Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

wordpress wordpress 2.5 vulnerabilities and exploits

(subscribe to this query)
NA
CVE-2012-2401
Plupload prior to 1.5.4, as used in wp-includes/js/plupload/ in WordPress prior to 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote malicious users to bypass the Same Origin Policy via crafted content.
Wordpress WordpressWordpress Wordpress 2.0.9Wordpress Wordpress 2.2Wordpress Wordpress 2.0Wordpress Wordpress 2.3.2Wordpress Wordpress 2.0.1Wordpress Wordpress 2.0.7Wordpress Wordpress 2.1Wordpress Wordpress 2.8.1Wordpress Wordpress 2.8.2Wordpress Wordpress 2.2.3Wordpress Wordpress 2.6.2Wordpress Wordpress 2.3.1Wordpress Wordpress 1.5.1.2Wordpress Wordpress 2.0.2Wordpress Wordpress 2.0.4Wordpress Wordpress 2.7Wordpress Wordpress 3.0.3Wordpress Wordpress 2.3.3Wordpress Wordpress 3.0.5Wordpress Wordpress 2.2.2Wordpress Wordpress 3.0.1
NA
CVE-2014-0165
WordPress prior to 3.7.2 and 3.8.x prior to 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
Wordpress Wordpress 3.7Wordpress WordpressWordpress Wordpress 3.4.2Wordpress Wordpress 3.4.1Wordpress Wordpress 3.2Wordpress Wordpress 3.0.4Wordpress Wordpress 3.0.3Wordpress Wordpress 2.9Wordpress Wordpress 3.8Wordpress Wordpress 3.8.1Wordpress Wordpress 3.4.0Wordpress Wordpress 3.3.3Wordpress Wordpress 3.1.4Wordpress Wordpress 3.1.3Wordpress Wordpress 3.0.2Wordpress Wordpress 3.0.1Wordpress Wordpress 2.8.5.2Wordpress Wordpress 2.8.5.1Wordpress Wordpress 3.6.1Wordpress Wordpress 3.6Wordpress Wordpress 3.3.2Wordpress Wordpress 3.3.1
NA
CVE-2014-0166
The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress prior to 3.7.2 and 3.8.x prior to 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote malicious users to obtain access via a forged cookie.
Wordpress Wordpress 3.6Wordpress Wordpress 3.5.1Wordpress Wordpress 3.3.1Wordpress Wordpress 3.3Wordpress Wordpress 3.1Wordpress Wordpress 3.0.6Wordpress Wordpress 2.9.2Wordpress Wordpress 2.9.1.1Wordpress Wordpress 2.8.4Wordpress WordpressWordpress Wordpress 3.8Wordpress Wordpress 3.4.1Wordpress Wordpress 3.4.0Wordpress Wordpress 3.1.4Wordpress Wordpress 3.1.3Wordpress Wordpress 3.0.3Wordpress Wordpress 3.0.2Wordpress Wordpress 2.8.6Wordpress Wordpress 2.8.5.2Wordpress Wordpress 2.8Wordpress Wordpress 2.7.1Wordpress Wordpress 2.5.1
NA
CVE-2013-0237
Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload prior to 1.5.5, as used in WordPress prior to 3.5.1 and other products, allows remote malicious users to inject arbitrary web script or HTML via the id parameter.
Wordpress Wordpress 3.3.3Wordpress Wordpress 3.3.2Wordpress Wordpress 2.5.1Wordpress Wordpress 2.0.11Wordpress Wordpress 2.6.2Wordpress Wordpress 2.6.1Wordpress Wordpress 2.6Wordpress Wordpress 2.3.1Wordpress Wordpress 2.0Wordpress Wordpress 2.7Wordpress Wordpress 2.9Wordpress Wordpress 2.9.1Wordpress Wordpress 2.6.5Wordpress Wordpress 1.6.2Wordpress Wordpress 1.5.2Wordpress Wordpress 1.5Wordpress Wordpress 1.5.1Wordpress Wordpress 1.3Wordpress Wordpress 1.3.2Wordpress Wordpress 0.71Moxiecode PluploadWordpress Wordpress
NA
CVE-2009-2334
wp-admin/admin.php in WordPress and WordPress MU prior to 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote malicious users to specify a configuration file in the page parameter to obtain sensitive information or mod...
