VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

36,919 total · sorted by risk
  • CVE-2011-5107Aug 23, 2012
    WordPress
    Alert Before You Post
    risk 0.04cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in post_alert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter.

  • CVE-2011-5106Aug 23, 2012
    WordPress
    Flexible Custom Post Type
    risk 0.04cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2012-1835Aug 14, 2012
    WordPress
    All-in-One Event Calendar
    risk 0.04cvss —epss 0.09

    Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4)…

  • CVE-2012-2371Aug 13, 2012
    WordPress
    WP-FaceThumb
    risk 0.04cvss —epss 0.13

    Cross-site scripting (XSS) vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pagination_wp_facethumb parameter.

  • CVE-2012-3814Jun 27, 2012
    WordPress
    Font Uploader
    risk 0.04cvss —epss 0.10

    Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a .php.ttf extension, then accessing it via a direct request to the file in…

  • CVE-2012-3588Jun 19, 2012
    WordPress
    Plugin Newsletter Plugin
    risk 0.04cvss —epss 0.11

    Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter.

  • CVE-2012-3578Jun 17, 2012
    WordPress
    Fcchat Widget
    risk 0.04cvss —epss 0.08

    Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executable extension followed by a safe extension, then accessing it…

  • CVE-2012-3577Jun 17, 2012
    WordPress
    Nmedia Member Conversation
    risk 0.04cvss —epss 0.14

    Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in…

  • CVE-2012-3576Jun 16, 2012
    WordPress
    wpStoreCart
    risk 0.04cvss —epss 0.18

    Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in…

  • CVE-2012-3575Jun 16, 2012
    Rbx Gallery
    Rbx Gallery
    risk 0.04cvss —epss 0.15

    Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/rbxslider.

  • CVE-2012-3574Jun 16, 2012
    WordPress
    MM Forms Community
    risk 0.04cvss —epss 0.11

    Unrestricted file upload vulnerability in includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to…

  • CVE-2012-1011Feb 7, 2012
    WordPress
    Allwebmenus
    risk 0.04cvss —epss 0.09

    actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it…

  • CVE-2012-1010Feb 7, 2012
    WordPress
    Allwebmenus
    risk 0.04cvss —epss 0.09

    Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified…

  • CVE-2012-0901Jan 20, 2012
    WordPress
    YouSayToo
    risk 0.04cvss —epss 0.08

    Cross-site scripting (XSS) vulnerability in yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter.

  • CVE-2010-2050May 25, 2010
    Joomla
    MS Comment
    risk 0.04cvss —epss 0.13

    Directory traversal vulnerability in the Moron Solutions MS Comment (com_mscomment) component 0.8.0b for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2009-4672Mar 5, 2010
    WordPress
    WP-Lytebox
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pg parameter.

  • CVE-2009-4170Dec 2, 2009
    WordPress
    WP-Cumulus
    risk 0.04cvss —epss 0.06

    WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.php, probably without parameters, which reveals the installation path in an error message.

  • CVE-2009-2334Jul 10, 2009
    WordPress
    WordPress
    risk 0.04cvss —epss 0.06

    wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify…

  • CVE-2008-6811May 18, 2009
    WordPress
    e-Commerce Plugin
    risk 0.04cvss —epss 0.07

    Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in…

  • CVE-2008-4769Oct 28, 2008
    WordPress
    WordPress
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php. NOTE: some of these details…

  • CVE-2008-4616Oct 20, 2008
    WordPress
    Spambam Plugin
    risk 0.04cvss —epss 0.07

    The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to calculate a shared key.

  • CVE-2008-3362Jul 30, 2008
    Giulio Ganci
    Wp Downloads Manager
    risk 0.04cvss —epss 0.17

    Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the upfile parameter, then accessing it via a direct…

  • CVE-2008-1061Feb 28, 2008
    WordPress
    Sniplets
    risk 0.04cvss —epss 0.07

    Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to (a) warning.php, (b) notice.php, and (c) inset.php in view/sniplets/, and possibly…

  • CVE-2008-0222Jan 10, 2008
    WordPress
    Filemanager
    risk 0.04cvss —epss 0.08

    Unrestricted file upload vulnerability in ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for WordPress allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors.

  • CVE-2007-6369Dec 15, 2007
    WordPress
    Pictpress
    risk 0.04cvss —epss 0.08

    Multiple directory traversal vulnerabilities in resize.php in the PictPress 0.91 and earlier plugin for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) size or (2) path parameter.

  • CVE-2007-6318Dec 12, 2007
    WordPress
    WordPress
    risk 0.04cvss —epss 0.09

    SQL injection vulnerability in wp-includes/query.php in WordPress 2.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the s parameter, when DB_CHARSET is set to (1) Big5, (2) GBK, or possibly other character set encodings that support a "\" in a…

  • CVE-2007-5710Oct 30, 2007
    WordPress
    WordPress
    risk 0.04cvss —epss 0.07

    Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inject arbitrary web script or HTML via the posts_columns array parameter.

  • CVE-2007-3140Jun 8, 2007
    WordPress
    WordPress
    risk 0.04cvss —epss 0.07

    SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a parameter value in an XML RPC wp.suggestCategories methodCall, a different vector than CVE-2007-1897.

  • CVE-2007-2714May 16, 2007
    Matt Mullenweg
    Akismet
    risk 0.04cvss —epss 0.11

    Unspecified vulnerability in akismet.php in Matt Mullenweg Akismet before 2.0.2, a WordPress plugin, has unknown impact and attack vectors.

  • CVE-2007-2482May 3, 2007
    WordPress
    wordTube
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in wordtube-button.php in the wordTube 1.43 and earlier plugin for WordPress, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the wpPATH parameter.

  • CVE-2007-2483May 3, 2007
    WordPress
    wp-Table
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the wpPATH parameter.

  • CVE-2007-0233Jan 13, 2007
    WordPress
    WordPress
    risk 0.04cvss —epss 0.12

    wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the tb_id…

  • CVE-2006-4208Aug 17, 2006
    WordPress
    Wp Db Backup
    risk 0.04cvss —epss 0.12

    Directory traversal vulnerability in wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier allows remote authenticated users with administrative privileges to read arbitrary files via a .. (dot dot) in the backup parameter to edit.php.

  • CVE-2005-2108Jul 5, 2005
    WordPress
    WordPress
    risk 0.04cvss —epss 0.09

    SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTP_RAW_POST_DATA variable, which stores the data in an XML file.

  • CVE-2004-1584Dec 31, 2004
    WordPress
    WordPress
    risk 0.04cvss —epss 0.11

    CRLF injection vulnerability in wp-login.php in WordPress 1.2 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the text parameter.

  • CVE-2004-1559Dec 31, 2004
    WordPress
    WordPress
    risk 0.04cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, text, popupurl, or popuptitle parameters to wp-login.php, (2) redirect_url parameter to admin-header.php, (3) popuptitle,…

  • CVE-2018-8729MedMar 15, 2018
    WordPress
    Activity Log
    risk 0.03cvss 6.1epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.

  • CVE-2015-6965Sep 16, 2015
    WordPress
    Contact Form Generator
    risk 0.03cvss —epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) create a field, (2) update a field, (3) delete a field, (4)…

  • CVE-2015-6805Sep 2, 2015
    WordPress
    MDC Private Message
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the message field in a private message.

  • CVE-2015-2321Aug 13, 2015
    WordPress
    Job Manager
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the email field.

  • CVE-2015-4465Jun 10, 2015
    WordPress
    zM Ajax Login & Register
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-8607Jun 10, 2015
    Xcloner
    Xcloner
    risk 0.03cvss —epss 0.01

    The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information via the ps command.

  • CVE-2014-8606Jun 10, 2015
    Xcloner
    Xcloner
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. (dot dot) in the file parameter in a json_return action in the xcloner_show page to wp-admin/admin-ajax.php.

  • CVE-2014-8603Jun 10, 2015
    Xcloner
    Xcloner
    risk 0.03cvss —epss 0.06

    cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the (1) file name when creating a backup or vectors related to the (2) $_CONFIG[tarpath], (3) $exclude, (4)…

  • CVE-2015-4084May 28, 2015
    Free Counter
    Free Counter
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value_ parameter in a check_stat action to wp-admin/admin-ajax.php.

  • CVE-2015-4066May 27, 2015
    WordPress
    GigPress
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) show_artist_id or (2) show_venue_id parameter in an add action in the gigpress.php page…

  • CVE-2015-4065May 27, 2015
    WordPress
    Landing Pages
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php.

  • CVE-2015-4064May 27, 2015
    WordPress
    Landing Pages
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php.

  • CVE-2015-4063May 27, 2015
    WordPress
    Newstatpress
    risk 0.03cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp_search page to wp-admin/admin.php.

  • CVE-2015-4018May 21, 2015
    WordPress
    FeedWordPress
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the link_ids[] parameter in an Update action in the syndication.php page to…

Page 694 of 739