VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

37,946 total · sorted by risk
  • CVE-2007-3140Jun 8, 2007
    WordPress
    WordPress
    risk 0.04cvss —epss 0.07

    SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a parameter value in an XML RPC wp.suggestCategories methodCall, a different vector than CVE-2007-1897.

  • CVE-2007-2714May 16, 2007
    Matt Mullenweg
    Akismet
    risk 0.04cvss —epss 0.11

    Unspecified vulnerability in akismet.php in Matt Mullenweg Akismet before 2.0.2, a WordPress plugin, has unknown impact and attack vectors.

  • CVE-2007-2482May 3, 2007
    WordPress
    wordTube
    risk 0.04cvss —epss 0.09

    Directory traversal vulnerability in wordtube-button.php in the wordTube 1.43 and earlier plugin for WordPress, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the wpPATH parameter.

  • CVE-2007-2483May 3, 2007
    WordPress
    wp-Table
    risk 0.04cvss —epss 0.07

    Directory traversal vulnerability in js/wptable-button.php in the wp-Table 1.43 and earlier plugin for WordPress, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the wpPATH parameter.

  • CVE-2007-0233Jan 13, 2007
    WordPress
    WordPress
    risk 0.04cvss —epss 0.12

    wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary SQL commands via the tb_id…

  • CVE-2006-4208Aug 17, 2006
    WordPress
    Wp Db Backup
    risk 0.04cvss —epss 0.12

    Directory traversal vulnerability in wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier allows remote authenticated users with administrative privileges to read arbitrary files via a .. (dot dot) in the backup parameter to edit.php.

  • CVE-2005-2108Jul 5, 2005
    WordPress
    WordPress
    risk 0.04cvss —epss 0.09

    SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the HTTP_RAW_POST_DATA variable, which stores the data in an XML file.

  • CVE-2004-1559Dec 31, 2004
    WordPress
    WordPress
    risk 0.04cvss —epss 0.06

    Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, text, popupurl, or popuptitle parameters to wp-login.php, (2) redirect_url parameter to admin-header.php, (3) popuptitle,…

  • CVE-2004-1584Dec 31, 2004
    WordPress
    WordPress
    risk 0.04cvss —epss 0.11

    CRLF injection vulnerability in wp-login.php in WordPress 1.2 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server via the text parameter.

  • CVE-2018-8729MedMar 15, 2018
    WordPress
    Activity Log
    risk 0.03cvss 6.1epss 0.07

    Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.

  • CVE-2015-6965Sep 16, 2015
    WordPress
    Contact Form Generator
    risk 0.03cvss —epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) create a field, (2) update a field, (3) delete a field, (4)…

  • CVE-2015-6805Sep 2, 2015
    WordPress
    MDC Private Message
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the MDC Private Message plugin 1.0.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the message field in a private message.

  • CVE-2015-2321Aug 13, 2015
    WordPress
    Job Manager
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the email field.

  • CVE-2015-4465Jun 10, 2015
    WordPress
    zM Ajax Login & Register
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-8607Jun 10, 2015
    Xcloner
    Xcloner
    risk 0.03cvss —epss 0.01

    The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information via the ps command.

  • CVE-2014-8606Jun 10, 2015
    Xcloner
    Xcloner
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. (dot dot) in the file parameter in a json_return action in the xcloner_show page to wp-admin/admin-ajax.php.

  • CVE-2014-8603Jun 10, 2015
    Xcloner
    Xcloner
    risk 0.03cvss —epss 0.06

    cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the (1) file name when creating a backup or vectors related to the (2) $_CONFIG[tarpath], (3) $exclude, (4)…

  • CVE-2015-4084May 28, 2015
    Free Counter
    Free Counter
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value_ parameter in a check_stat action to wp-admin/admin-ajax.php.

  • CVE-2015-4066May 27, 2015
    WordPress
    GigPress
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) show_artist_id or (2) show_venue_id parameter in an add action in the gigpress.php page…

  • CVE-2015-4065May 27, 2015
    WordPress
    Landing Pages
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php.

  • CVE-2015-4064May 27, 2015
    WordPress
    Landing Pages
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php.

  • CVE-2015-4063May 27, 2015
    WordPress
    Newstatpress
    risk 0.03cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nsp_search page to wp-admin/admin.php.

  • CVE-2015-4018May 21, 2015
    WordPress
    FeedWordPress
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in feedwordpresssyndicationpage.class.php in the FeedWordPress plugin before 2015.0514 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the link_ids[] parameter in an Update action in the syndication.php page to…

  • CVE-2015-3325May 15, 2015
    WordPress
    Wp Symposium
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the show parameter in the QUERY_STRING to the default URI.

  • CVE-2015-3986May 14, 2015
    Thecartpress
    Thecartpress Ecommerce Shopping Cart
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct…

  • CVE-2014-9311Apr 14, 2015
    Shareaholic
    Shareaholic
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in admin.php in the Shareaholic plugin before 7.6.1.0 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the location[id] parameter in a shareaholic_add_location action to wp-admin/admin-ajax.php.

