Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

wordpress wordpress 3.6 vulnerabilities and exploits

(subscribe to this query)
4.3
CVSSv2
CVE-2011-3850
Cross-site scripting (XSS) vulnerability in the Atahualpa theme prior to 3.6.8 for WordPress allows remote malicious users to inject arbitrary web script or HTML via the s parameter.
Bytesforall AtahualpaBytesforall Atahualpa 2.0Bytesforall Atahualpa 2.01Bytesforall Atahualpa 2.2Bytesforall Atahualpa 2.21Bytesforall Atahualpa 3.1Bytesforall Atahualpa 3.1.1Bytesforall Atahualpa 3.1.2Bytesforall Atahualpa 3.1.3Bytesforall Atahualpa 3.1.4Bytesforall Atahualpa 3.1.5Bytesforall Atahualpa 3.1.6Bytesforall Atahualpa 3.1.8Bytesforall Atahualpa 3.1.9Bytesforall Atahualpa 3.2Bytesforall Atahualpa 3.4Bytesforall Atahualpa 3.4.01Bytesforall Atahualpa 3.4.1Bytesforall Atahualpa 3.4.3Bytesforall Atahualpa 3.4.4Bytesforall Atahualpa 3.4.5Bytesforall Atahualpa 3.4.6
7.5
CVSSv2
CVE-2013-1852
SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin prior to 3.8.1 for WordPress allows remote malicious users to execute arbitrary SQL commands via the league_id parameter in the leaguemanager-export page to wp-admin/admin.php.
Kolja Schleich LeaguemanagerKolja Schleich Leaguemanager 3.7Kolja Schleich Leaguemanager 3.6.9Kolja Schleich Leaguemanager 3.5.2Kolja Schleich Leaguemanager 3.5.1Kolja Schleich Leaguemanager 3.5Kolja Schleich Leaguemanager 3.4.2Kolja Schleich Leaguemanager 3.1.7Kolja Schleich Leaguemanager 3.1.6Kolja Schleich Leaguemanager 3.1.5Kolja Schleich Leaguemanager 3.1.4Kolja Schleich Leaguemanager 2.9Kolja Schleich Leaguemanager 2.8Kolja Schleich Leaguemanager 2.7.1Kolja Schleich Leaguemanager 2.1Kolja Schleich Leaguemanager 2.0Kolja Schleich Leaguemanager 1.5Kolja Schleich Leaguemanager 1.4.2Kolja Schleich Leaguemanager 3.6.7Kolja Schleich Leaguemanager 3.6.5Kolja Schleich Leaguemanager 3.6Kolja Schleich Leaguemanager 3.5.5
4.3
CVSSv2
CVE-2011-3862
Cross-site scripting (XSS) vulnerability in the Morning Coffee theme prior to 3.6 for WordPress allows remote malicious users to inject arbitrary web script or HTML via the PATH_INFO to index.php.
Adazing Morning CoffeeAdazing Morning Coffee 2.7Adazing Morning Coffee 2.8Adazing Morning Coffee 2.9Adazing Morning Coffee 3.0Adazing Morning Coffee 3.1Adazing Morning Coffee 3.2Adazing Morning Coffee 3.4
6.8
CVSSv2
CVE-2014-4717
Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Share Buttons Adder plugin prior to 4.5 for WordPress allow remote malicious users to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) ssba...
Sharethis Simple Share Buttons Adder 2.2Sharethis Simple Share Buttons Adder 2.0Sharethis Simple Share Buttons Adder 1.0Sharethis Simple Share Buttons Adder 3.2Sharethis Simple Share Buttons Adder 3.9Sharethis Simple Share Buttons Adder 3.8Sharethis Simple Share Buttons Adder 1.5Sharethis Simple Share Buttons Adder 2.3Sharethis Simple Share Buttons Adder 1.1Sharethis Simple Share Buttons Adder 3.1Sharethis Simple Share Buttons Adder 3.0Sharethis Simple Share Buttons Adder 2.9Sharethis Simple Share Buttons Adder 1.3Sharethis Simple Share Buttons Adder 4.1Sharethis Simple Share Buttons Adder 4.0Sharethis Simple Share Buttons Adder 2.4Sharethis Simple Share Buttons AdderSharethis Simple Share Buttons Adder 4.2Sharethis Simple Share Buttons Adder 3.5Sharethis Simple Share Buttons Adder 2.8Sharethis Simple Share Buttons Adder 2.6Sharethis Simple Share Buttons Adder 1.9
NA
CVE-2022-3070
The Generate PDF WordPress plugin prior to 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Zealousweb Generate Pdf Using Contact Form 7
3.5
CVSSv2
CVE-2020-14959
Multiple XSS vulnerabilities in the Easy Testimonials plugin prior to 3.6 for WordPress allow remote malicious users to inject arbitrary web script or HTML via the wp-admin/post.php Client Name, Position, Web Address, Other, Location Reviewed, Product Reviewed, Item Reviewed, or ...
Goldplugins Easy Testimonials
NA
CVE-2024-0680
The WP Private Content Plus plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 3.6. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for un...
NA
CVE-2023-4995
The Embed Calendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'calendly' shortcode in versions up to, and including, 3.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authent...
Embedcalendly Embed Calendly
NA
CVE-2021-4397
The Staff Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated malicious users t...
Goldplugins Staff Directory Plugin
NA
CVE-2023-2082
The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.6 due to insufficient sanitization and escaping on the 'text value set via the bmc_post_reception action. This make...
Buymeacoffee Buy Me A Coffee
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-30924CVE-2024-3400overflowCVE-2024-23528CVE-2024-21338CVE-2024-3818CVE-2024-23535NULL pointer dereferenceelevation of privilege
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook