Vulnerability database

4,896 results · page 97 of 98

• Jan 20, 2012Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2012-0898 · WordPress plugins & themes · reported by MITREMedium 5

  Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dwn_file parameter.

  Product

  myEASYbackup

  What to do

  Update myEASYbackup to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com

• Jan 4, 2012Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uCVE-2011-5051 · WordPress plugins & themes · reported by MITREHigh 7.5

  Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension using (1) uploadify/upload_admin_avatar.php or (2) uploadify/upload_profile_avatar.php, then accessing it via a direct request to the file in an unspecified directory inside the webroot.

  Product

  Multiple unrestricted file upload vulnerabilities in the WP Symposium

  Fixed in

  11.12.24

  What to do

  Update Multiple unrestricted file upload vulnerabilities in the WP Symposium to 11.12.24 or newer.

  Full record and what to do →NVD recordosvdb.orgosvdb.org

• Dec 27, 2011Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers toCVE-2011-3841 · WordPress plugins & themes · reported by PSIRT-CNA@flexerasoftware.comMedium 4.3

  Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers to inject arbitrary web script or HTML via the uid parameter.

  Product

  Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium

  Fixed in

  11.12.08

  What to do

  Update Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium to 11.12.08 or newer.

  Full record and what to do →NVD recordsecunia.comsecunia.com

• Dec 13, 2011wptouch/ajax.php in the WPTouch plugin for: SQL injectionCVE-2011-4803 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in wptouch/ajax.php in the WPTouch plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  Product

  wptouch/ajax.php in the WPTouch plugin for

  What to do

  Update wptouch/ajax.php in the WPTouch plugin for to the newest version.

  Full record and what to do →NVD recordexploit-db.comexploit-db.com

• Dec 2, 2011modules/sharedaddy.php in the Jetpack plugin for: SQL injectionCVE-2011-4673 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  Product

  modules/sharedaddy.php in the Jetpack plugin for

  What to do

  Update modules/sharedaddy.php in the Jetpack plugin for to the newest version.

  Full record and what to do →NVD recordexploit-db.comsecurityfocus.com

• Dec 2, 2011adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8, for: SQL injectionCVE-2011-4671 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8, for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter (aka redirect URL).

  Product

  adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8, for

  Fixed in

  3.6.8

  What to do

  Update adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8, for to 3.6.8 or newer.

  Full record and what to do →NVD recorddownloads.wordpress.orgsecunia.com

• Dec 2, 2011wp-users.php in WordPress Users plugin 1.3 and possibly earlier for: SQL injectionCVE-2011-4669 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in wp-users.php in WordPress Users plugin 1.3 and possibly earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the uid parameter to index.php.

  Product

  wp-users.php in WordPress Users plugin 1.3 and possibly earlier for

  What to do

  Update wp-users.php in WordPress Users plugin 1.3 and possibly earlier for to the newest version.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Nov 30, 2011SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote aCVE-2011-4646 · WordPress plugins & themes · reported by MITREMedium 6

  SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote authenticated users with the Author role to execute arbitrary SQL commands via the id attribute of the ratings shortcode when creating a post. NOTE: some of these details are obtained from third party information.

  Product

  SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions

  Fixed in

  1.62

  What to do

  Update SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions to 1.62 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Nov 29, 2011Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrCVE-2011-4568 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer plugin before 1.2.12 for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI.

  Product

  Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer

  Fixed in

  1.2.12

  What to do

  Update Cross-site scripting (XSS) vulnerability in view/frontend-head.php in the Flowplayer to 1.2.12 or newer.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Nov 28, 2011Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WCVE-2011-4562 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header in a request to a post that does not exist.

  Product

  Redirection

  What to do

  Update Redirection to the newest version.

  Full record and what to do →NVD recorddotxed.netosvdb.org

• Oct 7, 2011Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote CVE-2010-4875 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in vodpod-video-gallery/vodpod_gallery_thumbs.php in the Vodpod Video Gallery Plugin 3.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the gid parameter.

  Product

  Vodpod Video Gallery

  What to do

  Update Vodpod Video Gallery to the newest version.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org

• Oct 4, 2011PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via aCVE-2011-3981 · WordPress plugins & themes · reported by MITREHigh 7.5

  PHP remote file inclusion vulnerability in actions.php in the Allwebmenus plugin 1.1.3 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.

  Product

  Allwebmenus

  What to do

  Update Allwebmenus to the newest version.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com

• Sep 13, 2011SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the evCVE-2010-4839 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in the Event Registration plugin 5.32 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the event_id parameter in a register action.

  Product

  Event Registration

  Affected

  up to 5.32

  What to do

  Affects up to 5.32. Update Event Registration to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsecunia.comexploit-db.com

• Apr 7, 2011lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for: Cross-site scripting (XSS)CVE-2010-4779 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wptouch_settings parameter to include/adsense-new.php. NOTE: some of these details are obtained from third party information.

  Product

  lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for

  What to do

  Update lib/includes/auth.inc.php in the WPtouch plugin 1.9.19.4 and 1.9.20 for to the newest version.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• Mar 28, 2011Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration screen in wp-relatedposts.php in the WP Related Posts plugin 1.0 for WordPress aCVE-2011-0760 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration screen in wp-relatedposts.php in the WP Related Posts plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the (1) wp_relatedposts_title, (2) wp_relatedposts_num, or (3) wp_relatedposts_type parameter.

  Product

  WP Related Posts

  What to do

  Update WP Related Posts to the newest version.

  Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com

• Mar 22, 2011Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration page in the Recaptcha (aka WP-reCAPTCHA) plugin 2.9.8.2 for WordPress allow remoCVE-2011-0759 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration page in the Recaptcha (aka WP-reCAPTCHA) plugin 2.9.8.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that disable the CAPTCHA requirement or insert cross-site scripting (XSS) sequences via the (1) recaptcha_opt_pubkey, (2) recaptcha_opt_privkey, (3) re_tabindex, (4) error_blank, (5) error_incorrect, (6) mailhide_pub, (7) mailhide_priv, (8) mh_replace_link, or (9) mh_replace_title parameter.

  Product

  Recaptcha (aka WP-reCAPTCHA)

  What to do

  Update Recaptcha (aka WP-reCAPTCHA) to the newest version.

  Full record and what to do →NVD recordarchives.neohapsis.comsecunia.com

• Mar 1, 2011Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote attackers tCVE-2010-4747 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pluginurl parameter.

  Product

  Processing Embed

  What to do

  Update Processing Embed to the newest version.

  Full record and what to do →NVD recordsecunia.comjohnleitch.net

• Feb 21, 2011Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrarCVE-2011-1047 · WordPress plugins & themes · reported by MITREHigh 7.5

  Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) search_max parameter in a search action to index.php, which is not properly handled by wpf.class.php, (2) id parameter in an editpost action to index.php, which is not properly handled by wpf-post.php, or (3) topic parameter to feed.php.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordosvdb.orgosvdb.org

• Jan 25, 2011Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitraCVE-2011-0641 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) what1, (2) what2, (3) what3, (4) what4, and (5) what5 parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

  Product

  StatPressCN

  What to do

  Update StatPressCN to the newest version.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• Dec 30, 2010Cross-site scripting (XSS) vulnerability in feedlist/handler_image.php in the FeedList plugin 2.61.01 for WordPress allows remote attackers to inject arbitrary CVE-2010-4637 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in feedlist/handler_image.php in the FeedList plugin 2.61.01 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.

  Product

  FeedList

  What to do

  Update FeedList to the newest version.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org

• Dec 30, 2010Cross-site scripting (XSS) vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to CVE-2010-4630 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in pages/admin/surveys/create.php in the WP Survey And Quiz Tool plugin 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter.

  Product

  WP Survey And Quiz Tool

  What to do

  Update WP Survey And Quiz Tool to the newest version.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org

• Dec 22, 2010Cross-site scripting (XSS) vulnerability in lembedded-video.php in the Embedded Video plugin 4.1 for WordPress allows remote attackers to inject arbitrary web sCVE-2010-4277 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in lembedded-video.php in the Embedded Video plugin 4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the content parameter to wp-admin/post.php.

  Product

  Embedded Video

  What to do

  Update Embedded Video to the newest version.

  Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com

• Dec 9, 2010Cross-site scripting (XSS) vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote attackers to inject aCVE-2010-4518 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in wp-safe-search/wp-safe-search-jx.php in the Safe Search plugin 0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the v1 parameter.

  Product

  Safe Search

  What to do

  Update Safe Search to the newest version.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• Dec 6, 2010The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php andCVE-2010-4403 · WordPress plugins & themes · reported by MITREMedium 5

  The Register Plus plugin 3.5.1 and earlier for WordPress allows remote attackers to obtain sensitive information via a direct request to (1) dash_widget.php and (2) register-plus.php, which reveals the installation path in an error message.

  Affected

  up to 3.5.1

  What to do

  Affects up to 3.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.orgwebsecurity.com.ua

• Dec 6, 2010Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to injectCVE-2010-4402 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) firstname, (2) lastname, (3) website, (4) aim, (5) yahoo, (6) jabber, (7) about, (8) pass1, and (9) pass2 parameters in a register action.

  Product

  Register Plus

  Affected

  up to 3.5.1

  What to do

  Affects up to 3.5.1. Update Register Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org

• Nov 3, 2010Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject aCVE-2010-3977 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in wp-content/plugins/cforms/lib_ajax.php in cforms WordPress plugin 11.5 allow remote attackers to inject arbitrary web script or HTML via the (1) rs and (2) rsargs[] parameters.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordsecunia.comconviso.com.br

• Jul 30, 2010SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the url CVE-2010-2924 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the url parameter. NOTE: some of these details are obtained from third party information.

  Product

  myLinksDump

  What to do

  Update myLinksDump to the newest version.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• Apr 7, 2010Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitraCVE-2010-1186 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.

  Product

  Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery

  Fixed in

  1.5.2

  What to do

  Update Cross-site scripting (XSS) vulnerability in xml/media-rss.php in the NextGEN Gallery to 1.5.2 or newer.

  Full record and what to do →NVD recordsecunia.comwordpress.org

• Mar 26, 2010SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQCVE-2009-4748 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in mycategoryorder.php in the My Category Order plugin 2.8 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the parentID parameter in an act_OrderCategories action to wp-admin/post-new.php.

  Product

  My Category Order

  Affected

  up to 2.8

  What to do

  Affects up to 2.8. Update My Category Order to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpacketstormsecurity.orgexploit-db.com

• Mar 5, 2010Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary local files viCVE-2009-4672 · WordPress plugins & themes · reported by MITREHigh 7.5

  Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pg parameter.

  Product

  WP-Lytebox

  What to do

  Update WP-Lytebox to the newest version.

  Full record and what to do →NVD recordsecunia.comexploit-db.com

• Feb 22, 2010SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress allows remote attackers to execute arbitCVE-2010-0673 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress allows remote attackers to execute arbitrary SQL commands via the postid parameter.

  Product

  Copperleaf Photolog

  What to do

  Update Copperleaf Photolog to the newest version.

  Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.org

• Dec 28, 2009SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2009-4424 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in results.php in the Pyrmont plugin 2 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  Product

  Pyrmont

  What to do

  Update Pyrmont to the newest version.

  Full record and what to do →NVD recordpacketstormsecurity.orgexploit-db.com

• Dec 18, 2009Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the searCVE-2009-3703 · WordPress plugins & themes · reported by MITREHigh 7.5

  Multiple SQL injection vulnerabilities in the WP-Forum plugin before 2.4 for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the search_max parameter in a search action to the default URI, related to wpf.class.php; (2) the forum parameter to an unspecified component, related to wpf.class.php; (3) the topic parameter in a viewforum action to the default URI, related to the remove_topic function in wpf.class.php; or the id parameter in a (4) editpost or (5) viewtopic action to the default URI, related to wpf-post.php.

  Product

  Multiple SQL injection vulnerabilities in the WP-Forum

  Fixed in

  2.4

  What to do

  Update Multiple SQL injection vulnerabilities in the WP-Forum to 2.4 or newer.

  Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com

• Dec 2, 2009WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.CVE-2009-4170 · WordPress plugins & themes · reported by MITREMedium 5

  WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, allows remote attackers to obtain sensitive information via a crafted request to wp-cumulus.php, probably without parameters, which reveals the installation path in an error message.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordwebsecurity.com.uasecurityfocus.com

• Dec 2, 2009Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in before 1.22 for WordPress allows remote attackers to inject arbitrary web sCVE-2009-4169 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in before 1.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  Product

  Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in

  Fixed in

  1.22

  What to do

  Update Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in to 1.22 or newer.

  Full record and what to do →NVD recordroytanck.comsecurityfocus.com

• Dec 2, 2009Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and eCVE-2009-4168 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.

  Product

  Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus

  Affected

  up to 2.0

  Fixed in

  1.23

  What to do

  Update Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus to 1.23 or newer.

  Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com

• Sep 11, 2009Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortion, which aCVE-2008-7216 · WordPress plugins & themes · reported by MITREMedium 4.3

  Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortion, which allows remote attackers to bypass CAPTCHA protection by reading certain bytes from the generated clip.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recorddocs.google.comsecurityfocus.com

• Sep 8, 2009wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for: Cross-site scripting (XSS)CVE-2008-7175 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action.

  Product

  wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for

  Affected

  up to 0.96

  What to do

  Affects up to 0.96. Update wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordosvdb.orgsecurityfocus.com

• Aug 18, 2009WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_heCVE-2009-2852 · WordPress plugins & themes · reported by MITREMedium 6.8

  WP-Syntax plugin 0.9.1 and earlier for Wordpress, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via the test_filter[wp_head] array parameter to test/index.php, which is used in a call to the call_user_func_array function.

  Affected

  up to 0.9.1

  What to do

  Affects up to 0.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordexploit-db.comsecurityfocus.com

• Jul 10, 2009wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which alloCVE-2009-2334 · WordPress plugins & themes · reported by MITREMedium 4.9

  wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.

  Fixed in

  2.8.1

  What to do

  Update the plugin to 2.8.1 or newer.

  Full record and what to do →NVD recordcorelabs.coresecurity.comsecuritytracker.com

• Jul 9, 2009template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin,: PHP remote file inclusionCVE-2009-2396 · WordPress plugins & themes · reported by MITREHigh 9.3

  PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter.

  Product

  template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin,

  What to do

  Update template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, to the newest version.

  Full record and what to do →NVD recordsecunia.comexploit-db.com

• Jul 8, 2009SQL injection vulnerability in BTE_RW_webajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via thCVE-2009-2383 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in BTE_RW_webajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the guid parameter.

  Product

  Related Sites

  What to do

  Update Related Sites to the newest version.

  Full record and what to do →NVD recordexploit-db.comsecurityfocus.com

• Jun 22, 2009SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified CVE-2009-2144 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  Product

  SQL injection vulnerability in the FireStats

  Fixed in

  1.6.2-stable

  What to do

  Update SQL injection vulnerability in the FireStats to 1.6.2-stable or newer.

  Full record and what to do →NVD recordfirestats.ccsecunia.com

• Jun 22, 2009PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute CVE-2009-2143 · WordPress plugins & themes · reported by MITREHigh 7.5

  PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the fs_javascript parameter.

  Product

  PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats

  Fixed in

  1.6.2-stable

  What to do

  Update PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats to 1.6.2-stable or newer.

  Full record and what to do →NVD recordfirestats.ccsecunia.com

• Jun 19, 2009SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands CVE-2009-2122 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.

  Product

  Paolo Palmonari Photoracer

  What to do

  Update Paolo Palmonari Photoracer to the newest version.

  Full record and what to do →NVD recordsecunia.comsecurityfocus.com

• May 18, 2009Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitraCVE-2008-6811 · WordPress plugins & themes · reported by MITREMedium 6.8

  Unrestricted file upload vulnerability in image_processing.php in the e-Commerce Plugin 3.4 and earlier for Wordpress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/plugins/wp-shopping-cart/.

  Product

  e-Commerce

  Affected

  up to 3.4

  What to do

  Affects up to 3.4. Update e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com

• Mar 19, 2009SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameteCVE-2009-0968 · WordPress plugins & themes · reported by MITREHigh 7.5

  SQL injection vulnerability in fmoblog.php in the fMoblog plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. NOTE: some of these details are obtained from third party information.

  Product

  fMoblog

  What to do

  Update fMoblog to the newest version.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• Dec 30, 2008Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magic_quotes_gpc is disabled, allCVE-2008-5752 · WordPress plugins & themes · reported by MITREMedium 4.3

  Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the book_id parameter. NOTE: some of these details are obtained from third party information.

  Product

  Page Flip Image Gallery

  Affected

  up to 0.2.2

  What to do

  Affects up to 0.2.2. Update Page Flip Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• Oct 24, 2008Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackeCVE-2008-4734 · WordPress plugins & themes · reported by MITREHigh 7.5

  Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to perform unauthorized actions as administrators via a request that sets the wpcr_hidden_form_input parameter.

  Product

  Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix

  Fixed in

  1.4.4

  What to do

  Update Cross-site request forgery (CSRF) vulnerability in the wpcr_do_options_page function in WP Comment Remix to 1.4.4 or newer.

  Full record and what to do →NVD recordchxsecurity.orgsecunia.com

• Oct 24, 2008Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to inject arbitraryCVE-2008-4733 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the (1) replytotext, (2) quotetext, (3) originallypostedby, (4) sep, (5) maxtags, (6) tagsep, (7) tagheadersep, (8) taglabel, and (9) tagheaderlabel parameters.

  Product

  Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix

  Fixed in

  1.4.4

  What to do

  Update Cross-site scripting (XSS) vulnerability in wpcommentremix.php in WP Comment Remix to 1.4.4 or newer.

  Full record and what to do →NVD recordchxsecurity.orgsecunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.