Marcin Probola

The issue is related to a Cross-Site Scripting (XSS) vulnerability. It occurs via the `count` parameter in the `wp-admin/options-general.php` API endpoint. This allows for potential malicious script injection.

The issue concerns SQL injection via the `group` parameter in the `PrliLinksController::list links` function. This allows for potential exploitation. No information is provided about the estimated number of affected devices or real-world incidents.

The issue concerns SQL injection via the `url` parameter in the `wpslDelURL` or `wpslEditURL` functions. This allows for potential SQL injection attacks.

The issue concerns SQL injection via the `HTTP CLIENT IP`, `HTTP X FORWARDED FOR`, `HTTP X FORWARDED`, `HTTP FORWARDED FOR`, or `HTTP FORWARDED` variable in the WtiLikePostProcessVote function.

The issue is related to SQL injection via the `set id` parameter in the `yasr get multi set values and field` function. This allows for potential exploitation. No information is provided about the estimated number of affected devices or real-world incidents.

The issue is related to SQL injection via the `cat id` parameter in the `afp get new category page` function. This allows for potential exploitation. No information is provided about the estimated number of affected devices or real-world incidents.

The issue is related to a SQL injection vulnerability via the `item id` parameter in the `afp get new portfolio item page` function. This allows for potential exploitation.

The issue concerns a SQL injection vulnerability via the `language` parameter in the `DOPBSPBackEndTranslation::display` function. This allows for potential exploitation.

The issue concerns a cross-site scripting (XSS) flaw. It is triggered via the `page` parameter in a `delURL` action.

The issue concerns SQL Injection via the `current slider id` parameter in the `/wp-admin/admin.php?page=smooth-slider-admin` API endpoint. This allows for potential exploitation. No information is provided about the estimated number of affected devices or real-world incidents.

The issue allows for XSS via the HTTP Referer or User-Agent header to a URL that does not exist.

The issue concerns a Cross-Site Scripting (XSS) flaw. It is exploited via the `id` parameter in the "wp-admin/admin-ajax.php?action=get soundcloud player" API endpoint.

The issue allows for SQL Injection via the `account id` parameter in the "wp-admin/options-general.php?page=microblogposter.php" API endpoint.

The issue concerns a CSRF vulnerability that can lead to XSS. It is exploited via the "pubid" parameter in the "/wp-admin/options-general.php?page=addthis social widget" API endpoint.

The issue concerns a CSRF with resultant XSS. It is exploitable via the "page limit" parameter in the "/wp-admin/themes.php?page=dynwid-config" API endpoint.

The issue is related to a Cross-Site Scripting (XSS) vulnerability, which occurs via the User-Agent HTTP header. This allows for potential malicious script injection, affecting the security of the system.

The issue concerns a CSRF with resultant XSS in the manual-image-crop plugin for WordPress. This occurs via the "wp-admin/admin-ajax.php?action=mic editor window" API endpoint, specifically through the `postId` parameter.

The issue concerns a text SQL injection in the `wp-admin/post-new.php` page of the wordpress-meta-robots plugin for WordPress.

The issue concerns a SQL injection vulnerability in the gocodes plugin for WordPress, specifically affecting the `wp-admin/tools.php` endpoint with the `gcid` parameter. This allows for potential SQL injection attacks.