Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
wordpress wordpress 3.5.2 vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2013-2173
wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote malicious users to cause a denial of service (CPU consumption) via a crafted value of a certain wp-postpass cookie.
Wordpress Wordpress 3.5.1
9.8
CVSSv3
CVE-2013-4144
There is an object injection vulnerability in swfupload plugin for wordpress.
Swfupload Project Swfupload 3.5.2
NA
CVE-2011-3850
Cross-site scripting (XSS) vulnerability in the Atahualpa theme prior to 3.6.8 for WordPress allows remote malicious users to inject arbitrary web script or HTML via the s parameter.
Bytesforall Atahualpa
Bytesforall Atahualpa 2.0
Bytesforall Atahualpa 2.01
Bytesforall Atahualpa 2.2
Bytesforall Atahualpa 2.21
Bytesforall Atahualpa 3.1
Bytesforall Atahualpa 3.1.1
Bytesforall Atahualpa 3.1.2
Bytesforall Atahualpa 3.1.3
Bytesforall Atahualpa 3.1.4
Bytesforall Atahualpa 3.1.5
Bytesforall Atahualpa 3.1.6
Bytesforall Atahualpa 3.1.8
Bytesforall Atahualpa 3.1.9
Bytesforall Atahualpa 3.2
Bytesforall Atahualpa 3.4
Bytesforall Atahualpa 3.4.01
Bytesforall Atahualpa 3.4.1
Bytesforall Atahualpa 3.4.3
Bytesforall Atahualpa 3.4.4
Bytesforall Atahualpa 3.4.5
Bytesforall Atahualpa 3.4.6
1 EDB exploit
NA
CVE-2013-1852
SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin prior to 3.8.1 for WordPress allows remote malicious users to execute arbitrary SQL commands via the league_id parameter in the leaguemanager-export page to wp-admin/admin.php.
Kolja Schleich Leaguemanager
Kolja Schleich Leaguemanager 3.7
Kolja Schleich Leaguemanager 3.6.9
Kolja Schleich Leaguemanager 3.5.2
Kolja Schleich Leaguemanager 3.5.1
Kolja Schleich Leaguemanager 3.5
Kolja Schleich Leaguemanager 3.4.2
Kolja Schleich Leaguemanager 3.1.7
Kolja Schleich Leaguemanager 3.1.6
Kolja Schleich Leaguemanager 3.1.5
Kolja Schleich Leaguemanager 3.1.4
Kolja Schleich Leaguemanager 2.9
Kolja Schleich Leaguemanager 2.8
Kolja Schleich Leaguemanager 2.7.1
Kolja Schleich Leaguemanager 2.1
Kolja Schleich Leaguemanager 2.0
Kolja Schleich Leaguemanager 1.5
Kolja Schleich Leaguemanager 1.4.2
Kolja Schleich Leaguemanager 3.6.7
Kolja Schleich Leaguemanager 3.6.5
Kolja Schleich Leaguemanager 3.6
Kolja Schleich Leaguemanager 3.5.5
1 EDB exploit
1 Github repository
9.8
CVSSv3
CVE-2021-4434
The Social Warfare plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.5.2 via the 'swp_url' parameter. This allows malicious users to execute code on the server.
Warfareplugins Social Warfare
9.8
CVSSv3
CVE-2021-24507
The Astra Pro Addon WordPress plugin prior to 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated user) before using them in SQ...
Brainstormforce Astra
1 Github repository
4.8
CVSSv3
CVE-2023-5243
The Login Screen Manager WordPress plugin up to and including 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for e...
Login Screen Manager Project Login Screen Manager
4.3
CVSSv3
CVE-2022-1842
The OpenBook Book Data WordPress plugin up to and including 3.5.2 does not have CSRF check in place when updating its settings, which could allow malicious users to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of san...
Openbook Book Data Project Openbook Book Data
6.5
CVSSv3
CVE-2019-1010034
Deepwoods Software WebLibrarian 3.5.2 and previous versions is affected by: SQL Injection. The impact is: Exposing the entire database. The component is: Function "AllBarCodes" (defined at database_code.php line 1018) is vulnerable to a boolean-based blind sql injection...
Deepsoft Weblibrarian
NA
CVE-2024-1893
The Easy Property Listings plugin for WordPress is vulnerable to time-based SQL Injection via the ‘property_status’ shortcode attribute in all versions up to, and including, 3.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient prepa...
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
hardcoded
arbitrary code
CVE-2024-2404
CVE-2024-21111
CVE-2024-28627
CVE-2024-4073
information disclosure
CVE-2024-32780
CVE-2024-4040
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2