Vulnerability database

5,873 results · page 114 of 118

• May 21, 2012Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via CVE-2012-2917 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key (cnd-key) in a share-and-follow-menu page to wp-admin/admin.php.

  Product

  Share and Follow

  What to do

  Update Share and Follow to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.orgsecurityfocus.com

• May 21, 2012Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2012-2916 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the active_option parameter to wp-admin/tools.php.

  Product

  Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE

  Fixed in

  2.1

  What to do

  Update Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE to 2.1 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.orgplugins.trac.wordpress.org

• May 21, 2012Multiple cross-site scripting (XSS) vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via CVE-2012-2913 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) leaflet_layer.php or (2) leaflet_marker.php, as reachable through wp-admin/admin.php.

  Product

  Leaflet

  What to do

  Update Leaflet to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.orgsecurityfocus.com

• May 21, 2012Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML CVE-2012-2912 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter in the show-league page or (2) season parameter in the team page to wp-admin/admin.php.

  Product

  LeagueManager

  What to do

  Update LeagueManager to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.orgsecurityfocus.com

• May 3, 2012The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, whichCVE-2012-1936 · WordPress plugins & themes · reported by MITREMedium 6.8

  The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks on specific actions and objects by sniffing the network, as demonstrated by attacks against the wp-admin/admin-ajax.php and wp-admin/user-new.php scripts. NOTE: the vendor reportedly disputes the significance of this issue because wp_create_nonce operates as intended, even if it is arguably inconsistent with certain CSRF protection details advocated by external organizations

  Affected

  up to 3.3.1

  What to do

  Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordexploit-db.comsecurityfocus.com

• Apr 21, 2012wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attaCVE-2012-2404 · WordPress plugins & themes · reported by MITREMedium 4.3

  wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

  Fixed in

  3.3.2

  What to do

  Update the plugin to 3.3.2 or newer.

  Full record and what to do →NVD recordcore.trac.wordpress.orgosvdb.org

• Apr 21, 2012wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conductCVE-2012-2403 · WordPress plugins & themes · reported by MITREMedium 4.3

  wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

  Fixed in

  3.3.2

  What to do

  Update the plugin to 3.3.2 or newer.

  Full record and what to do →NVD recordcore.trac.wordpress.orgcore.trac.wordpress.org

• Apr 21, 2012wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-widCVE-2012-2402 · WordPress plugins & themes · reported by MITREMedium 5.5

  wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors.

  Fixed in

  3.3.2

  What to do

  Update the plugin to 3.3.2 or newer.

  Full record and what to do →NVD recordcore.trac.wordpress.orgosvdb.org

• Apr 21, 2012Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which tCVE-2012-2401 · WordPress plugins & themes · reported by MITREMedium 5

  Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.

  Fixed in

  1.5.4

  What to do

  Update the plugin to 1.5.4 or newer.

  Full record and what to do →NVD recordcore.trac.wordpress.orgcore.trac.wordpress.org

• Apr 21, 2012Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors.CVE-2012-2400 · WordPress plugins & themes · reported by MITREHigh 10

  Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors.

  Fixed in

  3.3.2

  What to do

  Update the plugin to 3.3.2 or newer.

  Full record and what to do →NVD recordcore.trac.wordpress.orgosvdb.org

• Apr 21, 2012Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earCVE-2012-2399 · WordPress plugins & themes · reported by MITREHigh 10

  Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.

  Affected

  up to 2.2.0.1

  Fixed in

  3.5.2

  What to do

  Update the plugin to 3.5.2 or newer.

  Full record and what to do →NVD recordcore.trac.wordpress.orgjvn.jp

• Mar 19, 2012The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknoCVE-2012-1786 · WordPress plugins & themes · reported by MITREMedium 5

  The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors.

  Product

  Media Upload form in the Video Embed & Thumbnail Generator

  Fixed in

  2.0

  What to do

  Update Media Upload form in the Video Embed & Thumbnail Generator to 2.0 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Mar 19, 2012kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecifiedCVE-2012-1785 · WordPress plugins & themes · reported by MITREHigh 7.5

  kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors.

  Product

  kg_callffmpeg.php in the Video Embed & Thumbnail Generator

  Fixed in

  2.0

  What to do

  Update kg_callffmpeg.php in the Video Embed & Thumbnail Generator to 2.0 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Mar 19, 2012Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2011-5082 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2member_pro_authnet_checkout[coupon] parameter (aka Coupon Code field).

