Vulnerability database

1,207 results · page 25 of 25

• Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in yupdates_application.php in the Yahoo! Updates for WordPress plugin 1.0 and earlier for WordPress allow rCVE-2014-4603 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in yupdates_application.php in the Yahoo! Updates for WordPress plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) secret, (2) key, or (3) appid parameter.

  Product

  Yahoo! Updates for

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Yahoo! Updates for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodevigilant.comsecurityfocus.com

• Jul 1, 2014Cross-site scripting (XSS) vulnerability in check.php in the Validated plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web scCVE-2014-4564 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in check.php in the Validated plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the slug parameter.

  Product

  Validated

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Validated to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodevigilant.comcodevigilant.com

• May 22, 2014Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of CVE-2013-2107 · WordPress plugins & themes · reported by Red HatMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdate_mailto parameter in the mail-on-update page to wp-admin/options-general.php. NOTE: a third party claims that 5.2.1 and 5.2.2 are also vulnerable, but the issue might require a separate CVE identifier since this might reflect an incomplete fix.

  Product

  Cross-site request forgery (CSRF) vulnerability in the Mail On Update

  Fixed in

  5.2.0

  What to do

  Update Cross-site request forgery (CSRF) vulnerability in the Mail On Update to 5.2.0 or newer.

  Full record and what to do →NVD recordosvdb.orgseclists.org

• Apr 9, 2014The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of aCVE-2014-0166 · WordPress plugins & themes · reported by Red HatMedium 6.4

  The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.

  Fixed in

  3.7.2

  What to do

  Update the plugin to 3.7.2 or newer.

  Full record and what to do →NVD recordcodex.wordpress.orgcodex.wordpress.org

• Sep 12, 2013WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictionsCVE-2013-4339 · WordPress plugins & themes · reported by Red HatHigh 7.5

  WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted string.

  Fixed in

  3.6.1

  What to do

  Update the plugin to 3.6.1 or newer.

  Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org

• Dec 27, 2012WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discoverCVE-2012-5868 · WordPress plugins & themes · reported by MITRELow 2.6

  WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordwhiteoaksecurity.comwhiteoaksecurity.com

• Dec 19, 2008wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remoteCVE-2008-5695 · WordPress plugins & themes · reported by MITREHigh 8.5

  wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated users with manage_options and upload_files capabilities to execute arbitrary code by uploading a PHP script and adding this script's pathname to active_plugins.

  Affected

  up to 2.3.2

  Fixed in

  1.3.2

  What to do

  Update the plugin to 1.3.2 or newer.

  Full record and what to do →NVD recordmu.wordpress.orgsecunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.