VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

37,946 total · sorted by risk
  • CVE-2012-5349Oct 9, 2012
    WordPress
    Pay With Tweet
    risk 0.03cvss —epss 0.03

    Multiple cross-site scripting (XSS) vulnerabilities in pay.php in the Pay With Tweet plugin before 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) link, (2) title, or (3) dl parameter.

  • CVE-2012-5346Oct 9, 2012
    WordPress
    WP Live.php
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in wp-live.php in the WP Live.php module 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2012-5229Oct 1, 2012
    WordPress
    Slideshow Gallery2
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in css/gallery-css.php in the Slideshow Gallery2 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the border parameter.

  • CVE-2011-5193Sep 23, 2012
    WordPress
    Whois Search
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress, when the WHOIS widget is enabled, allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php, a different…

  • CVE-2011-5182Sep 20, 2012
    WordPress
    Lanoba Social Plugin
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor disputes this issue, stating "Lanoba's plug in does…

  • CVE-2011-5180Sep 20, 2012
    Zooeffect
    Zooeffect
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in wp-1pluginjquery.php in the ZooEffect plugin 1.01 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information. NOTE: this…

  • CVE-2012-2917May 21, 2012
    WordPress
    Share and Follow
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key (cnd-key) in a share-and-follow-menu page to wp-admin/admin.php.

  • CVE-2012-2913May 21, 2012
    WordPress
    Leaflet
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) leaflet_layer.php or (2) leaflet_marker.php, as reachable through wp-admin/admin.php.

  • CVE-2011-4803Dec 14, 2011
    WordPress
    Wptouch
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in wptouch/ajax.php in the WPTouch plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2011-4673Dec 2, 2011
    WordPress
    Jetpack
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2011-4671Dec 2, 2011
    WordPress
    Adrotate
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8, for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter (aka redirect URL).

  • CVE-2010-4875Oct 7, 2011
    WordPress
    Vodpod Video Gallery
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gid parameter.

  • CVE-2011-3865Sep 28, 2011
    WordPress
    Black-LetterHead
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.

  • CVE-2011-3863Sep 28, 2011
    WordPress
    RedLine
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3862Sep 28, 2011
    WordPress
    Morning Coffee
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.

  • CVE-2011-3861Sep 28, 2011
    WordPress
    Web Minimalist 200901
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.

  • CVE-2011-3860Sep 28, 2011
    WordPress
    Cover WP
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3859Sep 28, 2011
    WordPress
    Trending
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.

  • CVE-2011-3858Sep 28, 2011
    WordPress
    Pixiv Custom
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3856Sep 28, 2011
    WordPress
    Elegant Grunge
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3855Sep 28, 2011
    WordPress
    F8 Lite
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3852Sep 28, 2011
    WordPress
    EvoLve
    risk 0.03cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the EvoLve theme before 1.2.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2011-3850Sep 28, 2011
    WordPress
    Atahualpa
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in the Atahualpa theme before 3.6.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  • CVE-2010-4839Sep 14, 2011
    WordPress
    Event Registration
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the event_id parameter in a register action.

  • CVE-2010-4747Mar 1, 2011
    WordPress
    Processing Embed
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pluginurl parameter.

  • CVE-2011-1047Feb 21, 2011
    Vasthtml
    Forum Server
    risk 0.03cvss —epss 0.05

    Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) search_max parameter in a search action to index.php, which is not properly handled by…

  • CVE-2010-4518Dec 9, 2010
    WordPress
    Safe Search
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the v1 parameter.

  • CVE-2010-3977Nov 3, 2010
    WordPress
    cforms
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.

  • CVE-2010-2924Jul 30, 2010
    WordPress
    Mylinksdump
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the url parameter. NOTE: some of these details are obtained from third party information.

  • CVE-2010-1186Apr 7, 2010
    WordPress
    Nextgen Gallery
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.

  • CVE-2010-0673Feb 22, 2010
    Copperleaf
    Photolog
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress allows remote attackers to execute arbitrary SQL commands via the postid parameter.

  • CVE-2009-4424Dec 28, 2009
    WordPress
    Pyrmont
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-3703Dec 18, 2009
    WordPress
    Wp Forum
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the forum parameter to an…

  • CVE-2009-4168Dec 2, 2009
    Joomla
    Joomulus
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags…

  • CVE-2008-7216Sep 11, 2009
    WordPress
    Peter's Math Anti-Spam Spinoff
    risk 0.03cvss —epss 0.06

    Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortion, which allows remote attackers to bypass CAPTCHA protection by reading certain bytes from the generated clip.

  • CVE-2008-7040Aug 24, 2009
    WordPress
    Yellow Swordfish Simple Forum
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in ahah/sf-profile.php in the Yellow Swordfish Simple Forum module for Wordpress allows remote attackers to execute arbitrary SQL commands via the u parameter. NOTE: this issue was disclosed by an unreliable researcher, so the details might be…

  • CVE-2009-2852Aug 18, 2009
    WordPress
    Wp Syntax
    risk 0.03cvss —epss 0.05

    WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_head] array parameter to test/index.php, which is used in a call to the call_user_func_array function.

  • CVE-2009-2602Jul 27, 2009
    WordPress
    R2 Newsletter
    risk 0.03cvss —epss 0.02

    R2 Newsletter Lite, Pro, and Stats stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for admin.mdb.

  • CVE-2009-2335Jul 10, 2009
    WordPress
    WordPress
    risk 0.03cvss —epss 0.85

    WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue,…

  • CVE-2009-2383Jul 8, 2009
    WordPress
    Related Sites
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in BTE_RW_webajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the guid parameter.

  • CVE-2009-2308Jul 2, 2009
    Punres
    Affiliates Mod
    risk 0.03cvss —epss 0.01

    Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier for PunBB allow remote attackers to execute arbitrary SQL commands via the (1) in or (2) out parameter.

  • CVE-2009-2154Jun 22, 2009
    Sappy.dk
    Impleo Music Collection
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in admin/login.php in Impleo Music Collection 2.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.

  • CVE-2009-2122Jun 19, 2009
    WordPress
    Photoracer
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2009-1030Mar 20, 2009
    WordPress
    WordPress
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU (WPMU) before 2.7 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.

  • CVE-2009-0968Mar 19, 2009
    WordPress
    fMoblog
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. NOTE: some of these details are obtained from third party information.

  • CVE-2008-6438Mar 6, 2009
    WordPress
    Macguru Blog Engine
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the uid parameter, a different vector than CVE-2008-2455. NOTE: it was later reported that 2.1.4 is also…

  • CVE-2008-6181Feb 19, 2009
    WordPress
    Com Mad4joomla
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in the Mad4Joomla Mailforms (com_mad4joomla) component before 1.1.8.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the jid parameter to index.php.

  • CVE-2008-5752Dec 30, 2008
    WordPress
    Page Flip Image Gallery Plugin
    risk 0.03cvss —epss 0.06

    Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the book_id parameter. NOTE: some of these details…

  • CVE-2008-4786Oct 29, 2008
    WordPress
    Easyshop
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in easyshop.php in the EasyShop plugin for e107 allows remote attackers to execute arbitrary SQL commands via the category_id parameter.

  • CVE-2008-4732Oct 24, 2008
    WordPress
    WP Comment Remix
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in ajax_comments.php in the WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the p parameter.

Page 717 of 759