VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

36,919 total · sorted by risk
  • CVE-2014-3210May 22, 2014
    WordPress
    Booking System
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the booking_form_id parameter to wp-admin/admin-ajax.php.

  • CVE-2013-1765May 14, 2014
    WordPress
    smart-flv
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in jwplayer.swf in the smart-flv plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) link or (2) playerready parameter.

  • CVE-2014-2340Apr 3, 2014
    Xcloner
    Xcloner
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that create website backups via a request to wp-admin/plugins.php.

  • CVE-2013-4240Apr 2, 2014
    WordPress
    HMS Testimonials
    risk 0.03cvss —epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add new testimonials via the hms-testimonials-addnew page, (2) add…

  • CVE-2013-1408Mar 24, 2014
    WordPress
    Wysija Newsletters
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search or (2) orderby parameter to wp-admin/admin.php. NOTE: this can be leveraged using…

  • CVE-2014-2586Mar 24, 2014
    McAfee
    Cloud Single Sign On
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote attackers to inject arbitrary web script or HTML via a crafted password.

  • CVE-2014-1906Mar 6, 2014
    Videowhisper
    Videowhisper Live Streaming Integration
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n…

  • CVE-2013-1409Mar 3, 2014
    Commentluv
    Commentluv
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _ajax_nonce parameter to wp-admin/admin-ajax.php.

  • CVE-2014-1854Feb 27, 2014
    WordPress
    Adrotate
    risk 0.03cvss —epss 0.06

    SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.

  • CVE-2013-7319Feb 6, 2014
    WordPress
    Download Manager
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in the Download Manager plugin before 2.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title field.

  • CVE-2013-1852Feb 5, 2014
    WordPress
    LeagueManager
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the league_id parameter in the leaguemanager-export page to wp-admin/admin.php.

  • CVE-2012-6624Jan 16, 2014
    WordPress
    Soundcloud Is Gold
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the SoundCloud Is Gold plugin 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter in a soundcloud_is_gold_player_preview action to wp-admin/admin-ajax.php.

  • CVE-2013-7233Dec 30, 2013
    WordPress
    WordPress
    risk 0.03cvss —epss 0.04

    Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list.

  • CVE-2013-7187Dec 20, 2013
    WordPress
    Formcraft
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2013-6797Nov 19, 2013
    Sunil Nanda
    Blue Wrench Video Widget
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bw_url parameter…

  • CVE-2013-5977Nov 1, 2013
    Cart66
    Cart66 Lite Plugin
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that (1) create or modify products or conduct cross-site scripting…

  • CVE-2013-5961Sep 30, 2013
    WordPress
    Lazy SEO
    risk 0.03cvss —epss 0.05

    Unrestricted file upload vulnerability in lazyseo.php in the Lazy SEO plugin 1.1.9 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in lazy-seo/.

  • CVE-2013-5917Sep 23, 2013
    WordPress
    NOSpam PTI
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the comment_post_ID parameter.

  • CVE-2013-5672Sep 10, 2013
    Indianic
    Testimonial Plugin
    risk 0.03cvss —epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add a testimonial via an iNIC_testimonial_save action; (2) add a listing…

  • CVE-2013-3532May 10, 2013
    Web Dorado
    Spider Video Player
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the theme parameter.

  • CVE-2013-3530May 10, 2013
    WordPress
    Spiffy XSPF Player
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in playlist.php in the Spiffy XSPF Player plugin 0.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the playlist_id parameter.

  • CVE-2013-3529May 10, 2013
    WordPress
    FuneralPress
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in user/obits.php in the WP FuneralPress plugin before 1.1.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) message, (2) photo-message, or (3) youtube-message parameter.

  • CVE-2012-6506Jan 24, 2013
    Zingiri
    Zingiri Web Shop
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in zing.inc.php or (2) notes parameter in fws/pages-front/onecheckout.php.

  • CVE-2012-6312Dec 11, 2012
    WordPress
    Video Lead Form
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php.

  • CVE-2012-5388Oct 24, 2012
    WordPress
    White Label CMS
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, a…

  • CVE-2012-5387Oct 24, 2012
    WordPress
    White Label CMS
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcms_o_developer_name…

  • CVE-2012-5350Oct 9, 2012
    WordPress
    Pay With Tweet
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in the Pay With Tweet plugin before 1.2 for WordPress allows remote authenticated users with certain permissions to execute arbitrary SQL commands via the id parameter in a paywithtweet shortcode.

  • CVE-2012-5349Oct 9, 2012
    WordPress
    Pay With Tweet
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in pay.php in the Pay With Tweet plugin before 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) link, (2) title, or (3) dl parameter.

  • CVE-2012-5346Oct 9, 2012
    WordPress
    WP Live.php
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in wp-live.php in the WP Live.php module 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2012-5229Oct 1, 2012
    WordPress
    Slideshow Gallery2
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in css/gallery-css.php in the Slideshow Gallery2 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the border parameter.

  • CVE-2011-5193Sep 23, 2012
    WordPress
    Whois Search
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enabled, allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php, a different…

  • CVE-2011-5182Sep 20, 2012
    WordPress
    Lanoba Social Plugin
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor disputes this issue, stating "Lanoba's plug in does…

  • CVE-2011-5180Sep 20, 2012
    Zooeffect
    Zooeffect
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in wp-1pluginjquery.php in the ZooEffect plugin 1.01 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information. NOTE: this…

  • CVE-2012-2917May 21, 2012
    WordPress
    Share and Follow
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key (cnd-key) in a share-and-follow-menu page to wp-admin/admin.php.

  • CVE-2012-2913May 21, 2012
    WordPress
    Leaflet
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) leaflet_layer.php or (2) leaflet_marker.php, as reachable through wp-admin/admin.php.

  • CVE-2011-4803Dec 14, 2011
    WordPress
    Wptouch
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in wptouch/ajax.php in the WPTouch plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2011-4673Dec 2, 2011
    WordPress
    Jetpack
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2011-4671Dec 2, 2011
    WordPress
    Adrotate
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8, for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter (aka redirect URL).

  • CVE-2010-4875Oct 7, 2011
    WordPress
    Vodpod Video Gallery
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gid parameter.

  • CVE-2011-3865Sep 28, 2011
    WordPress
    Black-LetterHead
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.

  • CVE-2011-3863Sep 28, 2011
    WordPress
    RedLine
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3862Sep 28, 2011
    WordPress
    Morning Coffee
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.

  • CVE-2011-3861Sep 28, 2011
    WordPress
    Web Minimalist 200901
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.

  • CVE-2011-3860Sep 28, 2011
    WordPress
    Cover WP
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3859Sep 28, 2011
    WordPress
    Trending
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.

  • CVE-2011-3858Sep 28, 2011
    WordPress
    Pixiv Custom
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3856Sep 28, 2011
    WordPress
    Elegant Grunge
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3855Sep 28, 2011
    WordPress
    F8 Lite
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3852Sep 28, 2011
    WordPress
    EvoLve
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the EvoLve theme before 1.2.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3850Sep 28, 2011
    WordPress
    Atahualpa
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Atahualpa theme before 3.6.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

Page 696 of 739