CVE-2019-15771

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The nd-shortcodes plugin before 6.0 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Aug 29, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-157726.1The nd-donations plugin before 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-157736.1The nd-travel plugin before 1.7 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-157746.1The nd-booking plugin before 2.5 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-157756.1The nd-learning plugin before 4.8 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.CVE-2019-157766.1The simple-301-redirects-addon-bulk-uploader plugin before 1.2.5 for WordPress has no protection against 301 redirect rule injection via a CCVE-2019-157775.4The shapepress-dsgvo plugin before 2.2.19 for WordPress has wp-admin/admin-ajax.php?action=admin-common-settings&admin_email= XSS.CVE-2019-157785.4The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS.CVE-2019-157798.8The insta-gallery plugin before 2.4.8 for WordPress has no nonce validation for qligg_dismiss_notice or qligg_form_item_delete.CVE-2019-15786.1Cross-site scripting vulnerability in Palo Alto Networks MineMeld version 0.9.60 and earlier may allow a remote attacker able to convince anCVE-2019-157809.8The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.CVE-2019-157818.8The facebook-by-weblizar plugin before 2.8.5 for WordPress has CSRF.CVE-2019-157826.1WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name.
CVE-2019-15771: Medium severity, CVSS 6.1 | Vulnix