Vulnerability database

2,119 results · page 40 of 43

• Aug 13, 2012Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allow remote attackers to iCVE-2012-4264 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "server variables," a different vulnerability than CVE-2012-4263.

  Product

  Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security)

  Fixed in

  3.2.5

  What to do

  Update Multiple cross-site scripting (XSS) vulnerabilities in the Better WP Security (better_wp_security) to 3.2.5 or newer.

  Full record and what to do →NVD recordbit51.complugins.trac.wordpress.org

• Aug 13, 2012Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allows remoteCVE-2012-4263 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security) plugin before 3.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP_USER_AGENT header.

  Product

  Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security)

  Fixed in

  3.2.5

  What to do

  Update Cross-site scripting (XSS) vulnerability in inc/admin/content.php in the Better WP Security (better_wp_security) to 3.2.5 or newer.

  Full record and what to do →NVD recordbit51.compacketstormsecurity.org

• Aug 13, 2012Cross-site scripting (XSS) vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTMCVE-2012-2371 · WordPress plugins & themes · reported by Red HatMedium 4.3

  Cross-site scripting (XSS) vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pagination_wp_facethumb parameter.

  Product

  WP-FaceThumb

  What to do

  Update WP-FaceThumb to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com

• Jul 22, 2012WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain CVE-2012-3385 · WordPress plugins & themes · reported by Red HatMedium 5

  WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors.

  Fixed in

  3.4.1

  What to do

  Update the plugin to 3.4.1 or newer.

  Full record and what to do →NVD recordcodex.wordpress.orgopenwall.com

• Jun 27, 2012Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute arbitrary PHP code CVE-2012-3814 · WordPress plugins & themes · reported by MITREHigh 7.5

  Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a .php.ttf extension, then accessing it via a direct request to the file in font-uploader/fonts.

  Product

  Font Uploader

  What to do

  Update Font Uploader to the newest version.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• Jun 19, 2012Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2012-3588 · WordPress plugins & themes · reported by MITREMedium 5

  Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter.

  Product

  Plugin Newsletter

  What to do

  Update Plugin Newsletter to the newest version.

  Full record and what to do →NVD recordsecunia.comexploit-db.com

• Jun 16, 2012Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbiCVE-2012-3578 · WordPress plugins & themes · reported by MITREMedium 6.8

  Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in html/images.

  Product

  FCChat Widget

  Affected

  up to 2.2.13.1

  What to do

  Affects up to 2.2.13.1. Update FCChat Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com

• Jun 16, 2012Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbiCVE-2012-3577 · WordPress plugins & themes · reported by MITREHigh 7.5

  Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation plugin before 1.4 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/user_uploads.

  Product

  Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation

  Fixed in

  1.4

  What to do

  Update Unrestricted file upload vulnerability in doupload.php in the Nmedia Member Conversation to 1.4 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com

• Jun 15, 2012Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary codeCVE-2012-3576 · WordPress plugins & themes · reported by MITREHigh 10

  Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/wpstorecart.

  Product

  Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart

  Fixed in

  2.5.30

  What to do

  Update Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart to 2.5.30 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Jun 15, 2012Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code by uploadinCVE-2012-3575 · WordPress plugins & themes · reported by MITREHigh 10

  Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/rbxslider.

  Product

  RBX Gallery

  What to do

  Update RBX Gallery to the newest version.

  Full record and what to do →NVD recordsecunia.comexploit-db.com

• Jun 15, 2012Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote attackers to inject arbitrary web script CVE-2012-2633 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 4.3

  Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.

  Product

  Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp

  Fixed in

  1.8.3.1

  What to do

  Update Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp to 1.8.3.1 or newer.

  Full record and what to do →NVD recordjvn.jpjvndb.jvn.jp

• May 22, 2012Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) plugin before 3.0.4.1 for WordPress allows remote aCVE-2012-2759 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) plugin before 3.0.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the callback parameter in a lostpassword action to wp-login.php.

  Product

  Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax)

  Fixed in

  3.0.4.1

  What to do

  Update Cross-site scripting (XSS) vulnerability in login-with-ajax.php in the Login With Ajax (aka login-with-ajax) to 3.0.4.1 or newer.

  Full record and what to do →NVD recordosvdb.orgplugins.trac.wordpress.org

• May 21, 2012Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via CVE-2012-2917 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key (cnd-key) in a share-and-follow-menu page to wp-admin/admin.php.

  Product

  Share and Follow

  What to do

  Update Share and Follow to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.orgsecurityfocus.com

• May 21, 2012Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2012-2916 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the active_option parameter to wp-admin/tools.php.

  Product

  Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE

  Fixed in

  2.1

  What to do

  Update Cross-site scripting (XSS) vulnerability in sabre_class_admin.php in the SABRE to 2.1 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.orgplugins.trac.wordpress.org

• May 21, 2012Multiple cross-site scripting (XSS) vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via CVE-2012-2913 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) leaflet_layer.php or (2) leaflet_marker.php, as reachable through wp-admin/admin.php.

