Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): Wordpress
  • Search Type: Search All
There are 3,328 matching records.
Displaying matches 2,841 through 2,860.
Vuln ID Summary CVSS Severity
CVE-2013-2501

Cross-site scripting (XSS) vulnerability in the Terillion Reviews plugin before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ProfileId field.

Published: March 22, 2013; 5:55:01 PM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2013-2640

ajax.functions.php in the MailUp plugin before 1.3.2 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks via unspecified vectors related to "formData=save" requests, a different version than CVE-2013-0731.

Published: March 22, 2013; 1:55:01 PM -0400
V3.x:(not available)
V2.0: 5.0 MEDIUM
CVE-2013-0731

ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks by setting the wordpress_logged_in cookie. NOTE: this is due to an incomplete fix for a similar issue that was fixed in 1.3.2.

Published: March 22, 2013; 11:55:01 AM -0400
V3.x:(not available)
V2.0: 5.0 MEDIUM
CVE-2013-1774

The chase_port function in drivers/usb/serial/io_ti.c in the Linux kernel before 3.7.4 allows local users to cause a denial of service (NULL pointer dereference and system crash) via an attempted /dev/ttyUSB read or write operation on a disconnected Edgeport USB serial converter.

Published: February 28, 2013; 2:55:01 PM -0500
V3.x:(not available)
V2.0: 4.0 MEDIUM
CVE-2011-5265

Cross-site scripting (XSS) vulnerability in cached_image.php in the Featurific For WordPress plugin 1.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the snum parameter. NOTE: this has been disputed by a third party.

Published: February 12, 2013; 3:55:04 PM -0500
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2011-5264

Cross-site scripting (XSS) vulnerability in lazyest-backup.php in the Lazyest Backup plugin before 0.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xml_or_all parameter.

Published: February 12, 2013; 3:55:04 PM -0500
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2011-5257

Multiple cross-site scripting (XSS) vulnerabilities in the Classipress theme before 3.1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) twitter_id parameter related to the Twitter widget and (2) facebook_id parameter related to the Facebook widget.

Published: February 12, 2013; 3:55:01 PM -0500
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2013-1464

Cross-site scripting (XSS) vulnerability in assets/player.swf in the Audio Player plugin before 2.0.4.6 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the playerID parameter.

Published: February 07, 2013; 12:56:25 AM -0500
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2013-1463

Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module before 1.9.4 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this might be the same vulnerability as CVE-2013-1808. If so, it is likely that CVE-2013-1463 will be REJECTed.

Published: February 07, 2013; 12:56:25 AM -0500
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2012-6527

Cross-site scripting (XSS) vulnerability in the My Calendar plugin before 1.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

Published: January 31, 2013; 12:44:00 AM -0500
V3.x:(not available)
V2.0: 2.6 LOW
CVE-2012-6512

The Organizer plugin 1.2.1 for WordPress allows remote attackers to obtain the installation path via unspecified vectors to (1) plugin_hook.php, (2) page/index.php, (3) page/dir.php (4) page/options.php, (5) page/resize.php, (6) page/upload.php, (7) page/users.php, or (8) page/view.php.

Published: January 23, 2013; 8:55:05 PM -0500
V3.x:(not available)
V2.0: 5.0 MEDIUM
CVE-2012-6511

Multiple cross-site scripting (XSS) vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) delete_id parameter or (2) extension parameter in an "Update Setting" action to wp-admin/admin.php.

Published: January 23, 2013; 8:55:05 PM -0500
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2012-6506

Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in zing.inc.php or (2) notes parameter in fws/pages-front/onecheckout.php.

Published: January 23, 2013; 8:55:04 PM -0500
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2011-4618

Cross-site scripting (XSS) vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter.

Published: January 23, 2013; 8:55:02 PM -0500
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2012-6499

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_to parameter.

Published: January 11, 2013; 11:33:49 PM -0500
V3.x:(not available)
V2.0: 5.8 MEDIUM
CVE-2011-5254

Unspecified vulnerability in the Connections plugin before 0.7.1.6 for WordPress has unknown impact and attack vectors.

Published: January 11, 2013; 11:33:49 PM -0500
V3.x:(not available)
V2.0: 10.0 HIGH
CVE-2013-0721

wp-php-widget.php in the WP PHP widget plugin 1.0.2 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.

Published: January 02, 2013; 6:46:23 AM -0500
V3.x:(not available)
V2.0: 5.0 MEDIUM
CVE-2012-5868

WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.

Published: December 27, 2012; 6:47:01 AM -0500
V3.x:(not available)
V2.0: 2.6 LOW
CVE-2012-5469

The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct request to wp-content/plugins/portable-phpmyadmin/wp-pma-mod.

Published: December 20, 2012; 7:02:18 AM -0500
V3.x:(not available)
V2.0: 7.5 HIGH
CVE-2012-5178

Cross-site request forgery (CSRF) vulnerability in the Welcart plugin before 1.2.2 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that complete a purchase.

Published: December 19, 2012; 6:55:55 AM -0500
V3.x:(not available)
V2.0: 6.8 MEDIUM