Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

wordpress wordpress 3.7 vulnerabilities and exploits

(subscribe to this query)
NA
CVE-2022-43504
Improper authentication vulnerability in WordPress versions before 6.0.3 allows a remote unauthenticated malicious user to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all ve...
Wordpress Wordpress
4.3
CVSSv2
CVE-2019-20042
In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions fr...
Wordpress WordpressDebian Debian Linux 9.0Debian Debian Linux 10.0
5
CVSSv2
CVE-2019-20043
In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such ...
Wordpress WordpressDebian Debian Linux 9.0Debian Debian Linux 10.0
NA
CVE-2023-25972
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in IKSWEB WordPress ????? plugin <= 3.7 versions.
Iksweb Wordpress Ctapt
4.3
CVSSv2
CVE-2012-2912
Multiple cross-site scripting (XSS) vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote malicious users to inject arbitrary web script or HTML via the (1) group parameter in the show-league page or (2) season parameter in the team page to wp-admin/admin.php...
Kolja Schleich Leaguemanager 3.7
7.5
CVSSv2
CVE-2013-1852
SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin prior to 3.8.1 for WordPress allows remote malicious users to execute arbitrary SQL commands via the league_id parameter in the leaguemanager-export page to wp-admin/admin.php.
Kolja Schleich LeaguemanagerKolja Schleich Leaguemanager 3.7Kolja Schleich Leaguemanager 3.6.9Kolja Schleich Leaguemanager 3.5.2Kolja Schleich Leaguemanager 3.5.1Kolja Schleich Leaguemanager 3.5Kolja Schleich Leaguemanager 3.4.2Kolja Schleich Leaguemanager 3.1.7Kolja Schleich Leaguemanager 3.1.6Kolja Schleich Leaguemanager 3.1.5Kolja Schleich Leaguemanager 3.1.4Kolja Schleich Leaguemanager 2.9Kolja Schleich Leaguemanager 2.8Kolja Schleich Leaguemanager 2.7.1Kolja Schleich Leaguemanager 2.1Kolja Schleich Leaguemanager 2.0Kolja Schleich Leaguemanager 1.5Kolja Schleich Leaguemanager 1.4.2Kolja Schleich Leaguemanager 3.6.7Kolja Schleich Leaguemanager 3.6.5Kolja Schleich Leaguemanager 3.6Kolja Schleich Leaguemanager 3.5.5
4.3
CVSSv2
CVE-2013-5711
Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System plugin prior to 3.7 for WordPress allows remote malicious users to inject arbitrary web script or HTML via the step parameter.
Slickremix Design Approval System Plugin 2.6Slickremix Design Approval System Plugin 2.5Slickremix Design Approval System Plugin 2.4Slickremix Design Approval System Plugin 2.3Slickremix Design Approval System Plugin 3.4Slickremix Design Approval System Plugin 3.3Slickremix Design Approval System Plugin 3.2Slickremix Design Approval System Plugin 3.1Slickremix Design Approval System Plugin 1.8Slickremix Design Approval System Plugin 1.7Slickremix Design Approval System Plugin 1.6Slickremix Design Approval System Plugin 1.5Slickremix Design Approval System Plugin 1.4Slickremix Design Approval System Plugin 3.5Slickremix Design Approval System Plugin 3.0Slickremix Design Approval System Plugin 2.8Slickremix Design Approval System Plugin 2.1Slickremix Design Approval System Plugin 1.9Slickremix Design Approval System Plugin 1.2Slickremix Design Approval System Plugin 1.0Slickremix Design Approval System PluginSlickremix Design Approval System Plugin 2.9
6.8
CVSSv2
CVE-2014-4717
Multiple cross-site request forgery (CSRF) vulnerabilities in the Simple Share Buttons Adder plugin prior to 4.5 for WordPress allow remote malicious users to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) ssba...
Sharethis Simple Share Buttons Adder 2.2Sharethis Simple Share Buttons Adder 2.0Sharethis Simple Share Buttons Adder 1.0Sharethis Simple Share Buttons Adder 3.2Sharethis Simple Share Buttons Adder 3.9Sharethis Simple Share Buttons Adder 3.8Sharethis Simple Share Buttons Adder 1.5Sharethis Simple Share Buttons Adder 2.3Sharethis Simple Share Buttons Adder 1.1Sharethis Simple Share Buttons Adder 3.1Sharethis Simple Share Buttons Adder 3.0Sharethis Simple Share Buttons Adder 2.9Sharethis Simple Share Buttons Adder 1.3Sharethis Simple Share Buttons Adder 4.1Sharethis Simple Share Buttons Adder 4.0Sharethis Simple Share Buttons Adder 2.4Sharethis Simple Share Buttons AdderSharethis Simple Share Buttons Adder 4.2Sharethis Simple Share Buttons Adder 3.5Sharethis Simple Share Buttons Adder 2.8Sharethis Simple Share Buttons Adder 2.6Sharethis Simple Share Buttons Adder 1.9
NA
CVE-2023-4549
The DoLogin Security WordPress plugin prior to 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by malicious users to conduct Stored XSS attacks via WordPress' login form.
Wpdo5ea Dologin Security
4.3
CVSSv2
CVE-2011-5104
Cross-site scripting (XSS) vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote malicious users to inject arbitrary web script or HTML via the custom_text parameter. NOTE: some of these details are obt...
Getshopped Wp E-commerce 3.8.6Getshopped Wp E-commerce 3.8.5Getshopped Wp E-commerce 3.8Getshopped Wp E-commerce 3.7.8.1Getshopped Wp E-commerce 3.7.8Getshopped Wp E-commerce 3.7.7Getshopped Wp E-commerce 3.7.6.2Getshopped Wp E-commerce 3.7.6.1Getshopped Wp E-commerce 3.7Getshopped Wp E-commerce 3.7.5.3Getshopped Wp E-commerce 3.7.5Getshopped Wp E-commerce 3.6.13Getshopped Wp E-commerce 3.6.12Getshopped Wp E-commerce 3.8.4Getshopped Wp E-commerce 3.8.3Getshopped Wp E-commerce 3.7.6.9Getshopped Wp E-commerce 3.7.6.7Getshopped Wp E-commerce 3.7.6Getshopped Wp E-commerce 3.7.5.2Getshopped Wp E-commerce 3.7.5.1Getshopped Wp E-commerce 3.7.4Getshopped Wp E-commerce 3.6.11
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
deserializationCVE-2024-4040cross-site scriptingCVE-2023-25790CVE-2024-2961XML external entityCVE-2024-26926CVE-2024-32806CVE-2024-32711
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook