CVE-2019-15858

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Sep 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-158599.8Password disclosure in the web interface on socomec DIRIS A-40 devices before 48250501 allows a remote attacker to get full access to a devi CVE-2019-15864.6A vulnerability in Cisco Application Policy Infrastructure Controller (APIC) Software could allow an unauthenticated, local attacker with ph CVE-2019-158605.5Xpdf 2.00 allows a SIGSEGV in XRef::constructXRef in XRef.cc. NOTE: 2.00 is a version from November 2002.CVE-2019-158627.5An issue was discovered in CKFinder through 2.6.2.1. Improper checks of file names allows remote attackers to upload files without any exten CVE-2019-158637.5The ConvertPlus plugin before 3.4.5 for WordPress has an unintended account creation (with the none role) via a request for variants.CVE-2019-158646.1The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.CVE-2019-158658.8The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has CSRF.CVE-2019-158668.8The crelly-slider plugin before 1.3.5 for WordPress has arbitrary file upload via a PHP file inside a ZIP archive to wp_ajax_crellyslider_im CVE-2019-158678.8The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for the slickpopupteam account, after a Subscriber ca CVE-2019-158688.8The affiliates-manager plugin before 2.6.6 for WordPress has CSRF.CVE-2019-158695.4The JobCareer theme before 2.5.1 for WordPress has stored XSS.CVE-2019-15874.3A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated, re