Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
wordpress wordpress 2.7.1 vulnerabilities and exploits
(subscribe to this query)
4.3
CVSSv3
CVE-2022-2267
The Mailchimp for WooCommerce WordPress plugin prior to 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can ...
Mailchimp Mailchimp For Woocommerce
6.1
CVSSv3
CVE-2022-0149
The WooCommerce Stored Exporter WordPress plugin prior to 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin page.
Visser Store Exporter For Woocommerce
1 Github repository
5.4
CVSSv3
CVE-2021-25106
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin prior to 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscriber, to update th...
Wpeka Wplegalpages
6.1
CVSSv3
CVE-2014-4558
Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and previous versions for WordPress allows remote malicious users to inject arbitrary web script or HTML via the api_url parameter.
Cybercompany Swipehq-payment-gateway-woocommerce
7.5
CVSSv3
CVE-2015-9339
The wp-file-upload plugin prior to 2.7.1 for WordPress has insufficient restrictions on upload of .js files.
Iptanus Wordpress File Upload
6.1
CVSSv3
CVE-2015-7357
Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 prior to 2.7.10 for WordPress allows remote malicious users to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #<svg onload=alert(1)>.
Udesign Project Udesign 2.7.9
Udesign Project Udesign 2.7.8
Udesign Project Udesign 2.7.7
Udesign Project Udesign 2.7.6
Udesign Project Udesign 2.7.5
Udesign Project Udesign 2.7.4
Udesign Project Udesign 2.7.3
Udesign Project Udesign 2.7.2
Udesign Project Udesign 2.7.1
Udesign Project Udesign 2.7.0
Udesign Project Udesign 2.6.0
Udesign Project Udesign 2.5.6
Udesign Project Udesign 2.5.5
Udesign Project Udesign 2.5.4
Udesign Project Udesign 2.5.3
Udesign Project Udesign 2.5.2
Udesign Project Udesign 2.5.1
Udesign Project Udesign 2.5.0
Udesign Project Udesign 2.4.19
Udesign Project Udesign 2.4.18
Udesign Project Udesign 2.4.17
Udesign Project Udesign 2.4.16
7.5
CVSSv3
CVE-2017-11658
In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficient to stop remote attacks and can be bypassed by using 0x00 bytes, as demonstrated by a .%00.../.%00.../ attack.
Wp-rocket Wp-rocket 2.6.14
Wp-rocket Wp-rocket 2.0.4
Wp-rocket Wp-rocket 2.5.9
Wp-rocket Wp-rocket 2.0.0
Wp-rocket Wp-rocket 2.9.1
Wp-rocket Wp-rocket 2.7.3
Wp-rocket Wp-rocket 2.7.0
Wp-rocket Wp-rocket 2.8.5
Wp-rocket Wp-rocket 2.10.0
Wp-rocket Wp-rocket 2.3.9
Wp-rocket Wp-rocket 2.3.1
Wp-rocket Wp-rocket 2.8.11
Wp-rocket Wp-rocket 2.3.5
Wp-rocket Wp-rocket 2.9.6
Wp-rocket Wp-rocket 2.5.10
Wp-rocket Wp-rocket 2.6.9
Wp-rocket Wp-rocket 2.9.11
Wp-rocket Wp-rocket 2.8.3
Wp-rocket Wp-rocket 2.8.18
Wp-rocket Wp-rocket 2.6.13
Wp-rocket Wp-rocket 2.8.23
Wp-rocket Wp-rocket 2.6.6
NA
CVE-2014-0165
WordPress prior to 3.7.2 and 3.8.x prior to 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
Wordpress Wordpress 3.0.5
Wordpress Wordpress 2.8.5.2
Wordpress Wordpress 1.2.3
Wordpress Wordpress 3.4.0
Wordpress Wordpress 2.0.11
Wordpress Wordpress 1.3.3
Wordpress Wordpress 3.6.1
Wordpress Wordpress 2.8.6
Wordpress Wordpress 2.0
Wordpress Wordpress 2.1.1
Wordpress Wordpress 2.2.3
Wordpress Wordpress 2.0.2
Wordpress Wordpress 3.7
Wordpress Wordpress 1.6.2
Wordpress Wordpress 3.5.0
Wordpress Wordpress 2.1
Wordpress Wordpress 1.1.1
Wordpress Wordpress 1.2.4
Wordpress Wordpress 2.0.6
Wordpress Wordpress 2.0.1
Wordpress Wordpress 2.8.4
Wordpress Wordpress 2.0.4
NA
CVE-2014-0166
The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress prior to 3.7.2 and 3.8.x prior to 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote malicious users to obtain access via a forged cookie.
Wordpress Wordpress 3.0.5
Wordpress Wordpress 2.8.5.2
Wordpress Wordpress 1.2.3
Wordpress Wordpress 3.4.0
Wordpress Wordpress 2.0.11
Wordpress Wordpress 1.3.3
Wordpress Wordpress 3.6.1
Wordpress Wordpress 2.8.6
Wordpress Wordpress 2.0
Wordpress Wordpress 2.1.1
Wordpress Wordpress 2.2.3
Wordpress Wordpress 2.0.2
Wordpress Wordpress 3.7
Wordpress Wordpress 1.6.2
Wordpress Wordpress 3.5.0
Wordpress Wordpress 2.1
Wordpress Wordpress 1.1.1
Wordpress Wordpress 1.2.4
Wordpress Wordpress 2.0.6
Wordpress Wordpress 2.0.1
Wordpress Wordpress 2.8.4
Wordpress Wordpress 2.0.4
1 Github repository
NA
CVE-2013-1852
SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin prior to 3.8.1 for WordPress allows remote malicious users to execute arbitrary SQL commands via the league_id parameter in the leaguemanager-export page to wp-admin/admin.php.
Kolja Schleich Leaguemanager 3.6.8
Kolja Schleich Leaguemanager 3.6.7
Kolja Schleich Leaguemanager 3.4.1
Kolja Schleich Leaguemanager 3.6.9
Kolja Schleich Leaguemanager 1.2.2
Kolja Schleich Leaguemanager 3.0.3
Kolja Schleich Leaguemanager 3.5.1
Kolja Schleich Leaguemanager 3.7
Kolja Schleich Leaguemanager 2.2
Kolja Schleich Leaguemanager 3.2
Kolja Schleich Leaguemanager 3.5.6
Kolja Schleich Leaguemanager 3.0.2
Kolja Schleich Leaguemanager 1.4.2
Kolja Schleich Leaguemanager 2.5.2
Kolja Schleich Leaguemanager
Kolja Schleich Leaguemanager 3.5
Kolja Schleich Leaguemanager 2.9.2
Kolja Schleich Leaguemanager 3.5.2
Kolja Schleich Leaguemanager 3.6.2
Kolja Schleich Leaguemanager 3.1.9
Kolja Schleich Leaguemanager 3.0.1
Kolja Schleich Leaguemanager 1.3
1 EDB exploit
1 Github repository
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
TCP
CVE-2024-4577
CVE-2024-2695
CVE-2024-31870
injection
CVE-2024-3813
arbitrary code
CVE-2024-27801
CVE-2024-30120
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
NEXT »