Vulnerabilities > Incsub > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-10-07 | CVE-2015-9455 | Cross-Site Request Forgery (CSRF) vulnerability in Incsub Buddypress-Activity-Plus The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action. | 7.8 |
| 2019-05-29 | CVE-2019-11872 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Incsub Hustle The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. | 8.8 |