VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

36,868 total · sorted by risk
  • CVE-2015-1614Feb 19, 2015
    WordPress
    Image Metadata Cruncher
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1)…

  • CVE-2015-1494Feb 17, 2015
    WordPress
    Fancybox For Wordpress
    risk 0.00cvss —epss 0.06

    The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw[*] parameter in an update action to wp-admin/admin-post.php, as demonstrated by the…

  • CVE-2015-1436Feb 16, 2015
    WordPress
    Easing Slider
    risk 0.00cvss —epss 0.03

    Cross-site scripting (XSS) vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the (1) easingslider_manage_customizations or (2) easingslider_edit_sliders page to…

  • CVE-2015-1582Feb 11, 2015
    WordPress
    Spider Facebook
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject…

  • CVE-2015-1581Feb 11, 2015
    WordPress
    Mobile Domain
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2)…

  • CVE-2015-1580Feb 11, 2015
    WordPress
    Redirection Page
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Redirection Page plugin 1.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the…

  • CVE-2015-1384Feb 3, 2015
    WordPress
    Banner Effect Header
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Banner Effect Header plugin before 1.2.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the banner_effect_divid parameter in the BannerEffectOptions page to wp-admin/options-general.php.

  • CVE-2015-1393Feb 2, 2015
    WordPress
    Photogallery
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the asc_or_desc parameter in a create gallery request in the galleries_bwg page to wp-admin/admin.php.

  • CVE-2015-1385Feb 2, 2015
    Blubrry
    Powerpress
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmin_categoryfeeds.php…

  • CVE-2015-1383Feb 2, 2015
    WordPress
    Geo Mashup
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search key.

  • CVE-2014-8802Jan 23, 2015
    WordPress
    Pie Register
    risk 0.00cvss —epss 0.08

    The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.

  • CVE-2015-1204Jan 21, 2015
    WordPress
    Wp Slimstat
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fs[resource] parameter in the wp-slim-view-2 page to wp-admin/admin.php.

  • CVE-2015-1055Jan 16, 2015
    WordPress
    Photogallery
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php.

  • CVE-2014-9570Jan 15, 2015
    Mywebsiteadvisor
    Simple Security
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the MyWebsiteAdvisor Simple Security plugin 1.1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) datefilter parameter in the access_log page to wp-admin/users.php or (2)…

  • CVE-2014-9308Jan 15, 2015
    WordPress
    Wp Easycart
    risk 0.00cvss —epss 0.52

    Unrestricted file upload vulnerability in inc/amfphp/administration/banneruploaderscript.php in the WP EasyCart (aka WordPress Shopping Cart) plugin before 3.0.9 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then…

  • CVE-2014-7957Jan 15, 2015
    WordPress
    Pods
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) conduct cross-site scripting (XSS) attacks via the toggled parameter in a toggle…

  • CVE-2014-7956Jan 15, 2015
    WordPress
    Pods
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods page to wp-admin/admin.php.

  • CVE-2014-100027Jan 13, 2015
    WordPress
    Wp Slimstat
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the WP SlimStat plugin before 3.5.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2014-100026Jan 13, 2015
    WordPress
    April's Super Functions Pack
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in readme.php in the April's Super Functions Pack plugin before 1.4.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party…

  • CVE-2014-100023Jan 13, 2015
    WordPress
    mTouch Quiz
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in question.php in the mTouch Quiz before 3.0.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the quiz parameter to wp-admin/edit.php.

  • CVE-2014-100022Jan 13, 2015
    WordPress
    mTouch Quiz
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in question.php in the mTouch Quiz before 3.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the quiz parameter to wp-admin/edit.php.

  • CVE-2014-100018Jan 13, 2015
    WordPress
    Unconfirmed
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in the unconfirmed page to wp-admin/network/users.php.

  • CVE-2014-100016Jan 13, 2015
    WordPress
    Photocrati
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in photocrati-gallery/ecomm-sizes.php in the Photocrati theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the prod_id parameter.

  • CVE-2014-10017Jan 13, 2015
    Welcart
    E Commerce
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) changeSort or (2) switch parameter in the usces_itemedit page to wp-admin/admin.php.

  • CVE-2014-10016Jan 13, 2015
    Welcart
    E Commerce
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script or HTML via (1) unspecified vectors related to purchase_limit or the (2) name, (3) intl, (4) nocod, or (5) time…

  • CVE-2014-10012Jan 13, 2015
    WordPress
    Another Wordpress Classifieds Plugin
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI.

  • CVE-2014-100009Jan 13, 2015
    Joomlaskin
    Js Multi Hotel
    risk 0.00cvss —epss 0.02

    The Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to obtain the installation path via a request to (1) functions.php, (2) myCalendar.php, (3) refreshDate.php, (4) show_image.php, (5) widget.php,…

  • CVE-2014-100008Jan 13, 2015
    Joomlaskin
    Js Multi Hotel
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in includes/delete_img.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the path parameter.

  • CVE-2014-100007Jan 13, 2015
    WordPress
    HK Exif Tags
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the HK Exif Tags plugin before 1.12 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via an EXIF tag. NOTE: some of these details are obtained from third party information.

  • CVE-2014-100001Jan 13, 2015
    WordPress
    LiveOptim
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the SEO Plugin LiveOptim plugin before 1.1.4-free for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of these…

  • CVE-2014-2839Jan 12, 2015
    WordPress
    Gd Star Rating
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the GD Star Rating plugin 19.22 for WordPress allows remote administrators to execute arbitrary SQL commands via the s parameter in the gd-star-rating-stats page to wp-admin/admin.php.

  • CVE-2014-2838Jan 12, 2015
    WordPress
    Gd Star Rating
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the GD Star Rating plugin 19.22 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct (1) SQL injection attacks via the s parameter in the gd-star-rating-stats…

  • CVE-2013-7419Jan 9, 2015
    Joomlaskin
    Js Multi Hotel
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in includes/refreshDate.php in the Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the roomid parameter.

  • CVE-2015-0920Jan 8, 2015
    WordPress
    Banner Effect Header
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the banner_effect_email parameter in the…

  • CVE-2012-5853Jan 8, 2015
    WordPress
    AJAX Post Search
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the "the_search_function" function in cardoza_ajax_search.php in the AJAX Post Search (cardoza-ajax-search) plugin before 1.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the srch_txt parameter in a "the_search_text"…

  • CVE-2014-9525Jan 5, 2015
    WordPress
    Timed Popup
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Timed Popup (wp-timed-popup) plugin 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct…

  • CVE-2014-9524Jan 5, 2015
    WordPress
    Facebook Like Box
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Facebook Like Box (cardoza-facebook-like-box) plugin before 2.8.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified…

  • CVE-2014-9523Jan 5, 2015
    WordPress
    Our Team Showcase
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Our Team Showcase (our-team-enhanced) plugin before 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or…

  • CVE-2014-9461Jan 2, 2015
    WordPress
    Cart66 Lite
    risk 0.00cvss —epss 0.02

    Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to read arbitrary files via a .. (dot dot) in the member_download action to wp-admin/admin-ajax.php.

  • CVE-2014-9460Jan 2, 2015
    WordPress
    Wp Vipergb
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the WP-ViperGB plugin before 1.3.11 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site…

  • CVE-2014-9454Jan 2, 2015
    WordPress
    Simple Sticky Footer
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Sticky Footer plugin before 1.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct…

  • CVE-2014-9453Jan 2, 2015
    WordPress
    Simple visitor stat
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in simple-visitor-stat.php in the Simple visitor stat plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP User-Agent or (2) HTTP Referer header.

  • CVE-2014-9443Jan 2, 2015
    Relevanssi
    Relevanssi
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Relevanssi plugin before 3.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2014-9442Jan 2, 2015
    WordPress
    Cart66 Lite
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the q parameter in a promotionProductSearch action to wp-admin/admin-ajax.php.

  • CVE-2014-9441Jan 2, 2015
    WordPress
    Lightbox Photo Gallery
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or conduct cross-site…

  • CVE-2014-9437Jan 2, 2015
    WordPress
    Sliding Social Icons
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings via unspecified vectors or (2) conduct cross-site…

  • CVE-2011-5308Jan 1, 2015
    WordPress
    cdnvote
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in cdnvote-post.php in the cdnvote plugin before 0.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) cdnvote_post_id or (2) cdnvote_point parameter.

  • CVE-2011-5307Jan 1, 2015
    WordPress
    PhotoSmash
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.

  • CVE-2011-5304Jan 1, 2015
    Sodahead
    Sodahead Polls
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Sodahead Polls plugin before 2.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via (1) the poll_id parameter to customizer.php or (2) the customize parameter to poll.php.

  • CVE-2014-9401Dec 31, 2014
    WordPress
    WP Limit Posts Automatically
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the WP Limit Posts Automatically plugin 0.7 and earlier for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the lpa_post_letters…

Page 727 of 738