Vulnerability database

360 results · page 8 of 8

• Jul 1, 2014Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX plugin before 2.1.1 for WordPress allows remote attackers to inject arbitrarCVE-2014-4521 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX plugin before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.

  Product

  Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX

  Fixed in

  2.1.1

  What to do

  Update Cross-site scripting (XSS) vulnerability in client-assist.php in the dsIDXpress IDX to 2.1.1 or newer.

  Full record and what to do →NVD recordcodevigilant.comwordpress.org

• Feb 27, 2014SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress alCVE-2014-1854 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in library/clicktracker.php in the AdRotate Pro plugin 3.9 through 3.9.5 and AdRotate Free plugin 3.9 through 3.9.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter.

  Affected

  up to 3.9.5

  What to do

  Affects up to 3.9.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsecunia.comadrotateplugin.com

• Feb 7, 2013Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module before 1.9.4 for Wordpress allows remote attackers tCVE-2013-1463 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module before 1.9.4 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this might be the same vulnerability as CVE-2013-1808. If so, it is likely that CVE-2013-1463 will be REJECTed.

  Product

  Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module

  Fixed in

  1.9.4

  What to do

  Update Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module to 1.9.4 or newer.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com

• Sep 20, 2012clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for: Cross-site scripting (XSS)CVE-2011-5181 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cdwidgetid parameter. NOTE: some of these details are obtained from third party information.

  Product

  clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for

  What to do

  Update clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for to the newest version.

  Full record and what to do →NVD recordosvdb.orgwordpress.org

• Aug 13, 2012Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to injectCVE-2012-4273 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter.

  Product

  Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons

  Fixed in

  0.34

  What to do

  Update Cross-site scripting (XSS) vulnerability in libs/xing.php in the 2 Click Social Media Buttons to 0.34 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.orgplugins.trac.wordpress.org

• Aug 13, 2012Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allow remote attackers to inject arbitrCVE-2012-4272 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the "processing of the buttons of Xing and Pinterest".

  Product

  Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons

  Fixed in

  0.34

  What to do

  Update Multiple cross-site scripting (XSS) vulnerabilities in the 2 Click Social Media Buttons to 0.34 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org

• Jun 27, 2012The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which CVE-2011-4957 · WordPress plugins & themes · reported by Red HatMedium 5

  The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attackers to cause a denial of service (crash) via a comment with a crafted URL that triggers many recursive calls.

  Fixed in

  3.1.1

  What to do

  Update the plugin to 3.1.1 or newer.

  Full record and what to do →NVD recordcore.trac.wordpress.orgsecunia.com

• Apr 21, 2012wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conductCVE-2012-2403 · WordPress plugins & themes · reported by MITREMedium 4.3

  wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

  Fixed in

  3.3.2

  What to do

  Update the plugin to 3.3.2 or newer.

  Full record and what to do →NVD recordcore.trac.wordpress.orgcore.trac.wordpress.org

• Sep 11, 2009Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortion, which aCVE-2008-7216 · WordPress plugins & themes · reported by MITREMedium 4.3

  Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortion, which allows remote attackers to bypass CAPTCHA protection by reading certain bytes from the generated clip.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recorddocs.google.comsecurityfocus.com

• Jan 31, 2008adclick.php in the AdServe 0.2 plugin for: SQL injectionCVE-2008-0507 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in adclick.php in the AdServe 0.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  Product

  adclick.php in the AdServe 0.2 plugin for

  What to do

  Update adclick.php in the AdServe 0.2 plugin for to the newest version.

  Full record and what to do →NVD recordsecunia.comsecurityfocus.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.