Wordpress Wordpress 2.3.3Wordpress Wordpress 2.3.2Wordpress Wordpress 2.2.2Wordpress Wordpress 2.2.1Wordpress Wordpress 2.1.1Wordpress Wordpress 2.1Wordpress Wordpress 2.6Wordpress Wordpress 2.3.1Wordpress Wordpress 2.2.0Wordpress Wordpress 2.2Wordpress Wordpress 2.0.9Wordpress Wordpress 2.0.8Wordpress Wordpress 2.0.11Wordpress Wordpress 2.0.10 Rc2Wordpress Wordpress 1.5.1.3Wordpress Wordpress 1.5.1.2Wordpress Wordpress 1.2.2Wordpress Wordpress 1.2.1Wordpress Wordpress 2.5.1Wordpress Wordpress 2.5Wordpress Wordpress 2.3Wordpress Wordpress 2.2 Revision5003
NA
CVE-2009-2432
WordPress and WordPress MU prior to 2.8.1 allow remote malicious users to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an error message.
Wordpress Wordpress 2.6Wordpress Wordpress 2.5.1Wordpress Wordpress 2.3Wordpress Wordpress 2.2 Revision5003Wordpress Wordpress 2.1Wordpress Wordpress 2.1.3 Rc2Wordpress Wordpress 2.0.8Wordpress Wordpress 2.0.7Wordpress Wordpress 2.0.10 Rc1Wordpress Wordpress 2.0.10Wordpress Wordpress 1.5.1.1Wordpress Wordpress 1.5.1Wordpress Wordpress 1.2.1Wordpress Wordpress 1.2-mingusWordpress Wordpress 1.0.2Wordpress Wordpress 1.0.1-milesWordpress Wordpress 0.72Wordpress Wordpress 0.711Wordpress Wordpress 0.6.2Wordpress Wordpress 2.6.1Wordpress Wordpress 2.6.3Wordpress Wordpress Mu 1.2.4
NA
CVE-2012-3414
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and previous versions, as used in WordPress prior to 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote malicious users to inject arbitrary web script or HTML via the movieName paramet...
Wordpress Wordpress 3.0.1Wordpress Wordpress 3.0.2Wordpress Wordpress 3.1.2Wordpress Wordpress 3.1.3Swfupload Project Swfupload 1.0.2Swfupload Project Swfupload 2.0.2Wordpress Wordpress 3.0.3Wordpress Wordpress 3.0.4Wordpress Wordpress 3.1.4Wordpress Wordpress 3.2Swfupload Project Swfupload 2.1.0Wordpress Wordpress 3.0.5Wordpress Wordpress 3.0.6Wordpress Wordpress 3.2.1Wordpress Wordpress 3.3Swfupload Project Swfupload 2.2.0Swfupload Project SwfuploadWordpress Wordpress -Wordpress Wordpress 3.0Wordpress Wordpress 3.1Wordpress Wordpress 3.1.1Wordpress Wordpress
NA
CVE-2013-2705
Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart plugin prior to 3.6 for WordPress allows remote malicious users to hijack the authentication of administrators for requests that change plugin settings.
Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 3.3.1Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 3.2.9Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 2.5Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 2.3Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 2.1Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 1.6Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 1.4Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 3.2.8Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 3.2.7Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 2.8Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 2.6Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 1.2.2Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 1.2Tipsandtricks-hq Wordpress Simple Paypal Shopping CartTipsandtricks-hq Wordpress Simple Paypal Shopping Cart 3.4Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 2.0Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 1.9Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 1.8Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 1.7Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 3.3.2Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 3.3.0Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 2.4
NA
CVE-2015-3440
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress prior to 4.2.1 allows remote malicious users to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.
Debian Debian Linux 7.0Debian Debian Linux 8.0Wordpress Wordpress
NA
CVE-2014-9097
Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed prior to 2014-07-23, for WordPress allow (1) remote malicious users to execute arbitrary SQL commands via the vid parameter in a myextract actio...
Apptha Contus Video Gallery 2.5
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-1183hard-codedCVE-2024-28254CVE-2023-43790buffer overflowbypassCVE-2024-32633CVE-2024-1874CVE-2024-23558
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook