VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

38,653 total · sorted by risk
  • CVE-2012-4768Sep 4, 2014
    WordPress
    Download Monitor
    risk 0.00cvss —epss 0.10

    Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI.

  • CVE-2012-4226Sep 3, 2014
    WordPress
    Quick Post Widget
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in Quick Post Widget plugin 1.9.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) Title, (2) Content, or (3) New category field to wordpress/ or (4) query string to wordpress/.

  • CVE-2014-3907Aug 26, 2014
    Mailpoet
    Mailpoet Newsletters
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.11 for WordPress allows remote attackers to hijack the authentication of arbitrary users.

  • CVE-2014-5344Aug 19, 2014
    Mobiloud
    Mobiloud
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the Mobiloud (mobiloud-mobile-app-plugin) plugin before 2.3.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party…

  • CVE-2014-3903Aug 19, 2014
    WordPress
    Cakifo
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Cakifo theme 1.x before 1.6.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via crafted Exif data.

  • CVE-2014-5266Aug 18, 2014
    Drupal
    Drupal
    risk 0.00cvss —epss 0.24

    The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a…

  • CVE-2014-5265Aug 18, 2014
    Drupal
    Drupal
    risk 0.00cvss —epss 0.03

    The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU…

  • CVE-2014-5240Aug 18, 2014
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL.

  • CVE-2014-5205Aug 18, 2014
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.

  • CVE-2014-5204Aug 18, 2014
    WordPress
    WordPress
    risk 0.00cvss —epss 0.02

    wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.

  • CVE-2014-5203Aug 18, 2014
    WordPress
    WordPress
    risk 0.00cvss —epss 0.04

    wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted serialized data.

  • CVE-2014-5202Aug 12, 2014
    WordPress
    Compfight
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in compfight-search.php in the Compfight plugin 1.4 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the search-value parameter.

  • CVE-2014-5199Aug 12, 2014
    Wordpress File Upload Project
    Wordpress File Upload
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in the WordPress File Upload plugin (wp-file-upload) before 2.4.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change plugin settings via unspecified vectors. NOTE: some of…

  • CVE-2014-5196Aug 12, 2014
    WordPress
    Improved User Search in Backend
    risk 0.00cvss —epss 0.02

    Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS…

  • CVE-2014-5190Aug 7, 2014
    WordPress
    SI CAPTCHA Anti-Spam
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in captcha-secureimage/test/index.php in the SI CAPTCHA Anti-Spam plugin 2.7.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

  • CVE-2014-5187Aug 6, 2014
    WordPress
    Tom M8te
    risk 0.00cvss —epss 0.05

    Directory traversal vulnerability in the Tom M8te (tom-m8te) plugin 1.5.3 for WordPress allows remote attackers to read arbitrary files via the file parameter to tom-download-file.php.

  • CVE-2014-5186Aug 6, 2014
    WordPress
    All Video Gallery
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the All Video Gallery (all-video-gallery) plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogallery_videos page to wp-admin/admin.php.

  • CVE-2014-5185Aug 6, 2014
    WordPress
    Quartz
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the Quartz plugin 1.01.1 for WordPress allows remote authenticated users with Contributor privileges to execute arbitrary SQL commands via the quote parameter in an edit action in the quartz/quote_form.php page to wp-admin/edit.php.

  • CVE-2014-5184Aug 6, 2014
    WordPress
    stripShow
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in the stripshow-storylines page in the stripShow plugin 2.5.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the story parameter in an edit action to wp-admin/admin.php.

  • CVE-2014-5183Aug 6, 2014
    WordPress
    Simple Retail Menus
    risk 0.00cvss —epss 0.02

    SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus (simple-retail-menus) plugin before 4.1 for WordPress allows remote authenticated editors to execute arbitrary SQL commands via the targetmenu parameter in an edit action to wp-admin/admin.php.

  • CVE-2014-5182Aug 6, 2014
    WordPress
    yawpp
    risk 0.00cvss —epss 0.02

    Multiple SQL injection vulnerabilities in the yawpp plugin 1.2 for WordPress allow remote authenticated users with Contributor privileges to execute arbitrary SQL commands via vectors related to (1) admin_functions.php or (2) admin_update.php, as demonstrated by the id parameter…

  • CVE-2014-5181Aug 6, 2014
    WordPress
    Last.fm Rotation
    risk 0.00cvss —epss 0.04

    Directory traversal vulnerability in lastfm-proxy.php in the Last.fm Rotation (lastfm-rotation) plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the snode parameter.

  • CVE-2012-6651Jul 31, 2014
    WordPress
    Vitamin
    risk 0.00cvss —epss 0.03

    Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to access arbitrary files via a .. (dot dot) in the path parameter to (1) add_headers.php or (2) minify.php.

  • CVE-2014-4726Jul 27, 2014
    Mailpoet
    Mailpoet Newsletters
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors.

  • CVE-2014-4942Jul 11, 2014
    WordPress
    Wp Easycart
    risk 0.00cvss —epss 0.05

    The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.

