Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

wordpress wordpress 2.6.3 vulnerabilities and exploits

(subscribe to this query)
NA
CVE-2014-8585
Directory traversal vulnerability in the WordPress Download Manager plugin for WordPress allows remote malicious users to read arbitrary files via a .. (dot dot) in the fname parameter to (1) views/file_download.php or (2) file_download.php.
Wpdownloadmanager Wordpress Download Manager 2.6.91Wpdownloadmanager Wordpress Download Manager 2.6.9Wpdownloadmanager Wordpress Download Manager 2.6.2Wpdownloadmanager Wordpress Download Manager 2.6.1Wpdownloadmanager Wordpress Download Manager 2.5.93Wpdownloadmanager Wordpress Download Manager 2.5.92Wpdownloadmanager Wordpress Download Manager 2.5.4Wpdownloadmanager Wordpress Download Manager 2.5.3Wpdownloadmanager Wordpress Download Manager 2.4.6Wpdownloadmanager Wordpress Download Manager 2.4.5Wpdownloadmanager Wordpress Download Manager 2.3.7Wpdownloadmanager Wordpress Download Manager 2.3.6Wpdownloadmanager Wordpress Download Manager 2.2.9Wpdownloadmanager Wordpress Download Manager 2.2.8Wpdownloadmanager Wordpress Download Manager 2.2.1Wpdownloadmanager Wordpress Download Manager 2.2.0Wpdownloadmanager Wordpress Download Manager 2.1.3Wpdownloadmanager Wordpress Download Manager 2.0.16Wpdownloadmanager Wordpress Download Manager 2.0.15Wpdownloadmanager Wordpress Download Manager 2.0.8Wpdownloadmanager Wordpress Download Manager 2.0.7Wpdownloadmanager Wordpress Download Manager 1.5.33
6.1
CVSSv3
CVE-2019-6780
The Wise Chat plugin prior to 2.7 for WordPress mishandles external links because rendering/filters/post/WiseChatLinksPostFilter.php omits noopener and noreferrer.
Kaine Wise Chat
NA
CVE-2013-1852
SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin prior to 3.8.1 for WordPress allows remote malicious users to execute arbitrary SQL commands via the league_id parameter in the leaguemanager-export page to wp-admin/admin.php.
Kolja Schleich LeaguemanagerKolja Schleich Leaguemanager 3.7Kolja Schleich Leaguemanager 3.6.9Kolja Schleich Leaguemanager 3.5.2Kolja Schleich Leaguemanager 3.5.1Kolja Schleich Leaguemanager 3.5Kolja Schleich Leaguemanager 3.4.2Kolja Schleich Leaguemanager 3.1.7Kolja Schleich Leaguemanager 3.1.6Kolja Schleich Leaguemanager 3.1.5Kolja Schleich Leaguemanager 3.1.4Kolja Schleich Leaguemanager 2.9Kolja Schleich Leaguemanager 2.8Kolja Schleich Leaguemanager 2.7.1Kolja Schleich Leaguemanager 2.1Kolja Schleich Leaguemanager 2.0Kolja Schleich Leaguemanager 1.5Kolja Schleich Leaguemanager 1.4.2Kolja Schleich Leaguemanager 3.6.7Kolja Schleich Leaguemanager 3.6.5Kolja Schleich Leaguemanager 3.6Kolja Schleich Leaguemanager 3.5.5
NA
CVE-2014-4725
The MailPoet Newsletters (wysija-newsletters) plugin prior to 2.6.7 for WordPress allows remote malicious users to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/...
Mailpoet Mailpoet Newsletters 2.6.4Mailpoet Mailpoet Newsletters 2.6.3Mailpoet Mailpoet Newsletters 2.6.2Mailpoet Mailpoet Newsletters 2.6.1Mailpoet Mailpoet Newsletters 2.5.1Mailpoet Mailpoet Newsletters 2.5Mailpoet Mailpoet Newsletters 2.4.4Mailpoet Mailpoet Newsletters 2.4.3Mailpoet Mailpoet Newsletters 2.2Mailpoet Mailpoet Newsletters 2.1.9Mailpoet Mailpoet Newsletters 2.1.8Mailpoet Mailpoet Newsletters 2.1.7Mailpoet Mailpoet Newsletters 2.1.6Mailpoet Mailpoet Newsletters 2.0.4Mailpoet Mailpoet NewslettersMailpoet Mailpoet Newsletters 2.6Mailpoet Mailpoet Newsletters 2.5.9.3Mailpoet Mailpoet Newsletters 2.5.7Mailpoet Mailpoet Newsletters 2.5.4Mailpoet Mailpoet Newsletters 2.5.2Mailpoet Mailpoet Newsletters 2.4.2Mailpoet Mailpoet Newsletters 2.4
NA
CVE-2013-3253
Cross-site request forgery (CSRF) vulnerability in admin/setting.php in the Xhanch - My Twitter plugin prior to 2.7.7 for WordPress allows remote malicious users to hijack the authentication of administrators for requests that change unspecified settings.
Xhanch My TwitterXhanch My Twitter 2.5.8Xhanch My Twitter 2.5.9Xhanch My Twitter 2.6.0Xhanch My Twitter 2.6.1Xhanch My Twitter 2.6.2Xhanch My Twitter 2.6.3Xhanch My Twitter 2.6.4Xhanch My Twitter 2.6.5Xhanch My Twitter 2.6.6Xhanch My Twitter 2.6.7Xhanch My Twitter 2.6.8Xhanch My Twitter 2.6.9Xhanch My Twitter 2.7.0Xhanch My Twitter 2.7.1Xhanch My Twitter 2.7.2Xhanch My Twitter 2.7.3Xhanch My Twitter 2.7.4Xhanch My Twitter 2.7.5
7.5
CVSSv3
CVE-2022-3846
The Workreap WordPress theme prior to 2.6.3 has a vulnerability with the notifications feature as it's possible to read any user's notification (employer or freelancer) as the notification ID is brute-forceable.
Amentotech Workreap
6.1
CVSSv3
CVE-2019-18834
Persistent XSS in the WooCommerce Subscriptions plugin prior to 2.6.3 for WordPress allows remote malicious users to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php.
Woocommerce Subscriptions
4.8
CVSSv3
CVE-2021-24972
The Pixel Cat WordPress plugin prior to 2.6.3 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed
Fatcatapps Pixel Cat
9.8
CVSSv3
CVE-2022-0827
The Bestbooks WordPress plugin up to and including 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
Presspage Bestbooks
4.8
CVSSv3
CVE-2021-24516
The PlanSo Forms WordPress plugin up to and including 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Sto...
Planso Planso Forms
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-47626CVE-2024-3400physicalCVE-2024-31426CVE-2024-22423CVE-2024-22438injectlocal usersCVE-2024-3797
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook