Vulnerability database

3,906 results · page 78 of 79

• Mar 5, 2015Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.CVE-2014-9688 · WordPress plugins & themes · reported by MITREHigh 7.5

  Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.

  Product

  Unspecified vulnerability in the Ninja Forms

  Fixed in

  2.8.10

  What to do

  Update Unspecified vulnerability in the Ninja Forms to 2.8.10 or newer.

  Full record and what to do →NVD recordwordpress.orgwordpress.org

• Feb 20, 2015Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPress allows remote atCVE-2015-2040 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit_time parameter in the CF7DBPluginSubmissions page to wp-admin/admin.php.

  Product

  Contact Form DB (aka CFDB and contact-form-7-to-database-extension)

  Affected

  2.8.26 to 2.8.26

  What to do

  Affects 2.8.26 to 2.8.26. Update Contact Form DB (aka CFDB and contact-form-7-to-database-extension) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Feb 20, 2015Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the CVE-2015-2039 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or (2) conduct cross-site scripting (XSS) attacks via the acobot_token parameter in the acobot page to wp-admin/options-general.php.

  Product

  Acobot Live Chat & Contact Form

  Affected

  2.0 to 2.0

  What to do

  Affects 2.0 to 2.0. Update Acobot Live Chat & Contact Form to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Jan 7, 2015Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to execute arbitrary codCVE-2014-9473 · WordPress plugins & themes · reported by MITREHigh 7.5

  Unrestricted file upload vulnerability in lib_nonajax.php in the CformsII plugin 14.7 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the cf_uploadfile2[] parameter, then accessing the file via a direct request to the file in the default upload directory.

  Product

  CformsII

  Affected

  up to 14.7

  What to do

  Affects up to 14.7. Update CformsII to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsecurityfocus.comwordpress.org

• Nov 17, 2014Cross-site scripting (XSS) vulnerability in the Contact Form Clean and Simple (clean-and-simple-contact-form-by-meg-nicholas) plugin 4.4.0 and earlier for WordPCVE-2014-8955 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Contact Form Clean and Simple (clean-and-simple-contact-form-by-meg-nicholas) plugin 4.4.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the cscf[name] parameter to contact-us/.

  Product

  Contact Form Clean and Simple (clean-and-simple-contact-form-by-meg-nicholas)

  Affected

  up to 4.4.0

  What to do

  Affects up to 4.4.0. Update Contact Form Clean and Simple (clean-and-simple-contact-form-by-meg-nicholas) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com

• Oct 10, 2014Multiple cross-site scripting (XSS) vulnerabilities in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.16 for WordPresCVE-2014-7139 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.16 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) form or (2) enc parameter in the CF7DBPluginShortCodeBuilder page to wp-admin/admin.php.

  Fixed in

  2.8.16

  What to do

  Update the plugin to 2.8.16 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com

• Sep 26, 2014Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web scriCVE-2014-7152 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the update_options action to wp-admin/admin-ajax.php.

  Product

  Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0

  Affected

  up to 5.0.6

  What to do

  Affects up to 5.0.6. Update Cross-site scripting (XSS) vulnerability in the Easy MailChimp Forms plugin 3.0 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordresearch.g0blin.co.ukwordpress.org

• Sep 26, 2014The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary fiCVE-2014-6446 · WordPress plugins & themes · reported by MITREHigh 7.5

  The Infusionsoft Gravity Forms plugin 1.5.3 through 1.5.10 for WordPress does not properly restrict access, which allows remote attackers to upload arbitrary files and execute arbitrary PHP code via a request to utilities/code_generator.php.

  Product

  Infusionsoft Gravity Forms plugin 1.5.3

  Affected

  up to 1.5.10

  What to do

  Affects up to 1.5.10. Update Infusionsoft Gravity Forms plugin 1.5.3 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com

• Sep 26, 2014Multiple cross-site scripting (XSS) vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 through 1.3.10 for WordPress allow remote CVE-2014-6445 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 through 1.3.10 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) uE or (2) uC parameter.

  Product

  Multiple cross-site scripting (XSS) vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0

  Affected

  up to 1.3.10

  What to do

  Affects up to 1.3.10. Update Multiple cross-site scripting (XSS) vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordresearch.g0blin.co.ukwordpress.org

• Jul 11, 2014The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinCVE-2014-4942 · WordPress plugins & themes · reported by MITREMedium 5

  The EasyCart (wp-easycart) plugin before 2.0.6 for WordPress allows remote attackers to obtain configuration information via a direct request to inc/admin/phpinfo.php, which calls the phpinfo function.

  Product

  EasyCart (wp-easycart)

  Fixed in

  2.0.6

  What to do

  Update EasyCart (wp-easycart) to 2.0.6 or newer.

  Full record and what to do →NVD recordcodevigilant.complugins.trac.wordpress.org

• Jul 2, 2014Cross-site scripting (XSS) vulnerability in fonts/font-form.php in the Style It plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitraryCVE-2014-4555 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in fonts/font-form.php in the Style It plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.

  Product

  Style It

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Style It to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodevigilant.comcodevigilant.com

• Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in forms/search.php in the WP-Business Directory (wp-ttisbdir) plugin 1.0.2 and earlier for WordPress allow CVE-2014-4599 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in forms/search.php in the WP-Business Directory (wp-ttisbdir) plugin 1.0.2 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) edit, (2) search_term, (3) page_id, (4) page, or (5) page_links parameter.

  Product

  WP-Business Directory (wp-ttisbdir)

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update WP-Business Directory (wp-ttisbdir) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodevigilant.comcodevigilant.com

• Jul 2, 2014Cross-site scripting (XSS) vulnerability in oleggo-twitter/twitter_login_form.php in the Oleggo LiveStream plugin 0.2.6 and earlier for WordPress allows remote CVE-2014-4540 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in oleggo-twitter/twitter_login_form.php in the Oleggo LiveStream plugin 0.2.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

  Product

  Oleggo LiveStream

  Affected

  up to 0.2.6

  What to do

  Affects up to 0.2.6. Update Oleggo LiveStream to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodevigilant.comcodevigilant.com

• Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in paginas/vista-previa-form.php in the EnvialoSimple: Email Marketing and Newsletters (envialosimple-email-CVE-2014-4527 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in paginas/vista-previa-form.php in the EnvialoSimple: Email Marketing and Newsletters (envialosimple-email-marketing-y-newsletters-gratis) plugin before 1.98 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) FormID or (2) AdministratorID parameter.

  Fixed in

  1.98

  What to do

  Update the plugin to 1.98 or newer.

  Full record and what to do →NVD recordcodevigilant.complugins.trac.wordpress.org

• Jul 1, 2014Multiple cross-site scripting (XSS) vulnerabilities in forms/messages.php in the WP-Contact (wp-contact-sidebar-widget) plugin 1.0 and earlier for WordPress allCVE-2014-4583 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in forms/messages.php in the WP-Contact (wp-contact-sidebar-widget) plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) edit, (2) order_direction, (3) limit_start, (4) id, or (5) order parameter.

  Product

  WP-Contact (wp-contact-sidebar-widget)

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update WP-Contact (wp-contact-sidebar-widget) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodevigilant.comcodevigilant.com

• Jul 1, 2014Cross-site scripting (XSS) vulnerability in xd_resize.php in the Contact Form by ContactMe.com plugin 2.3 and earlier for WordPress allows remote attackers to iCVE-2014-4518 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in xd_resize.php in the Contact Form by ContactMe.com plugin 2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the width parameter.

  Product

  Contact Form by ContactMe.com

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Contact Form by ContactMe.com to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordcodevigilant.comcodevigilant.com

• May 22, 2014SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for WordPress allows remote authenticated userCVE-2014-3210 · WordPress plugins & themes · reported by MITREMedium 6.5

  SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) plugin before 1.3 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the booking_form_id parameter to wp-admin/admin-ajax.php.

