VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

36,919 total · sorted by risk
  • CVE-2010-4839Sep 14, 2011
    WordPress
    Event Registration
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the event_id parameter in a register action.

  • CVE-2010-4747Mar 1, 2011
    WordPress
    Processing Embed
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pluginurl parameter.

  • CVE-2011-1047Feb 21, 2011
    Vasthtml
    Forum Server
    risk 0.03cvss —epss 0.05

    Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) search_max parameter in a search action to index.php, which is not properly handled by…

  • CVE-2010-4518Dec 9, 2010
    WordPress
    Safe Search
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the v1 parameter.

  • CVE-2010-3977Nov 3, 2010
    WordPress
    cforms
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.

  • CVE-2010-2924Jul 30, 2010
    WordPress
    Mylinksdump
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the url parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-1186Apr 7, 2010
    WordPress
    Nextgen Gallery
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.

  • CVE-2010-0673Feb 22, 2010
    Copperleaf
    Photolog
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress allows remote attackers to execute arbitrary SQL commands via the postid parameter.

  • CVE-2009-4424Dec 28, 2009
    WordPress
    Pyrmont
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-3703Dec 18, 2009
    WordPress
    Wp Forum
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the forum parameter to an…

  • CVE-2009-4168Dec 2, 2009
    Joomla
    Joomulus
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags…

  • CVE-2008-7216Sep 11, 2009
    WordPress
    Peter's Math Anti-Spam Spinoff
    risk 0.03cvss —epss 0.06

    Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortion, which allows remote attackers to bypass CAPTCHA protection by reading certain bytes from the generated clip.

  • CVE-2008-7040Aug 24, 2009
    WordPress
    Yellow Swordfish Simple Forum
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in ahah/sf-profile.php in the Yellow Swordfish Simple Forum module for Wordpress allows remote attackers to execute arbitrary SQL commands via the u parameter. NOTE: this issue was disclosed by an unreliable researcher, so the details might be…

  • CVE-2009-2852Aug 18, 2009
    WordPress
    Wp Syntax
    risk 0.03cvss —epss 0.05

    WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_head] array parameter to test/index.php, which is used in a call to the call_user_func_array function.

  • CVE-2009-2602Jul 27, 2009
    WordPress
    R2 Newsletter
    risk 0.03cvss —epss 0.02

    R2 Newsletter Lite, Pro, and Stats stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for admin.mdb.

  • CVE-2009-2335Jul 10, 2009
    WordPress
    WordPress
    risk 0.03cvss —epss 0.85

    WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue,…

  • CVE-2009-2383Jul 8, 2009
    WordPress
    Related Sites
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in BTE_RW_webajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the guid parameter.

  • CVE-2009-2308Jul 2, 2009
    Punres
    Affiliates Mod
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier for PunBB allow remote attackers to execute arbitrary SQL commands via the (1) in or (2) out parameter.

  • CVE-2009-2154Jun 22, 2009
    Sappy.dk
    Impleo Music Collection
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/login.php in Impleo Music Collection 2.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2009-2122Jun 19, 2009
    WordPress
    Photoracer
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-1030Mar 20, 2009
    WordPress
    WordPress
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU (WPMU) before 2.7 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.

  • CVE-2009-0968Mar 19, 2009
    WordPress
    fMoblog
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. NOTE: some of these details are obtained from third party information.

  • CVE-2008-6438Mar 6, 2009
    WordPress
    Macguru Blog Engine
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the uid parameter, a different vector than CVE-2008-2455. NOTE: it was later reported that 2.1.4 is also…

  • CVE-2008-6181Feb 19, 2009
    WordPress
    Com Mad4joomla
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Mad4Joomla Mailforms (com_mad4joomla) component before 1.1.8.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the jid parameter to index.php.

  • CVE-2008-5752Dec 30, 2008
    WordPress
    Page Flip Image Gallery Plugin
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the book_id parameter. NOTE: some of these details…

  • CVE-2008-4786Oct 29, 2008
    WordPress
    Easyshop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in easyshop.php in the EasyShop plugin for e107 allows remote attackers to execute arbitrary SQL commands via the category_id parameter.

  • CVE-2008-4732Oct 24, 2008
    WordPress
    WP Comment Remix
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in ajax_comments.php in the WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the p parameter.

  • CVE-2008-4625Oct 21, 2008
    WordPress
    stnl_iframe.php
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in stnl_iframe.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter, a different vector than CVE-2008-0683.

  • CVE-2008-2510May 29, 2008
    WordPress
    Upload File Plugin
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in wp-uploadfile.php in the Upload File plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the f_id parameter.

  • CVE-2008-2455May 27, 2008
    WordPress
    Macguru Blog Engine
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in comment.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the rid parameter.

  • CVE-2008-1982Apr 27, 2008
    WordPress
    Wpss
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in ss_load.php in the Spreadsheet (wpSS) 0.6 and earlier plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the ss_id parameter.

  • CVE-2008-1646Apr 2, 2008
    WordPress
    Wp Download
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in wp-download.php in the WP-Download 1.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the dl_id parameter.

  • CVE-2008-1304Mar 12, 2008
    WordPress
    WordPress
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) inviteemail parameter in an invite action to wp-admin/users.php and the (2) to parameter in a sent action to wp-admin/invites.php.

  • CVE-2008-0939Feb 25, 2008
    WordPress
    Wp Photo Album Plus
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in wppa.php in the WP Photo Album (WPPA) before 1.1 plugin for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the photo parameter to index.php, used by the wppa_photo_name function; or (2) the album parameter to…

  • CVE-2008-0845Feb 20, 2008
    WordPress
    WP-People
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the person parameter.

  • CVE-2008-0682Feb 12, 2008
    WordPress
    Wordspew
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in wordspew-rss.php in the Wordspew plugin before 3.72 for Wordpress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-0691Feb 12, 2008
    WordPress
    Wp Footnotes
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in admin_panel.php in the Simon Elvery WP-Footnotes 2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) wp_footnotes_current_settings[priority], (2)…

  • CVE-2008-0683Feb 12, 2008
    WordPress
    ShiftThis Newsletter
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in shiftthis-preview.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter.

  • CVE-2008-0616Feb 6, 2008
    WordPress
    DMSGuestbook
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in the administration panel in the DMSGuestbook 1.7.0 plugin for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors. NOTE: it is not clear whether this issue crosses privilege boundaries.

  • CVE-2008-0507Jan 31, 2008
    WordPress
    AdServe 0.2
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in adclick.php in the AdServe 0.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-0520Jan 31, 2008
    WordPress
    Wassup Plugin
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) from_date or (2) to_date parameter to spy.php.

  • CVE-2008-0491Jan 30, 2008
    WordPress
    fGallery
    risk 0.03cvss —epss 0.06

    SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the album parameter.

  • CVE-2008-0490Jan 30, 2008
    WordPress
    Wp Cal Plugin
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in functions/editevent.php in the WP-Cal 0.3 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-0388Jan 23, 2008
    WordPress
    Wp Forum
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in the WP-Forum 1.7.4 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the user parameter in a showprofile action to the default URI.

  • CVE-2008-0193Jan 10, 2008
    WordPress
    WordPress
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php.

  • CVE-2007-5229Oct 5, 2007
    Feedburner
    Feedsmith
    risk 0.03cvss —epss 0.05

    Cross-site request forgery (CSRF) vulnerability in the FeedBurner FeedSmith 2.2 plugin for WordPress allows remote attackers to change settings and hijack blog feeds via a request to wp-admin/options-general.php that submits parameter values to FeedBurner_FeedSmith_Plugin.php,…

  • CVE-2007-4482Aug 22, 2007
    WordPress
    Pool
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in index.php in the Pool 1.0.7 theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF).

  • CVE-2007-4104Jul 31, 2007
    WordPress
    WP-FeedStats
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, one of which involves an rss2 feed with an invalid or missing blog with an XSS sequence…

  • CVE-2007-2821May 22, 2007
    WordPress
    WordPress
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via the cookie parameter.

  • CVE-2007-2757May 18, 2007
    Dean J Robinson
    Redoable
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in Redoable 1.2 allow remote attackers to inject arbitrary web script or HTML via the s parameter to (1) wp-content/themes/redoable/searchloop.php or (2) wp-content/themes/redoable/header.php.

Page 697 of 739