webmaster-source vulnerabilities

Products

• gocodes 2
• wp125 1

Latest webmaster-source CVEs

Newest publication first

1. CVE-2015-9398 The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.

   Published 2019-09-20

   High·CVSS 8.8

   The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection.

2. CVE-2015-9397 GoCodes <= 1.3.5 - Cross-Site Scripting

   Published 2019-09-20

   Medium·CVSS 5.4

   The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.

3. CVE-2013-2700 Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125 plugin before 1.5.0 for WordPress allows remote attackers to hijack the authentication of administrat...

   Published 2014-05-14

   Medium·CVSS 6.8

   Cross-site request forgery (CSRF) vulnerability in the Add/Edit page (adminmenus.php) in the WP125 plugin before 1.5.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that add or edit an ad via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.