Reflected XSS in iframe allows unauthenticated users to do almost anything an admin can
Severity: Medium
Advisories
Stored XSS in iframe allows less privileged users to do almost anything an admin can
Severity: Medium
Full Path Disclosure vulnerability in JM Twitter Cards reveals the location of the WordPress installation on the server
Severity: Medium
Reflected XSS in Flickr Justified Gallery could allows unauthenticated attackers to do almost anything an admin can do
Severity: Medium
The OAuth2 Complete plugin for WordPress uses a pseudorandom number generator which is non-cryptographically secure
Severity: High
Stored XSS in Google Analytics by Yoast Premium allows privileged users to attack other users
Severity: Medium
Blind SQL Injection in WP Symposium allows unauthenticated attackers to access sensitive data
Severity: Medium
Comment form CSRF in WordPress 4.2.2 allows admin impersonation via comments
Severity: Medium
CSRF and arbitrary file deletion in BuddyPress Activity Plus 1.5
Severity: High
Admin-only local file inclusion and arbitrary code execution in Subscribe to Comments 2.1.2
Severity: High