wordpress wordpress 2.8.1 vulnerabilities and exploits

(subscribe to this query)

NA

Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress prior to 2.8.2 allows remote malicious users to inject arbitrary web script or HTML via a comment author URL.

Wordpress Wordpress

1 EDB exploit

9.8

CVSSv3

The Secure Copy Content Protection and Content Locking WordPress plugin prior to 2.8.2 does not escape the sccp_id parameter of the ays_sccp_results_export_file AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to ...

Ays-pro Secure Copy Content Protection And Content Locking

NA

Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and previous versions, for WordPress allows remote malicious users to inject arbitrary web script or HTML via the aoid parameter.

Wptrafficanalyzer Trafficanalyzer 3.3.2 Wptrafficanalyzer Trafficanalyzer 3.0.1 Wptrafficanalyzer Trafficanalyzer 3.0.0 Wptrafficanalyzer Trafficanalyzer 2.7.0 Wptrafficanalyzer Trafficanalyzer 2.6.0 Wptrafficanalyzer Trafficanalyzer 2.2.1 Wptrafficanalyzer Trafficanalyzer 2.2.0 Wptrafficanalyzer Trafficanalyzer 1.5.0 Wptrafficanalyzer Trafficanalyzer 1.4.0 Wptrafficanalyzer Trafficanalyzer 1.0.0 Wptrafficanalyzer Trafficanalyzer 3.2.1 Wptrafficanalyzer Trafficanalyzer 3.2.0 Wptrafficanalyzer Trafficanalyzer 3.1.0 Wptrafficanalyzer Trafficanalyzer 2.8.2 Wptrafficanalyzer Trafficanalyzer 2.8.1 Wptrafficanalyzer Trafficanalyzer 2.5.0 Wptrafficanalyzer Trafficanalyzer 2.4.1 Wptrafficanalyzer Trafficanalyzer 1.8.0 Wptrafficanalyzer Trafficanalyzer 1.7.0 Wptrafficanalyzer Trafficanalyzer 1.1.3 Wptrafficanalyzer Trafficanalyzer 1.1.2 Wptrafficanalyzer Trafficanalyzer 3.0.3

1 EDB exploit

4.8

CVSSv3

The Login rebuilder WordPress plugin prior to 2.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multis...

12net Login Rebuilder

4.8

CVSSv3

The SEO by 10Web WordPress plugin prior to 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite...

10web Seo

6.1

CVSSv3

The Recipe Card Blocks by WPZOOM WordPress plugin prior to 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue

Wpzoom Recipe Card Blocks For Gutenberg \\& Elementor

4.8

CVSSv3

The Slickr Flickr WordPress plugin up to and including 2.8.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Diywebmastery Slickr Flickr

8.8

CVSSv3

The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin prior to 2.8.1, available to any authenticated user, does not sanitise the categoryID parameter before using it in a SQL statement, leading to an SQL injection

Frenify Mediamatic

4.3

CVSSv3

The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with subscriber-level permiss...

Frenify Mediamatic

6.1

CVSSv3

The Stockdio Historical Chart plugin prior to 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The stockdio_event...

Stockdio Stockdio Historical Chart

Get Started

« PREV 1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook