VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

37,946 total · sorted by risk
  • CVE-2014-5465Sep 3, 2014
    WordPress
    Download Shortcode
    risk 0.04cvss —epss 0.14

    Directory traversal vulnerability in force-download.php in the Download Shortcode plugin 0.2.3 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

  • CVE-2014-5337Aug 29, 2014
    WordPress
    Wordpress Mobile Pack
    risk 0.04cvss —epss 0.17

    The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php.

  • CVE-2012-6653Aug 6, 2014
    WordPress
    All Video Gallery
    risk 0.04cvss —epss 0.07

    Unspecified vulnerability in the All Video Gallery (all-video-gallery) plugin before 1.2.0 for WordPress has unspecified impact and attack vectors.

  • CVE-2014-4940Jul 11, 2014
    WordPress
    Tera Charts
    risk 0.04cvss —epss 0.19

    Multiple directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the fn parameter to (1) charts/treemap.php or (2) charts/zoomabletreemap.php.

  • CVE-2014-4937Jul 11, 2014
    WordPress
    BookX
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in includes/bookx_export.php BookX plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

  • CVE-2014-3848May 23, 2014
    Imember360
    Imember360
    risk 0.04cvss —epss 0.09

    The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database credentials via the i4w_dbinfo parameter.

  • CVE-2014-1907Mar 6, 2014
    Videowhisper
    Videowhisper Live Streaming Integration
    risk 0.04cvss —epss 0.11

    Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a ..…

  • CVE-2013-7102Dec 23, 2013
    Optimizepress
    Optimizepress
    risk 0.04cvss —epss 0.15

    Multiple unrestricted file upload vulnerabilities in (1) media-upload.php, (2) media-upload-lncthumb.php, and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file…

  • CVE-2013-5962Sep 30, 2013
    WordPress
    Complete Gallery Manager
    risk 0.04cvss —epss 0.15

    Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct…

  • CVE-2013-5673Sep 10, 2013
    Indianic
    Testimonial Plugin
    risk 0.04cvss —epss 0.07

    SQL injection vulnerability in testimonial.php in the IndiaNIC Testimonial plugin 2.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the custom_query parameter in a testimonial_add action to wp-admin/admin-ajax.php.

  • CVE-2013-4625Aug 9, 2013
    WordPress
    Duplicator
    risk 0.04cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter.

  • CVE-2013-4117Jul 16, 2013
    WordPress
    Category Grid View Gallery
    risk 0.04cvss —epss 0.13

    Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter.

  • CVE-2013-3526May 10, 2013
    WordPress
    Traffic Analyzer
    risk 0.04cvss —epss 0.14

    Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the aoid parameter.

  • CVE-2013-1464Feb 7, 2013
    WordPress
    Audio Player
    risk 0.04cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in assets/player.swf in the Audio Player plugin before 2.0.4.6 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the playerID parameter.

  • CVE-2013-1463Feb 7, 2013
    WordPress
    WP-Table Reloaded
    risk 0.04cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module before 1.9.4 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this might be the same vulnerability as…

  • CVE-2011-4618Jan 24, 2013
    WordPress
    Advanced Text Widget
    risk 0.04cvss —epss 0.10

    Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2012-6499Jan 12, 2013
    Age Verification Project
    Age Verification
    risk 0.04cvss —epss 0.11

    Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_to parameter.

  • CVE-2012-6313Dec 11, 2012
    WordPress
    Simple Gmail Login
    risk 0.04cvss —epss 0.08

    simple-gmail-login.php in the Simple Gmail Login plugin before 1.1.4 for WordPress allows remote attackers to obtain sensitive information via a request that lacks a timezone, leading to disclosure of the installation path in a stack trace.

  • CVE-2012-5913Nov 17, 2012
    WordPress
    WordPress Integrator
    risk 0.04cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter to wp-login.php.

  • CVE-2011-4342Oct 8, 2012
    Backwpup
    Backwpup
    risk 0.04cvss —epss 0.11

    PHP remote file inclusion vulnerability in wp_xml_export.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the wpabs parameter.

  • CVE-2012-5318Oct 8, 2012
    WordPress
    Kish Guest Posting
    risk 0.04cvss —epss 0.07

    Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the…

  • CVE-2012-4242Oct 1, 2012
    WordPress
    MF Gig Calendar
    risk 0.04cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page.

  • CVE-2011-5181Sep 20, 2012
    WordPress
    ClickDesk Live Support - Live Chat
    risk 0.04cvss —epss 0.10

    Cross-site scripting (XSS) vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cdwidgetid parameter. NOTE: some of these details are obtained from third party…

  • CVE-2011-4926Aug 29, 2012
    WordPress
    Adminimize
    risk 0.04cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in adminimize/adminimize_page.php in the Adminimize plugin before 1.7.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

  • CVE-2011-5107Aug 23, 2012
    WordPress
    Alert Before You Post
    risk 0.04cvss —epss 0.09

    Cross-site scripting (XSS) vulnerability in post_alert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter.

  • CVE-2011-5106Aug 23, 2012
    WordPress
    Flexible Custom Post Type
    risk 0.04cvss —epss 0.11

    Cross-site scripting (XSS) vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2012-1835Aug 14, 2012
    WordPress
    All-in-One Event Calendar
    risk 0.04cvss —epss 0.09

    Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4)…

  • CVE-2012-2371Aug 13, 2012
    WordPress
    WP-FaceThumb
    risk 0.04cvss —epss 0.13

    Cross-site scripting (XSS) vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pagination_wp_facethumb parameter.

  • CVE-2012-3814Jun 27, 2012
    WordPress
    Font Uploader
    risk 0.04cvss —epss 0.10

    Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a .php.ttf extension, then accessing it via a direct request to the file in…

  • CVE-2012-3588Jun 19, 2012
    WordPress
    Plugin Newsletter Plugin
    risk 0.04cvss —epss 0.11

    Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter.

  • CVE-2012-3578Jun 17, 2012
    WordPress
    Fcchat Widget
    risk 0.04cvss —epss 0.08

    Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executable extension followed by a safe extension, then accessing it…

  • CVE-2012-3577Jun 17, 2012
    WordPress
    Nmedia Member Conversation
    risk 0.04cvss —epss 0.14

    Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in…

  • CVE-2012-3576Jun 16, 2012
    WordPress
    Wpstorecart
    risk 0.04cvss —epss 0.18

    Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in…

  • CVE-2012-3575Jun 16, 2012
    Rbx Gallery
    Rbx Gallery
    risk 0.04cvss —epss 0.15

    Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/rbxslider.

  • CVE-2012-3574Jun 16, 2012
    WordPress
    MM Forms Community
    risk 0.04cvss —epss 0.11

    Unrestricted file upload vulnerability in includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to…

  • CVE-2012-1011Feb 7, 2012
    WordPress
    Allwebmenus
    risk 0.04cvss —epss 0.09

    actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it…

  • CVE-2012-1010Feb 7, 2012
    WordPress
    Allwebmenus
    risk 0.04cvss —epss 0.09

    Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified…

  • CVE-2012-0901Jan 20, 2012
    WordPress
    YouSayToo
    risk 0.04cvss —epss 0.07

    Cross-site scripting (XSS) vulnerability in yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter.

  • CVE-2010-2050May 25, 2010
    Joomla
    MS Comment
    risk 0.04cvss —epss 0.13

    Directory traversal vulnerability in the Moron Solutions MS Comment (com_mscomment) component 0.8.0b for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

  • CVE-2009-4672Mar 5, 2010
    WordPress
    WP-Lytebox
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pg parameter.

  • CVE-2009-4170Dec 2, 2009
    WordPress
    WP-Cumulus
    risk 0.04cvss —epss 0.06

    WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.php, probably without parameters, which reveals the installation path in an error message.

  • CVE-2009-2334Jul 10, 2009
    WordPress
    WordPress
    risk 0.04cvss —epss 0.06

    wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify…

  • CVE-2008-6811May 18, 2009
    WordPress
    e-Commerce Plugin
    risk 0.04cvss —epss 0.07

    Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in…

  • CVE-2008-4769Oct 28, 2008
    WordPress
    WordPress
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php. NOTE: some of these details…

  • CVE-2008-4616Oct 20, 2008
    WordPress
    Spambam Plugin
    risk 0.04cvss —epss 0.07

    The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to calculate a shared key.

  • CVE-2008-3362Jul 30, 2008
    Giulio Ganci
    Wp Downloads Manager
    risk 0.04cvss —epss 0.17

    Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the upfile parameter, then accessing it via a direct…

  • CVE-2008-1061Feb 28, 2008
    WordPress
    Sniplets
    risk 0.04cvss —epss 0.07

    Multiple cross-site scripting (XSS) vulnerabilities in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to (a) warning.php, (b) notice.php, and (c) inset.php in view/sniplets/, and possibly…

  • CVE-2008-0222Jan 10, 2008
    WordPress
    Filemanager
    risk 0.04cvss —epss 0.08

    Unrestricted file upload vulnerability in ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for WordPress allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors.

  • CVE-2007-6369Dec 15, 2007
    WordPress
    Pictpress
    risk 0.04cvss —epss 0.08

    Multiple directory traversal vulnerabilities in resize.php in the PictPress 0.91 and earlier plugin for WordPress allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) size or (2) path parameter.

  • CVE-2007-6318Dec 12, 2007
    WordPress
    WordPress
    risk 0.04cvss —epss 0.09

    SQL injection vulnerability in wp-includes/query.php in WordPress 2.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the s parameter, when DB_CHARSET is set to (1) Big5, (2) GBK, or possibly other character set encodings that support a "\" in a…

Page 714 of 759