaign/updatecampaign.php. | ||||
| CVE-2018-20968 | 1 Smackcoders | 1 Ultimate Exporter | 2024-11-21 | N/A |
| The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF. | ||||
| CVE-2018-20967 | 1 Smackcoders | 1 Import All Pages\, Post Types\, Products\, Orders\, And Users As Xml \& Csv | 2024-11-21 | N/A |
| The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF. | ||||
| CVE-2016-11000 | 1 Smackcoders | 1 Ultimate Exporter | 2024-11-21 | 9.8 Critical |
| The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter. | ||||
| CVE-2016-10985 | 1 Smackcoders | 1 Echo Sign | 2024-11-21 | 6.1 Medium |
| The echosign plugin before 1.2 for WordPress has XSS via the templates/add_templates.php id parameter. | ||||
| CVE-2016-10984 | 1 Smackcoders | 1 Echo Sign | 2024-11-21 | 6.1 Medium |
| The echosign plugin before 1.2 for WordPress has XSS via the inc.php page parameter. | ||||
| CVE-2015-9306 | 1 Smackcoders | 1 Import All Pages\, Post Types\, Products\, Orders\, And Users As Xml \& Csv | 2024-11-21 | N/A |
| The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS. | ||||
| CVE-2015-10125 | 1 Smackcoders | 1 Import All Pages\, Post Types\, Products\, Orders\, And Users As Xml \& Csv | 2024-11-21 | 4.3 Medium |
| A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able to address this issue. The identifier of the patch is 13c30af721d3f989caac72dd0f56cf0dc40fad7e. It is recommended to upgrade the affected component. The identifier VDB-241317 was assigned to this vulnerability. | ||||
Page 1 of 1.