  Product

  s2Member Pro

  Fixed in

  111220

  What to do

  Update s2Member Pro to 111220 or newer.

  Full record and what to do →NVD recordsecunia.comprimothemes.com

• Feb 24, 2012PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary CVE-2012-1205 · WordPress plugins & themes · reported by MITREHigh 7.5

  PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.

  Product

  PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload

  Fixed in

  0.20

  What to do

  Update PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload to 0.20 or newer.

  Full record and what to do →NVD recordosvdb.orgplugins.trac.wordpress.org

• Feb 14, 2012Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers CVE-2012-1068 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging.

  Product

  Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments

  Fixed in

  2.0.7

  What to do

  Update Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments to 2.0.7 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Feb 14, 2012SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter iCVE-2012-1067 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  Product

  WP-RecentComments

  What to do

  Update WP-RecentComments to the newest version.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• Feb 7, 2012actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP codCVE-2012-1011 · WordPress plugins & themes · reported by MITREHigh 7.5

  actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.

  Product

  AllWebMenus

  What to do

  Update AllWebMenus to the newest version.

  Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com

• Feb 7, 2012Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP codeCVE-2012-1010 · WordPress plugins & themes · reported by MITREHigh 7.5

  Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.

  Product

  Unrestricted file upload vulnerability in actions.php in the AllWebMenus

  Fixed in

  1.1.8

  What to do

  Update Unrestricted file upload vulnerability in actions.php in the AllWebMenus to 1.1.8 or newer.

  Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com

• Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL databasCVE-2012-0937 · WordPress plugins & themes · reported by MITREMedium 5

  wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898. NOTE: the vendor disputes the significance of this issue because an incomplete WordPress installation might be present on the network for only a short time

  Affected

  up to 3.3.1

  What to do

  Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordarchives.neohapsis.comexploit-db.com

• Jan 30, 2012Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attacCVE-2012-0782 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance

  Affected

  up to 3.3.1

  What to do

  Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordarchives.neohapsis.comexploit-db.com

• Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate,CVE-2011-4899 · WordPress plugins & themes · reported by MITREHigh 7.5

  wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments

  Affected

  up to 3.3.1

  What to do

  Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordarchives.neohapsis.comexploit-db.com

• Jan 30, 2012wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameteCVE-2011-4898 · WordPress plugins & themes · reported by MITREMedium 5

  wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective

  Affected

  up to 3.3.1

  What to do

  Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordarchives.neohapsis.comexploit-db.com

• Jan 28, 2012ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8: PHP remote file inclusionCVE-2012-0934 · WordPress plugins & themes · reported by MITREHigh 7.5

  PHP remote file inclusion vulnerability in ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the tt-abspath parameter.

  Product

  ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8

  Fixed in

  0.8

  What to do

  Update ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8 to 0.8 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Jan 20, 2012Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2012-0898 · WordPress plugins & themes · reported by MITREMedium 5

  Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dwn_file parameter.

  Product

  myEASYbackup

  What to do

  Update myEASYbackup to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com

• Jan 20, 2012Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files viaCVE-2012-0896 · WordPress plugins & themes · reported by MITREMedium 5

  Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.

  Product

  Absolute path traversal vulnerability in download.php in the Count Per Day module

  Fixed in

  3.1.1

  What to do

  Update Absolute path traversal vulnerability in download.php in the Count Per Day module to 3.1.1 or newer.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org

• Jan 20, 2012Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2012-0895 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map parameter.

  Product

  Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module

  Fixed in

  3.1.1

  What to do

  Update Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module to 3.1.1 or newer.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org

• Jan 5, 2012wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used,: Cross-site scripting (XSS)CVE-2012-0287 · WordPress plugins & themes · reported by MITRELow 2.6

  Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the "Duplicate comment detected" feature.

  Product

  wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used,

  Fixed in

  3.3.1

  What to do

  Update wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, to 3.3.1 or newer.

  Full record and what to do →NVD recordoldmanlab.blogspot.comsecurityfocus.com

• Jan 4, 2012Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uCVE-2011-5051 · WordPress plugins & themes · reported by MITREHigh 7.5

  Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension using (1) uploadify/upload_admin_avatar.php or (2) uploadify/upload_profile_avatar.php, then accessing it via a direct request to the file in an unspecified directory inside the webroot.

  Product

  Multiple unrestricted file upload vulnerabilities in the WP Symposium

  Fixed in

  11.12.24

  What to do

  Update Multiple unrestricted file upload vulnerabilities in the WP Symposium to 11.12.24 or newer.

