Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
wordpress wordpress vulnerabilities and exploits
(subscribe to this query)
10
CVSSv2
CVE-2021-24527
The User Registration & User Profile – Profile Builder WordPress plugin prior to 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin w...
Cozmoslabs Profile Builder
10
CVSSv2
CVE-2021-24215
An Improper Access Control vulnerability exists in the Controlled Admin Access WordPress plugin prior to 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a comple...
Wpruby Controlled Admin Access
10
CVSSv2
CVE-2021-24148
A business logic issue in the MStore API WordPress plugin, versions prior to 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address.
Inspireui Mstore Api
10
CVSSv2
CVE-2021-3120
An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin prior to 3.3.1 for WordPress allows remote malicious users to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnera...
Yithemes Yith Woocommerce Gift Cards
10
CVSSv2
CVE-2020-35489
The contact-form-7 (aka Contact Form 7) plugin prior to 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.
Rocklobster Contact Form 7
5 Github repositories
10
CVSSv2
CVE-2013-3684
NextGEN Gallery plugin prior to 1.9.13 for WordPress: ngggallery.php file upload
Imagely Nextgen Gallery
1 EDB exploit
10
CVSSv2
CVE-2019-14313
A SQL injection vulnerability exists in the 10Web Photo Gallery plugin prior to 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote malicious user to execute arbitrary SQL commands on the affected system via filemanager/model.php.
10web Photo Gallery
10
CVSSv2
CVE-2019-13569
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin up to and including 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote malicious user to execute arbitrary SQL commands on the affected system.
Icegram Email Subscribers \\& Newsletters
10
CVSSv2
CVE-2019-13573
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin prior to 7.3.19.727 for WordPress. Successful exploitation of this vulnerability would allow a remote malicious user to execute arbitrary SQL commands on the affected system.
Foliovision Fv Flowplayer Video Player
10
CVSSv2
CVE-2015-8249
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote malicious users to upload and execute arbitrary files via the ConnectionId parameter.
Manageengine Desktop Central 9.0
1 EDB exploit
3 Github repositories
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-33228
CVE-2024-20361
log injection
bypass
CVE-2024-4985
CVE-2024-35223
CVE-2024-29849
CVE-2024-31893
IMAP
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
5
6
NEXT »