dwxsupport

Title	CVE ID	CVSS	Vector	Date
WP User Groups <= 2.1.0 - Cross-Site Request Forgery		8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	May 11, 2018
Quiz And Survey Master <= 4.7.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting	CVE-2016-11085	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	December 15, 2016
Private Only <= 3.5.1 - Multiple Cross-Site Request Forgery	CVE-2015-5483	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	August 26, 2015
BuddyPress Activity Plus <= 1.5 - Cross-Site Request Forgery	CVE-2015-9455	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	July 14, 2015
Theme My Login <= 6.3.9 - Local File Inclusion	CVE-2014-5155	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	June 30, 2014
Subscribe To Comments Reloaded <= 140129 - Cross-Site Request Forgery to Cross-Site Scripting	CVE-2014-2274	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	February 18, 2014
BP Group Documents <= 1.2.1 - Cross-Site Request Forgery		8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	October 4, 2013
Relevanssi <= 3.6.0 - Authenticated (Admin+) SQL Injection		8.7	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N	April 10, 2018
Image Slider < 1.1.90 - Arbitrary File Deletion		8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	December 23, 2016
WooCommerce <= 2.2.2 - Cross-Site Scripting via range Parameter	CVE-2014-6313	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	September 15, 2014
Tooltipy < 5.1 - Cross-Site Request Forgery	CVE-2018-1000505	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	June 20, 2018
iFrame <= 4.0 - Stored Cross-Site Scripting	CVE-2015-6738	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	August 10, 2015
Plotly <= 1.0.2 - Stored Cross-Site Scripting	CVE-2015-9347	6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	July 13, 2015
BP Group Documents <= 1.2.1 - Stored Cross-Site Scripting		6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	October 4, 2013
Content Audit <= 1.9.1 - Cross-Site Request Forgery to Cross-Site Scripting	CVE-2017-18560	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	September 26, 2017
iFrame <= 3.0 - Reflected Cross-Site Scripting	CVE-2015-6738	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	August 11, 2015
Improved User Search in Backend <= 1.2.5 - Cross-Site Request Forgery to Cross-Site Scripting	CVE-2014-5196	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	August 13, 2014
Twitget <= 3.3.2 - Stored Cross-Site Scripting	CVE-2014-2995	5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	April 11, 2014
BP Group Documents <= 1.2 - Stored Cross-Site Scripting		5.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	October 4, 2013
copy-me <= 1.0.0 - Missing Authorization & Cross-Site Request Forgery	CVE-2016-10938	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	December 21, 2016

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation