← Back

Wordpress

wordpress

409 CVEs • 51 products

Products (51)

Click to collapse
Toggle
Wordpress
wordpress
355 CVEs
Wordpress Mu
wordpress_mu
10 CVEs
Sniplets Plugin
sniplets_plugin
3 CVEs
Blix
blix
2 CVEs
Math Comment Spam Protection Plugin
math_comment_spam_protection_plugin
2 CVEs
Wassup Plugin
wassup_plugin
2 CVEs
Pay With Tweet
pay-with-tweet
2 CVEs
Blixed
blixed
1 CVE
Blixkrieg
blixkrieg
1 CVE
Unamed Theme
unamed_theme
1 CVE
Unamed Theme Se
unamed_theme_se
1 CVE
Sirius
sirius
1 CVE
Pool
pool
1 CVE
Wordpressclassic
wordpressclassic
1 CVE
Pictpress
pictpress
1 CVE
Wp Contactform
wp-contactform
1 CVE
Cryptographp
cryptographp
1 CVE
Captcha
captcha
1 CVE
Filemanager
filemanager
1 CVE
Wp Forum
wp_forum
1 CVE
Wp Cal Plugin
wp_cal_plugin
1 CVE
Adserve
adserve
1 CVE
Permalinks Migration Plugin
permalinks_migration_plugin
1 CVE
Wordspew
wordspew
1 CVE
St Newsletter Plugin
st_newsletter_plugin
1 CVE
Wp Footnotes
wp-footnotes
1 CVE
Search Unleashed Plugin
search_unleashed_plugin
1 CVE
Dean Logan Wp People Plugin
dean_logan_wp-people_plugin
1 CVE
Photo Album Plugin
photo_album_plugin
1 CVE
Wp Download
wp_download
1 CVE
Wpss
wpss
1 CVE
Download Monitor Plugin
download_monitor_plugin
1 CVE
Upload File Plugin
upload_file_plugin
1 CVE
Wp Downloads Manager
wp_downloads_manager
1 CVE
Spambam Plugin
spambam_plugin
1 CVE
Page Flip Image Gallery Plugin
page_flip_image_gallery_plugin
1 CVE
Peter's Math Anti Spam For Wordpress
peter's_math_anti-spam_for_wordpress
1 CVE
Wordpress Users
wordpress-users
1 CVE
Fcchat Widget
fcchat_widget
1 CVE
Plugin Newsletter Plugin
plugin_newsletter_plugin
1 CVE
Alert Before You Post
alert_before_you_post
1 CVE
Lanoba Social Plugin
lanoba_social_plugin
1 CVE
Slideshow Gallery2
slideshow_gallery2
1 CVE
Wp Maintenance Mode Plugin
wp_maintenance_mode_plugin
1 CVE
Requests
requests
1 CVE
Debug Bar
debug_bar
1 CVE
Health Check & Troubleshooting
health_check_&_troubleshooting
1 CVE
Performance Lab
performance_lab
1 CVE
Blogger Importer
blogger_importer
1 CVE
Gutenberg
gutenberg
1 CVE
Thanh Toan Quet Ma Qr Code Tu Dong
thanh_toan_quet_ma_qr_code_tu_dong
1 CVE

CVEs (409)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2011-4956
1Wordpress
1Wordpress
Apr 29, 2026
Jun 27, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-3588
1Wordpress
1Plugin Newsletter Plugin
Apr 29, 2026
Jun 19, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter.
CVE-2012-3578
1Wordpress
1Fcchat Widget
Apr 29, 2026
Jun 17, 2012
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executabl...Show more
Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in html/images.Show less
CVE-2012-2633
1Wordpress
1Wassup Plugin
Apr 29, 2026
Jun 15, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.
CVE-2012-1936
1Wordpress
1Wordpress
Apr 29, 2026
May 3, 2012
N/A· v4
N/A· v3
6.8 MEDIUM· v2
The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-...Show more
The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks on specific actions and objects by sniffing the network, as demonstrated by attacks against the wp-admin/admin-ajax.php and wp-admin/user-new.php scripts. NOTE: the vendor reportedly disputes the significance of this issue because wp_create_nonce operates as intended, even if it is arguably inconsistent with certain CSRF protection details advocated by external organizationsShow less
CVE-2012-2404
1Wordpress
1Wordpress
Apr 29, 2026
Apr 21, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
CVE-2012-2403
1Wordpress
1Wordpress
Apr 29, 2026
Apr 21, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
CVE-2012-2402
1Wordpress
1Wordpress
Apr 29, 2026
Apr 21, 2012
N/A· v4
N/A· v3
5.5 MEDIUM· v2
wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors.
CVE-2012-2401
2Moxiecode
Wordpress
2Plupload
Wordpress
Apr 29, 2026
Apr 21, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to...Show more
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.Show less
CVE-2012-2400
1Wordpress
1Wordpress
Apr 29, 2026
Apr 21, 2012
N/A· v4
N/A· v3
10.0 HIGH· v2
Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors.
CVE-2012-2399
1Wordpress
1Wordpress
Apr 29, 2026
Apr 21, 2012
N/A· v4
N/A· v3
10.0 HIGH· v2
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject a...Show more
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.Show less
CVE-2012-0937
1Wordpress
1Wordpress
Apr 29, 2026
Jan 30, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as...Show more
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898. NOTE: the vendor disputes the significance of this issue because an incomplete WordPress installation might be present on the network for only a short timeShow less
CVE-2012-0782
1Wordpress
1Wordpress
Apr 29, 2026
Jan 30, 2012
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbho...Show more
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevanceShow less
CVE-2011-4899
1Wordpress
1Wordpress
Apr 29, 2026
Jan 30, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary dat...Show more
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environmentsShow less
CVE-2011-4898
1Wordpress
1Wordpress
Apr 29, 2026
Jan 30, 2012
N/A· v4
N/A· v3
5.0 MEDIUM· v2
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, whic...Show more
wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspectiveShow less
CVE-2012-0287
1Wordpress
1Wordpress
Apr 29, 2026
Jan 6, 2012
N/A· v4
N/A· v3
2.6 LOW· v2
Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a P...Show more
Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the "Duplicate comment detected" feature.Show less
CVE-2011-4669
1Wordpress
1Wordpress Users
Apr 29, 2026
Dec 2, 2011
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in wp-users.php in WordPress Users plugin 1.3 and possibly earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the uid parameter to index.php.
CVE-2011-3818
1Wordpress
1Wordpress
Apr 29, 2026
Sep 24, 2011
N/A· v4
N/A· v3
5.0 MEDIUM· v2
WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by wp-admin/includes/user.ph...Show more
WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by wp-admin/includes/user.php and certain other files.Show less
CVE-2011-3130
1Wordpress
1Wordpress
Apr 29, 2026
Aug 10, 2011
N/A· v4
N/A· v3
7.5 HIGH· v2
wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibly involving SQL injection.
CVE-2011-3129
1Wordpress
1Wordpress
Apr 29, 2026
Aug 10, 2011
N/A· v4
N/A· v3
9.3 HIGH· v2
The file upload functionality in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running "on hosts with dangerous security settings," has unknown impact and attack vectors, possibly related to dangerous filenames.