  Product

  SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar)

  Fixed in

  1.3

  What to do

  Update SQL injection vulnerability in dopbs-backend-forms.php in the Booking System (Booking Calendar) to 1.3 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.comwordpress.org

• Mar 14, 2014Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcfCVE-2014-2265 · WordPress plugins & themes · reported by MITREMedium 5

  Rock Lobster Contact Form 7 before 3.7.2 allows remote attackers to bypass the CAPTCHA protection mechanism and submit arbitrary form data by omitting the _wpcf7_captcha_challenge_captcha-719 parameter.

  Fixed in

  3.7.2

  What to do

  Update the plugin to 3.7.2 or newer.

  Full record and what to do →NVD recordcontactform7.comweb.archive.org

• Jan 20, 2014wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions viaCVE-2012-6634 · WordPress plugins & themes · reported by MITREMedium 6.4

  wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a post_id value.

  Fixed in

  3.3.3

  What to do

  Update the plugin to 3.3.3 or newer.

  Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org

• Jan 20, 2014wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticated users to perform CVE-2011-5270 · WordPress plugins & themes · reported by MITREMedium 4

  wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticated users to perform publish actions by leveraging the Contributor role.

  Fixed in

  3.0.6

  What to do

  Update the plugin to 3.0.6 or newer.

  Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org

• Jan 8, 2014Cross-site scripting (XSS) vulnerability in inc/raf_form.php in the Recommend to a friend plugin 2.0.2 for WordPress allows remote attackers to inject arbitraryCVE-2013-7276 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in inc/raf_form.php in the Recommend to a friend plugin 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the current_url parameter.

  Product

  Recommend to a friend

  What to do

  Update Recommend to a friend to the newest version.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com

• Dec 20, 2013SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via thCVE-2013-7187 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  Product

  FormCraft

  Affected

  up to 1.3.7

  What to do

  Affects up to 1.3.7. Update FormCraft to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.comsecunia.com

• Jul 8, 2013WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, CVE-2013-2203 · WordPress plugins & themes · reported by Red HatMedium 4.3

  WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message.

  Fixed in

  3.5.2

  What to do

  Update the plugin to 3.5.2 or newer.

  Full record and what to do →NVD recordcodex.wordpress.orgwordpress.org

• Apr 2, 2013importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which caCVE-2013-2744 · WordPress plugins & themes · reported by MITREMedium 5

  importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which calls the phpinfo function.

  Product

  BackupBuddy

  What to do

  Update BackupBuddy to the newest version.

  Full record and what to do →NVD recordarchives.neohapsis.compacketstormsecurity.com

• Jan 2, 2013wp-php-widget.php in the WP PHP widget plugin 1.0.2 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals thCVE-2013-0721 · WordPress plugins & themes · reported by MITREMedium 5

  wp-php-widget.php in the WP PHP widget plugin 1.0.2 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.

  Product

  WP PHP widget

  What to do

  Update WP PHP widget to the newest version.

  Full record and what to do →NVD recordosvdb.orgosvdb.org

• Dec 11, 2012simple-gmail-login.php in the Simple Gmail Login plugin before 1.1.4 for WordPress allows remote attackers to obtain sensitive information via a request that laCVE-2012-6313 · WordPress plugins & themes · reported by MITREMedium 5

  simple-gmail-login.php in the Simple Gmail Login plugin before 1.1.4 for WordPress allows remote attackers to obtain sensitive information via a request that lacks a timezone, leading to disclosure of the installation path in a stack trace.

  Product

  simple-gmail-login.php in the Simple Gmail Login

  Fixed in

  1.1.4

  What to do

  Update simple-gmail-login.php in the Simple Gmail Login to 1.1.4 or newer.

  Full record and what to do →NVD recordarchives.neohapsis.comwordpress.org

• Dec 11, 2012the Video Lead Form plugin for: Cross-site scripting (XSS)CVE-2012-6312 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php.

  Product

  the Video Lead Form plugin for

  What to do

  Update the Video Lead Form plugin for to the newest version.

  Full record and what to do →NVD recordarchives.neohapsis.comwordpress.org

• Sep 14, 2012wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a nCVE-2012-4422 · WordPress plugins & themes · reported by Red HatLow 3.5

  wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveraging the Administrator role.

  Fixed in

  3.4.2

  What to do

  Update the plugin to 3.4.2 or newer.

  Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org

• Sep 14, 2012The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticateCVE-2012-4421 · WordPress plugins & themes · reported by Red HatMedium 4

  The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticated users to bypass intended access restrictions and publish new posts by leveraging the Contributor role and using the Atom Publishing Protocol (aka AtomPub) feature.

  Fixed in

  3.4.2

  What to do

  Update the plugin to 3.4.2 or newer.

  Full record and what to do →NVD recordcodex.wordpress.orgcore.trac.wordpress.org

• Jun 27, 2012The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which CVE-2011-4957 · WordPress plugins & themes · reported by Red HatMedium 5

  The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attackers to cause a denial of service (crash) via a comment with a crafted URL that triggers many recursive calls.

  Fixed in

  3.1.1

  What to do

  Update the plugin to 3.1.1 or newer.

  Full record and what to do →NVD recordcore.trac.wordpress.orgsecunia.com

• Jun 15, 2012includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6 for: Unrestricted file uploadCVE-2012-3574 · WordPress plugins & themes · reported by MITREHigh 7.5

  Unrestricted file upload vulnerability in includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in upload/temp.

  Product

  includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6 for

  What to do

  Update includes/doajaxfileupload.php in the MM Forms Community plugin 2.2.5 and 2.2.6 for to the newest version.

  Full record and what to do →NVD recordsecunia.comexploit-db.com

• Apr 21, 2012wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conductCVE-2012-2403 · WordPress plugins & themes · reported by MITREMedium 4.3

  wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

  Fixed in

  3.3.2

  What to do

  Update the plugin to 3.3.2 or newer.

  Full record and what to do →NVD recordcore.trac.wordpress.orgcore.trac.wordpress.org

• Mar 19, 2012The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknoCVE-2012-1786 · WordPress plugins & themes · reported by MITREMedium 5

  The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors.

  Product

  Media Upload form in the Video Embed & Thumbnail Generator

  Fixed in

  2.0

  What to do

  Update Media Upload form in the Video Embed & Thumbnail Generator to 2.0 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Sep 23, 2011WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in anCVE-2011-3818 · WordPress plugins & themes · reported by MITREMedium 5

  WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by wp-admin/includes/user.php and certain other files.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordcode.google.comcode.google.com

• Dec 6, 2010The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php andCVE-2010-4403 · WordPress plugins & themes · reported by MITREMedium 5

  The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php and (2) register-plus.php, which reveals the installation path in an error message.

  Affected

  up to 3.5.1

  What to do

  Affects up to 3.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.orgwebsecurity.com.ua

• Nov 3, 2010Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject aCVE-2010-3977 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordsecunia.comconviso.com.br

• Dec 2, 2009WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.CVE-2009-4170 · WordPress plugins & themes · reported by MITREMedium 5

  WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.php, probably without parameters, which reveals the installation path in an error message.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordwebsecurity.com.uasecurityfocus.com

• Aug 18, 2009Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advancCVE-2009-2853 · WordPress plugins & themes · reported by MITREHigh 10

  Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-form-comment.php, (5) edit-link-category-form.php, (6) edit-link-form.php, (7) edit-page-form.php, and (8) edit-tag-form.php in wp-admin/.

  Fixed in

  2.8.3

  What to do

  Update the plugin to 2.8.3 or newer.

  Full record and what to do →NVD recordcore.trac.wordpress.orgcore.trac.wordpress.org

• Jul 10, 2009WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the instalCVE-2009-2432 · WordPress plugins & themes · reported by MITREMedium 5

  WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an error message.

  Fixed in

  2.8.1

  What to do

  Update the plugin to 2.8.1 or newer.