  Product

  Leaflet

  What to do

  Update Leaflet to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.orgsecurityfocus.com

• May 21, 2012Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML CVE-2012-2912 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) group parameter in the show-league page or (2) season parameter in the team page to wp-admin/admin.php.

  Product

  LeagueManager

  What to do

  Update LeagueManager to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.orgsecurityfocus.com

• Apr 21, 2012wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attaCVE-2012-2404 · WordPress plugins & themes · reported by MITREMedium 4.3

  wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

  Fixed in

  3.3.2

  What to do

  Update the plugin to 3.3.2 or newer.

  Full record and what to do →NVD recordcore.trac.wordpress.orgosvdb.org

• Apr 21, 2012wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conductCVE-2012-2403 · WordPress plugins & themes · reported by MITREMedium 4.3

  wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

  Fixed in

  3.3.2

  What to do

  Update the plugin to 3.3.2 or newer.

  Full record and what to do →NVD recordcore.trac.wordpress.orgcore.trac.wordpress.org

• Apr 21, 2012wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-widCVE-2012-2402 · WordPress plugins & themes · reported by MITREMedium 5.5

  wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors.

  Fixed in

  3.3.2

  What to do

  Update the plugin to 3.3.2 or newer.

  Full record and what to do →NVD recordcore.trac.wordpress.orgosvdb.org

• Mar 19, 2012The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknoCVE-2012-1786 · WordPress plugins & themes · reported by MITREMedium 5

  The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors.

  Product

  Media Upload form in the Video Embed & Thumbnail Generator

  Fixed in

  2.0

  What to do

  Update Media Upload form in the Video Embed & Thumbnail Generator to 2.0 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Mar 19, 2012kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecifiedCVE-2012-1785 · WordPress plugins & themes · reported by MITREHigh 7.5

  kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors.

  Product

  kg_callffmpeg.php in the Video Embed & Thumbnail Generator

  Fixed in

  2.0

  What to do

  Update kg_callffmpeg.php in the Video Embed & Thumbnail Generator to 2.0 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Mar 19, 2012Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2011-5082 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2member_pro_authnet_checkout[coupon] parameter (aka Coupon Code field).

  Product

  s2Member Pro

  Fixed in

  111220

  What to do

  Update s2Member Pro to 111220 or newer.

  Full record and what to do →NVD recordsecunia.comprimothemes.com

• Feb 24, 2012PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary CVE-2012-1205 · WordPress plugins & themes · reported by MITREHigh 7.5

  PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.

  Product

  PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload

  Fixed in

  0.20

  What to do

  Update PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload to 0.20 or newer.

  Full record and what to do →NVD recordosvdb.orgplugins.trac.wordpress.org

• Feb 14, 2012Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers CVE-2012-1068 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging.

  Product

  Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments

  Fixed in

  2.0.7

  What to do

  Update Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments to 2.0.7 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Feb 14, 2012SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter iCVE-2012-1067 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  Product

  WP-RecentComments

  What to do

  Update WP-RecentComments to the newest version.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• Feb 7, 2012actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP codCVE-2012-1011 · WordPress plugins & themes · reported by MITREHigh 7.5

  actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.

  Product

  AllWebMenus

  What to do

  Update AllWebMenus to the newest version.

  Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com

• Feb 7, 2012Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP codeCVE-2012-1010 · WordPress plugins & themes · reported by MITREHigh 7.5

  Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory.

  Product

  Unrestricted file upload vulnerability in actions.php in the AllWebMenus

  Fixed in

  1.1.8

  What to do

  Update Unrestricted file upload vulnerability in actions.php in the AllWebMenus to 1.1.8 or newer.

  Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com

• Jan 30, 2012Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attacCVE-2012-0782 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance

  Affected

  up to 3.3.1

  What to do

  Affects up to 3.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordarchives.neohapsis.comexploit-db.com

• Jan 28, 2012ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8: PHP remote file inclusionCVE-2012-0934 · WordPress plugins & themes · reported by MITREHigh 7.5

  PHP remote file inclusion vulnerability in ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the tt-abspath parameter.

  Product

  ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8

  Fixed in

  0.8

  What to do

  Update ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8 to 0.8 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Jan 20, 2012Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2012-0898 · WordPress plugins & themes · reported by MITREMedium 5

  Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dwn_file parameter.

  Product

  myEASYbackup

  What to do

  Update myEASYbackup to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com

• Jan 20, 2012Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files viaCVE-2012-0896 · WordPress plugins & themes · reported by MITREMedium 5

  Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter.

  Product

  Absolute path traversal vulnerability in download.php in the Count Per Day module

  Fixed in

  3.1.1

  What to do

  Update Absolute path traversal vulnerability in download.php in the Count Per Day module to 3.1.1 or newer.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org

• Jan 20, 2012Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2012-0895 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map parameter.

  Product

  Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module

  Fixed in

  3.1.1

  What to do

  Update Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module to 3.1.1 or newer.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org

• Jan 4, 2012Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uCVE-2011-5051 · WordPress plugins & themes · reported by MITREHigh 7.5

  Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension using (1) uploadify/upload_admin_avatar.php or (2) uploadify/upload_profile_avatar.php, then accessing it via a direct request to the file in an unspecified directory inside the webroot.

  Product

  Multiple unrestricted file upload vulnerabilities in the WP Symposium

  Fixed in

  11.12.24

  What to do

  Update Multiple unrestricted file upload vulnerabilities in the WP Symposium to 11.12.24 or newer.

  Full record and what to do →NVD recordosvdb.orgosvdb.org

• Dec 27, 2011Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers toCVE-2011-3841 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3

  Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers to inject arbitrary web script or HTML via the uid parameter.

  Product

  Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium

  Fixed in

  11.12.08

  What to do

  Update Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium to 11.12.08 or newer.

  Full record and what to do →NVD recordsecunia.comsecunia.com

• Nov 30, 2011SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote aCVE-2011-4646 · WordPress plugins & themes · reported by MITREMedium 6

  SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote authenticated users with the Author role to execute arbitrary SQL commands via the id attribute of the ratings shortcode when creating a post. NOTE: some of these details are obtained from third party information.

  Product

  SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions

  Fixed in

  1.62

  What to do

  Update SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions to 1.62 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Nov 29, 2011Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrCVE-2011-4568 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI.

  Product

  Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer

  Fixed in

  1.2.12

  What to do

  Update Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer to 1.2.12 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Oct 7, 2011Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote CVE-2010-4875 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gid parameter.

  Product

  Vodpod Video Gallery

  What to do

  Update Vodpod Video Gallery to the newest version.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org

• Oct 4, 2011PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via aCVE-2011-3981 · WordPress plugins & themes · reported by MITREHigh 7.5

  PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.

  Product

  Allwebmenus

  What to do

  Update Allwebmenus to the newest version.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2011-3865 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.

  Product

  Cross-site scripting (XSS) vulnerability in the Black-LetterHead

  Fixed in

  1.6

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Black-LetterHead to 1.6 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the The Erudite theme before 2.7.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via CVE-2011-3864 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the The Erudite theme before 2.7.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the The Erudite

  Fixed in

  2.7.9

  What to do

  Update Cross-site scripting (XSS) vulnerability in the The Erudite to 2.7.9 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sCVE-2011-3863 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the RedLine

  Fixed in

  1.66

  What to do

  Update Cross-site scripting (XSS) vulnerability in the RedLine to 1.66 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2011-3862 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.

  Product

  Cross-site scripting (XSS) vulnerability in the Morning Coffee

  Fixed in

  3.6

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Morning Coffee to 3.6 or newer.

  Full record and what to do →NVD recordsecunia.comsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HCVE-2011-3861 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.

  Product

  Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901

  Fixed in

  1.2

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 to 1.2 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via theCVE-2011-3860 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the Cover WP

  Fixed in

  1.6.6

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Cover WP to 1.6.6 or newer.

  Full record and what to do →NVD recordsecurityfocus.comsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cCVE-2011-3859 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the Trending

  Fixed in

  0.2

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Trending to 0.2 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML viaCVE-2011-3858 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the Pixiv Custom

  Fixed in

  2.1.6

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Pixiv Custom to 2.1.6 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via theCVE-2011-3857 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the Antisnews

  Fixed in

  1.10

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Antisnews to 1.10 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML vCVE-2011-3856 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the Elegant Grunge

  Fixed in

  1.0.4

  What to do

  Update Cross-site scripting (XSS) vulnerability in the Elegant Grunge to 1.0.4 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CVE-2011-3855 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the F8 Lite

  Fixed in

  4.2.2

  What to do

  Update Cross-site scripting (XSS) vulnerability in the F8 Lite to 4.2.2 or newer.

  Full record and what to do →NVD recordsitewat.chsitewat.ch

• Sep 28, 2011Cross-site scripting (XSS) vulnerability in the ZenLite theme before 4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s CVE-2011-3854 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the ZenLite theme before 4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.

  Product

  Cross-site scripting (XSS) vulnerability in the ZenLite

  Fixed in

  4.4

  What to do

  Update Cross-site scripting (XSS) vulnerability in the ZenLite to 4.4 or newer.

  Full record and what to do →NVD recordsecunia.comsitewat.ch

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.