VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

37,946 total · sorted by risk
  • CVE-2008-4625Oct 21, 2008
    WordPress
    stnl_iframe.php
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in stnl_iframe.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter, a different vector than CVE-2008-0683.

  • CVE-2008-2510May 29, 2008
    WordPress
    Upload File Plugin
    risk 0.03cvss —epss 0.02

    SQL injection vulnerability in wp-uploadfile.php in the Upload File plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the f_id parameter.

  • CVE-2008-2455May 27, 2008
    WordPress
    Macguru Blog Engine
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in comment.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the rid parameter.

  • CVE-2008-1982Apr 27, 2008
    WordPress
    Wpss
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in ss_load.php in the Spreadsheet (wpSS) 0.6 and earlier plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the ss_id parameter.

  • CVE-2008-1646Apr 2, 2008
    WordPress
    Wp Download
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in wp-download.php in the WP-Download 1.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the dl_id parameter.

  • CVE-2008-1304Mar 12, 2008
    WordPress
    WordPress
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) inviteemail parameter in an invite action to wp-admin/users.php and the (2) to parameter in a sent action to wp-admin/invites.php.

  • CVE-2008-0939Feb 25, 2008
    WordPress
    Wp Photo Album Plus
    risk 0.03cvss —epss 0.04

    Multiple SQL injection vulnerabilities in wppa.php in the WP Photo Album (WPPA) before 1.1 plugin for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the photo parameter to index.php, used by the wppa_photo_name function; or (2) the album parameter to…

  • CVE-2008-0845Feb 20, 2008
    WordPress
    WP-People
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the person parameter.

  • CVE-2008-0682Feb 12, 2008
    WordPress
    Wordspew
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in wordspew-rss.php in the Wordspew plugin before 3.72 for Wordpress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-0683Feb 12, 2008
    WordPress
    ShiftThis Newsletter
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in shiftthis-preview.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter.

  • CVE-2008-0691Feb 12, 2008
    WordPress
    Wp Footnotes
    risk 0.03cvss —epss 0.04

    Multiple cross-site scripting (XSS) vulnerabilities in admin_panel.php in the Simon Elvery WP-Footnotes 2.2 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) wp_footnotes_current_settings[priority], (2)…

  • CVE-2008-0616Feb 6, 2008
    WordPress
    DMSGuestbook
    risk 0.03cvss —epss 0.04

    SQL injection vulnerability in the administration panel in the DMSGuestbook 1.7.0 plugin for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors. NOTE: it is not clear whether this issue crosses privilege boundaries.

  • CVE-2008-0507Jan 31, 2008
    WordPress
    AdServe 0.2
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in adclick.php in the AdServe 0.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-0520Jan 31, 2008
    WordPress
    Wassup Plugin
    risk 0.03cvss —epss 0.03

    Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) from_date or (2) to_date parameter to spy.php.

  • CVE-2008-0491Jan 30, 2008
    WordPress
    fGallery
    risk 0.03cvss —epss 0.06

    SQL injection vulnerability in fim_rss.php in the fGallery 2.4.1 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the album parameter.

  • CVE-2008-0490Jan 30, 2008
    WordPress
    Wp Cal Plugin
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in functions/editevent.php in the WP-Cal 0.3 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2008-0388Jan 23, 2008
    WordPress
    Wp Forum
    risk 0.03cvss —epss 0.03

    SQL injection vulnerability in the WP-Forum 1.7.4 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the user parameter in a showprofile action to the default URI.

  • CVE-2008-0193Jan 10, 2008
    WordPress
    WordPress
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php.

  • CVE-2007-5229Oct 5, 2007
    Feedburner
    Feedsmith
    risk 0.03cvss —epss 0.05

    Cross-site request forgery (CSRF) vulnerability in the FeedBurner FeedSmith 2.2 plugin for WordPress allows remote attackers to change settings and hijack blog feeds via a request to wp-admin/options-general.php that submits parameter values to FeedBurner_FeedSmith_Plugin.php,…

  • CVE-2007-4482Aug 22, 2007
    WordPress
    Pool
    risk 0.03cvss —epss 0.04

    Cross-site scripting (XSS) vulnerability in index.php in the Pool 1.0.7 theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF).

  • CVE-2007-4104Jul 31, 2007
    WordPress
    WP-FeedStats
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, one of which involves an rss2 feed with an invalid or missing blog with an XSS sequence…

  • CVE-2007-2757May 18, 2007
    Dean J Robinson
    Redoable
    risk 0.03cvss —epss 0.05

    Multiple cross-site scripting (XSS) vulnerabilities in Redoable 1.2 allow remote attackers to inject arbitrary web script or HTML via the s parameter to (1) wp-content/themes/redoable/searchloop.php or (2) wp-content/themes/redoable/header.php.

  • CVE-2006-6937Jan 17, 2007
    Pensacola Web Designs
    Xtremeasp Photogallery
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in displaypic.asp in Xtreme ASP Photo Gallery allows remote attackers to inject arbitrary SQL commands via the sortorder parameter.

  • CVE-2006-1694Apr 11, 2006
    Xbrite
    Xbrite Members
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in members.php in XBrite Members 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.

  • CVE-2006-0733Feb 16, 2006
    WordPress
    WordPress
    risk 0.03cvss —epss 0.05

    Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2) onblur in the "author's website" field. NOTE: followup comments to the researcher's web log suggest…

  • CVE-2021-4428LowJul 18, 2023
    What3words
    Autosuggest
    risk 0.01cvss 2.7epss 0.16

    A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting…

  • CVE-2021-24666CriSep 27, 2021
    Podlove
    Podlove Podcast Publisher
    risk 0.01cvss 9.8epss 0.09

    The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P[\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for…

  • CVE-2020-28037CriNov 2, 2020
    WordPress
    WordPress
    risk 0.01cvss 9.8epss 0.08

    is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old…

  • CVE-2020-28032CriNov 2, 2020
    WordPress
    WordPress
    risk 0.01cvss 9.8epss 0.16

    WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.

  • CVE-2019-6112MedAug 14, 2020
    WordPress
    Sell Media
    risk 0.01cvss 6.1epss 0.09

    A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field).

  • CVE-2018-14028HigAug 10, 2018
    WordPress
    WordPress
    risk 0.01cvss 7.2epss 0.13

    In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an…

  • CVE-2015-2807Sep 1, 2015
    Documentcloud
    Navis Documentcloud
    risk 0.01cvss —epss 0.07

    Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.

  • CVE-2014-8799Nov 28, 2014
    WordPress
    Dukapress
    risk 0.01cvss —epss 0.68

    Directory traversal vulnerability in the dp_img_resize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the src parameter to lib/dp_image.php.

  • CVE-2014-4725Jul 27, 2014
    Mailpoet
    Mailpoet Newsletters
    risk 0.01cvss —epss 0.60

    The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in…

  • CVE-2026-88788Sep 22, 2026
    WordPress
    Text Styler
    risk 0.00cvss —epss —

    The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to…

  • CVE-2026-84913Sep 10, 2026
    Drupal
    Drupal
    risk 0.00cvss —epss —

    Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

  • CVE-2026-87939Sep 10, 2026
    Drupal
    Drupal
    risk 0.00cvss —epss —

    Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

  • CVE-2026-87940Sep 10, 2026
    Drupal
    Drupal
    risk 0.00cvss —epss —

    Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

  • CVE-2026-87944Sep 10, 2026
    Drupal
    Drupal
    risk 0.00cvss —epss —

    Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

  • CVE-2026-87945Sep 10, 2026
    Drupal
    Drupal
    risk 0.00cvss —epss —

    Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

  • CVE-2026-87947Sep 9, 2026
    Drupal
    Drupal
    risk 0.00cvss —epss —

    Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

  • CVE-2026-87950Sep 9, 2026
    Drupal
    Drupal
    risk 0.00cvss —epss —

    Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

  • CVE-2026-87951Sep 9, 2026
    Drupal
    Drupal
    risk 0.00cvss —epss —

    Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

  • CVE-2026-87953Sep 9, 2026
    Drupal
    Drupal
    risk 0.00cvss —epss —

    Mentioned in Drupal. See https://www.drupal.org/security for vendor details.

  • CVE-2025-13398Sep 2, 2026
    WordPress
    DesignThemes LMS
    risk 0.00cvss —epss —

    Rejected reason: This CVE ID is a duplicate of CVE-2025-13542 and was never published. Both IDs were assigned to the same unauthenticated privilege escalation vulnerability in the DesignThemes LMS WordPress plugin. All CVE users should reference CVE-2025-13542 instead of this ID.

  • CVE-2026-14942Aug 28, 2026
    WordPress
    Customer Reviews For Woocommerce
    risk 0.00cvss —epss —

    Rejected reason: This CVE ID was assigned to a reported vulnerability in the Customer Reviews for WooCommerce WordPress plugin and was never published. The report was withdrawn: the precondition it depends on, an attacker obtaining a review form identifier belonging to a…

  • CVE-2026-16249Aug 24, 2026
    WordPress
    6storage Rentals
    risk 0.00cvss —epss —

    Rejected reason: This CVE ID is a duplicate of CVE-2026-15303 and was never published. Both IDs were assigned to the same vulnerability in the 6Storage Rentals WordPress plugin. All CVE users should reference CVE-2026-15303 instead of this ID.

  • CVE-2026-73189Aug 18, 2026
    WordPress
    Wp Crowdfunding
    risk 0.00cvss —epss 0.00

    Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-14858

  • CVE-2026-73188Aug 13, 2026
    WordPress
    Kivicare Clinic Management System
    risk 0.00cvss —epss —

    Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-13610.

  • CVE-2026-28183Aug 6, 2026
    WordPress
    PublishPress Capabilities
    risk 0.00cvss —epss —

    Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Page 718 of 759