  • CVE-2015-2292Mar 17, 2015
    Yoast
    Wordpress Seo
    risk 0.03cvss —epss 0.06

    Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or…

  • CVE-2015-2218Mar 5, 2015
    WordPress
    WonderPlugin Audio Player
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) item[name] or (2)…

  • CVE-2015-2216Mar 5, 2015
    WordPress
    Photocrati
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL commands via the prod_id parameter.

  • CVE-2015-2199Mar 3, 2015
    Wonderplugin
    Audio Player
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users to execute arbitrary SQL commands via the item[id] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or remote…

  • CVE-2015-2090Feb 26, 2015
    Sympies
    Wordpress Survey And Poll
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the survey_id parameter in an ajax_survey action to wp-admin/admin-ajax.php.

  • CVE-2015-2084Feb 25, 2015
    WordPress
    Easy Social Icons
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the image_file parameter in an edit…

  • CVE-2015-1366Jan 27, 2015
    WordPress
    Pixabay Images
    risk 0.03cvss —epss 0.06

    Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the image_user parameter.

  • CVE-2014-10013Jan 13, 2015
    WordPress
    Another Wordpress Classifieds Plugin
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the keywordphrase parameter in a dosearch action.

  • CVE-2014-100003Jan 13, 2015
    WordPress
    YourMembers
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in includes/ym-download_functions.include.php in the Code Futures YourMembers plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the ym_download_id parameter to the default URI.

  • CVE-2014-8810Dec 24, 2014
    WordPress
    Wp Symposium
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tray parameter in a getMailMessage action.

  • CVE-2014-9305Dec 8, 2014
    WordPress
    Cart66 Lite
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in the shortcodeProductsTable function in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.2 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a shortcode_products_table action to…

  • CVE-2014-8800Dec 5, 2014
    WordPress
    Nextend Facebook Connect
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in nextend-facebook-settings.php in the Nextend Facebook Connect plugin before 1.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fb_login_button parameter in a newfb_update_options action.

  • CVE-2014-9179Dec 2, 2014
    Supportezzy Ticket System Project
    Supportezzy Ticket System
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the "URL (optional)" field in a new ticket.

  • CVE-2014-9178Dec 2, 2014
    WordPress
    Sp Project \& Document Manager
    risk 0.03cvss —epss 0.05

    Multiple SQL injection vulnerabilities in classes/ajax.php in the Smarty Pants Plugins SP Project & Document Manager plugin (sp-client-document-manager) 2.4.1 and earlier for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) vendor_email[] parameter…

  • CVE-2014-9175Dec 2, 2014
    Wpdatatables
    Wpdatatables
    risk 0.03cvss —epss 0.05

    SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the table_id parameter in a get_wdtable action to wp-admin/admin-ajax.php.

  • CVE-2014-9099Nov 26, 2014
    WordPress
    WhyDoWork AdSense
    risk 0.03cvss —epss 0.03

    Cross-site request forgery (CSRF) vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the whydowork_adsense page in…

  • CVE-2014-9098Nov 26, 2014
    Apptha
    Contus Video Gallery
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly before 2014-07-23, for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the videoadssearchQuery parameter to…

  • CVE-2014-9097Nov 26, 2014
    Apptha
    Contus Video Gallery
    risk 0.03cvss —epss 0.05

    Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed before 2014-07-23, for WordPress allow (1) remote attackers to execute arbitrary SQL commands via the vid parameter in a myextract action to…

  • CVE-2014-9034Nov 25, 2014
    WordPress
    WordPress
    risk 0.03cvss —epss 0.83

    wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to…

  • CVE-2014-8948Nov 16, 2014
    Imember360
    Imember360
    risk 0.03cvss —epss 0.04

    Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authentication of administrators for requests that with an unspecified impact via the i4w_trace parameter. NOTE: this can be…

  • CVE-2014-8375Oct 21, 2014
    WordPress
    Gb Gallery Slideshow
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in GBgallery.php in the GB Gallery Slideshow plugin 1.5 for WordPress allows remote administrators to execute arbitrary SQL commands via the selected_group parameter in a gb_ajax_get_group action to wp-admin/admin-ajax.php.

  • CVE-2014-2995Oct 17, 2014
    WordPress
    Twitget
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitget_consumer_key parameter to…

  • CVE-2014-2559Oct 17, 2014
    WordPress
    Twitget
    risk 0.03cvss —epss 0.03

    Multiple cross-site request forgery (CSRF) vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change unspecified plugin options via a request to…

  • CVE-2014-6312Oct 15, 2014
    WordPress
    Login Widget With Shortcode
    risk 0.03cvss —epss 0.04

    Cross-site request forgery (CSRF) vulnerability in the Login Widget With Shortcode (login-sidebar-widget) plugin before 3.2.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the…

Page 715 of 759