  • CVE-2014-4941Jul 11, 2014
    WordPress
    Cross-RSS
    risk 0.00cvss —epss 0.04

    Absolute path traversal vulnerability in Cross-RSS (wp-cross-rss) plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a full pathname in the rss parameter to proxy.php.

  • CVE-2014-4856Jul 10, 2014
    WordPress
    Polldaddy
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Polldaddy Polls & Ratings plugin before 2.0.25 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a ratings shortcode and a unique ID. NOTE: some of these details are obtained from…

  • CVE-2014-4855Jul 10, 2014
    WordPress
    Polylang
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Polylang plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a user description. NOTE: some of these details are obtained from third party information.

  • CVE-2014-4854Jul 10, 2014
    WordPress
    WP Construction Mode
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wuc_logo parameter in a save action to wp-admin/admin.php.

  • CVE-2014-4848Jul 10, 2014
    WordPress
    Blogstand Banner
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Blogstand Banner (blogstand-smart-banner) plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bs_blog_id parameter to wp-admin/options-general.php.

  • CVE-2014-4847Jul 10, 2014
    Buffercode
    Random Banner
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Random Banner plugin 1.1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the buffercode_RBanner_url_banner1 parameter in an update action to wp-admin/options.php.

  • CVE-2014-4846Jul 10, 2014
    WordPress
    Metaslider
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Meta Slider (ml-slider) plugin 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to wp-admin/admin.php.

  • CVE-2014-4845Jul 10, 2014
    WordPress
    BannerMan
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the BannerMan plugin 0.2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the bannerman_background parameter to wp-admin/options-general.php.

  • CVE-2014-4724Jul 7, 2014
    WordPress
    Custom Banners
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Custom Banners plugin 1.2.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the custom_banners_registered_name parameter to wp-admin/options.php.

  • CVE-2014-4723Jul 7, 2014
    WordPress
    Easy Banners
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in the Easy Banners plugin 1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter to wp-admin/options-general.php.

  • CVE-2014-4591Jul 2, 2014
    WordPress
    WP-Picasa-Image
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in picasa_upload.php in the WP-Picasa-Image plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the post_id parameter.

  • CVE-2014-4581Jul 2, 2014
    WordPress
    WPCB
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in facture.php in the WPCB plugin 2.4.8 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  • CVE-2014-4571Jul 2, 2014
    WordPress
    VN-Calendar
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in vncal.js.php in the VN-Calendar plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) fs or (2) w parameter.

  • CVE-2014-4565Jul 2, 2014
    WordPress
    Verification Code for Comments
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in vcc.js.php in the Verification Code for Comments plugin 2.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) vp, (2) vs, (3) l, (4) vu, or (5) vm parameter.

  • CVE-2014-4563Jul 2, 2014
    WordPress
    URL Cloak & Encrypt
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in go.php in the URL Cloak & Encrypt (url-cloak-encrypt) plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.

  • CVE-2014-4555Jul 2, 2014
    WordPress
    Style It
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in fonts/font-form.php in the Style It plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.

  • CVE-2014-4554Jul 2, 2014
    WordPress
    SS Downloads
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in templates/download.php in the SS Downloads plugin before 1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the title parameter.

  • CVE-2014-4549Jul 2, 2014
    Woocommerce Sagepay Direct Payment Gateway Project
    Woocommerce Sagepay Direct Payment Gateway
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in pages/3DComplete.php in the WooCommerce SagePay Direct Payment Gateway plugin before 0.1.6.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) MD or (2) PARes parameter.

  • CVE-2014-4546Jul 2, 2014
    Rezgo
    Rezgo
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in book_ajax.php in the Rezgo plugin 1.4.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the response parameter.

  • CVE-2014-4534Jul 2, 2014
    WordPress
    HTML5 Video Player with Playlist
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in videoplayer/autoplay.php in the HTML5 Video Player with Playlist plugin 2.4.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) theme or (2) playlistmod parameter.

  • CVE-2014-4600Jul 2, 2014
    WordPress
    WP Ultimate Email Marketer
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in contact/edit.php in the WP Ultimate Email Marketer plugin 1.1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) listname or (2) contact parameter.

  • CVE-2014-4599Jul 2, 2014
    WordPress
    Wp Business Directory
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in forms/search.php in the WP-Business Directory (wp-ttisbdir) plugin 1.0.2 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) edit, (2) search_term, (3) page_id, (4) page, or…

  • CVE-2014-4596Jul 2, 2014
    WordPress
    SnapApp
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in js/button-snapapp.php in the SnapApp plugin 1.5 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) msg or (2) act parameter.

  • CVE-2014-4595Jul 2, 2014
    WordPress
    WP RESTful
    risk 0.00cvss —epss 0.02

    Multiple cross-site scripting (XSS) vulnerabilities in the WP RESTful plugin 0.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) oauth_callback parameter to html_api_authorize.php or the (2) oauth_token_temp or (3)…

  • CVE-2014-4594Jul 2, 2014
    Wordpress Responsive Preview Project
    Wordpress Responsive Preview
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in index.php in the WordPress Responsive Preview plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the url parameter.

Page 765 of 774