  Full record and what to do →NVD recordcorelabs.coresecurity.comsecuritytracker.com

• Jul 10, 2009WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML souCVE-2009-2431 · WordPress plugins & themes · reported by MITREMedium 5

  WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordcorelabs.coresecurity.comsecuritytracker.com

• Feb 4, 2008cforms-css.php in Oliver Seidel cforms: PHP remote file inclusionCVE-2008-0560 · WordPress plugins & themes · reported by MITREMedium 6.8

  PHP remote file inclusion vulnerability in cforms-css.php in Oliver Seidel cforms (contactforms), a Wordpress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the tm parameter. NOTE: CVE disputes this issue for 7.3, since there is no tm parameter, and the code exits with a fatal error due to a call to an undefined function

  Product

  cforms-css.php in Oliver Seidel cforms

  What to do

  Update cforms-css.php in Oliver Seidel cforms to the newest version.

  Full record and what to do →NVD recordsecurityreason.comattrition.org

• Jan 9, 2008WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the default URI, which revealsCVE-2008-0191 · WordPress plugins & themes · reported by MITREMedium 5

  WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the default URI, which reveals the full path and the SQL database structure.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordlists.grok.org.uksecurityreason.com

• Jan 9, 2008WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-adCVE-2008-0195 · WordPress plugins & themes · reported by MITREMedium 5

  WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals the path in various error messages.

  Affected

  up to 2.0.11

  What to do

  Affects up to 2.0.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordlists.grok.org.uksecurityreason.com

• Jan 9, 2008Multiple cross-site scripting (XSS) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress CVE-2008-0197 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) wpcf_email, (2) wpcf_subject, (3) wpcf_question, (4) wpcf_answer, (5) wpcf_success_msg, (6) wpcf_error_msg, or (7) wpcf_msg parameter to wp-admin/admin.php, or (8) the SRC attribute of an IFRAME element.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordlists.grok.org.uksecurityreason.com

• Jan 9, 2008Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WorCVE-2008-0198 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site request forgery (CSRF) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to perform actions as administrators via the (1) wpcf_question, (2) wpcf_success_msg, or (3) wpcf_error_msg parameter to wp-admin/admin.php.

  Affected

  1.5 to 1.5

  What to do

  Affects 1.5 to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordlists.grok.org.uksecurityreason.com

• Jul 9, 2007WordPress before 2.2.2 allows remote attackers to redirect visitors to other websites and potentially obtain sensitive information via (1) the _wp_http_referer CVE-2007-3639 · WordPress plugins & themes · reported by MITREMedium 4

  WordPress before 2.2.2 allows remote attackers to redirect visitors to other websites and potentially obtain sensitive information via (1) the _wp_http_referer parameter to wp-pass.php, related to the wp_get_referer function in wp-includes/functions.php; and possibly other vectors related to (2) wp-includes/pluggable.php and (3) the wp_nonce_ays function in wp-includes/functions.php.

  Fixed in

  2.2.2

  What to do

  Update the plugin to 2.2.2 or newer.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• Jun 14, 2007Cross-site scripting (XSS) vulnerability in searchform.php in the AndyBlue theme before 20070607 for WordPress allows remote attackers to inject arbitrary web sCVE-2007-3239 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in searchform.php in the AndyBlue theme before 20070607 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF portion of a URI to index.php. NOTE: this can be leveraged for PHP code execution in an administrative session.

  Product

  AndyBlue

  Fixed in

  20070607

  What to do

  Update AndyBlue to 20070607 or newer.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• Mar 22, 2007wp-login.php in WordPress allows remote attackers to redirect authenticated users to other websites and potentially obtain sensitive information via the redirecCVE-2007-1599 · WordPress plugins & themes · reported by MITREMedium 6.5

  wp-login.php in WordPress allows remote attackers to redirect authenticated users to other websites and potentially obtain sensitive information via the redirect_to parameter.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordsecunia.comdebian.org

• Mar 10, 2007WordPress allows remote attackers to obtain sensitive information via a direct request for wp-admin/admin-functions.php, which reveals the path in an error messCVE-2007-1409 · WordPress plugins & themes · reported by MITREMedium 5

  WordPress allows remote attackers to obtain sensitive information via a direct request for wp-admin/admin-functions.php, which reveals the path in an error message.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordsecunia.comgentoo.org

• Jan 8, 2007wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive informaCVE-2007-0109 · WordPress plugins & themes · reported by MITREMedium 5

  wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks.

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.