  Full record and what to do →NVD recordosvdb.orgosvdb.org

• Dec 27, 2011Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers toCVE-2011-3841 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3

  Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers to inject arbitrary web script or HTML via the uid parameter.

  Product

  Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium

  Fixed in

  11.12.08

  What to do

  Update Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium to 11.12.08 or newer.

  Full record and what to do →NVD recordsecunia.comsecunia.com

• Dec 2, 2011wp-users.php in WordPress Users plugin 1.3 and possibly earlier for: SQL injectionCVE-2011-4669 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in wp-users.php in WordPress Users plugin 1.3 and possibly earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the uid parameter to index.php.

  Product

  wp-users.php in WordPress Users plugin 1.3 and possibly earlier for

  What to do

  Update wp-users.php in WordPress Users plugin 1.3 and possibly earlier for to the newest version.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Nov 30, 2011SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote aCVE-2011-4646 · WordPress plugins & themes · reported by MITREMedium 6

  SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote authenticated users with the Author role to execute arbitrary SQL commands via the id attribute of the ratings shortcode when creating a post. NOTE: some of these details are obtained from third party information.

  Product

  SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions

  Fixed in

  1.62

  What to do

  Update SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions to 1.62 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Nov 29, 2011Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrCVE-2011-4568 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI.

  Product

  Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer

  Fixed in

  1.2.12

  What to do

  Update Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer to 1.2.12 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Oct 7, 2011Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote CVE-2010-4875 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gid parameter.

  Product

  Vodpod Video Gallery

  What to do

  Update Vodpod Video Gallery to the newest version.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org

• Oct 4, 2011PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via aCVE-2011-3981 · WordPress plugins & themes · reported by MITREHigh 7.5

  PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.

  Product

  Allwebmenus

  What to do

  Update Allwebmenus to the newest version.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2011-3865 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.

  Product

  Cross-site scripting (XSS) vulnerability in the Black-LetterHead

  Fixed in

  1.6

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Black-LetterHead to 1.6 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the The Erudite theme before 2.7.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via CVE-2011-3864 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the The Erudite theme before 2.7.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the The Erudite

  Fixed in

  2.7.9

  What to do

  Update Cross-site scripting (XSS) vulnerability in the The Erudite to 2.7.9 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sCVE-2011-3863 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the RedLine

  Fixed in

  1.66

  What to do

  Update Cross-site scripting (XSS) vulnerability in the RedLine to 1.66 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2011-3862 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.

  Product

  Cross-site scripting (XSS) vulnerability in the Morning Coffee

  Fixed in

  3.6

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Morning Coffee to 3.6 or newer.

  Full record and what to do →NVD recordsecunia.comsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2011-3861 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.

  Product

  Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901

  Fixed in

  1.2

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 to 1.2 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via theCVE-2011-3860 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the Cover WP

  Fixed in

  1.6.6

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Cover WP to 1.6.6 or newer.

  Full record and what to do →NVD recordsecurityfocus.comsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cCVE-2011-3859 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the Trending

  Fixed in

  0.2

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Trending to 0.2 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2011-3858 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the Pixiv Custom

  Fixed in

  2.1.6

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Pixiv Custom to 2.1.6 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via theCVE-2011-3857 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the Antisnews

  Fixed in

  1.10

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Antisnews to 1.10 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2011-3856 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the Elegant Grunge

  Fixed in

  1.0.4

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Elegant Grunge to 1.0.4 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CVE-2011-3855 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the F8 Lite

  Fixed in

  4.2.2

  What to do

  Update Cross-site scripting (XSS) vulnerability in the F8 Lite to 4.2.2 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the ZenLite theme before 4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s CVE-2011-3854 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the ZenLite theme before 4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the ZenLite

  Fixed in

  4.4

  What to do

  Update Cross-site scripting (XSS) vulnerability in the ZenLite to 4.4 or newer.

  Full record and what to do →NVD recordsecunia.comsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Hybrid theme before 0.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpCVE-2011-3853 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Hybrid theme before 0.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the Hybrid

  Fixed in

  0.10

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Hybrid to 0.10 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the EvoLve theme before 1.2.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sCVE-2011-3852 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the EvoLve theme before 1.2.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the EvoLve

  Fixed in

  1.2.6

  What to do

  Update Cross-site scripting (XSS) vulnerability in the EvoLve to 1.2.6 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the News theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpageCVE-2011-3851 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the News theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the News

  Fixed in

  0.2

  What to do

  Update Cross-site scripting (XSS) vulnerability in the News to 0.2 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.