Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

wordpress wordpress 1.2.3 vulnerabilities and exploits

(subscribe to this query)
8.8
CVSSv3
CVE-2023-28661
The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the get_popup_data action.
Accesspressthemes Wp Popup Banners 1.2.3Accesspressthemes Wp Popup Banners 1.2.4Accesspressthemes Wp Popup Banners 1.2.2Accesspressthemes Wp Popup Banners 1.2.1Accesspressthemes Wp Popup Banners 1.2.0Accesspressthemes Wp Popup Banners 1.1.9Accesspressthemes Wp Popup Banners 1.1.8Accesspressthemes Wp Popup Banners 1.1.7Accesspressthemes Wp Popup Banners 1.1.6Accesspressthemes Wp Popup Banners 1.1.5Accesspressthemes Wp Popup Banners 1.1.4Accesspressthemes Wp Popup Banners 1.1.3Accesspressthemes Wp Popup Banners 1.1.2Accesspressthemes Wp Popup Banners 1.1.1Accesspressthemes Wp Popup Banners 1.1.0Accesspressthemes Wp Popup Banners 1.0.9Accesspressthemes Wp Popup Banners 1.0.8Accesspressthemes Wp Popup Banners 1.0.7Accesspressthemes Wp Popup Banners 1.0.6Accesspressthemes Wp Popup Banners 1.0.5Accesspressthemes Wp Popup Banners 1.0.4Accesspressthemes Wp Popup Banners 1.0.3
NA
CVE-2013-6243
SQL injection vulnerability in the Landing Pages plugin 1.2.3, prior to 20131009, and previous versions for WordPress allows remote malicious users to execute arbitrary SQL commands via the "post" parameter to index.php.
Landing Pages Project Landing Pages PluginLanding Pages Project Landing Pages Plugin 1.2.1Landing Pages Project Landing Pages Plugin 1.1.9Landing Pages Project Landing Pages Plugin 1.0.9.0Landing Pages Project Landing Pages Plugin 1.0.8.6Landing Pages Project Landing Pages Plugin 1.0.5.6Landing Pages Project Landing Pages Plugin 1.0.5.3Landing Pages Project Landing Pages Plugin 1.1Landing Pages Project Landing Pages Plugin 1.1.0.1Landing Pages Project Landing Pages Plugin 1.0.9.9Landing Pages Project Landing Pages Plugin 1.0.8.1Landing Pages Project Landing Pages Plugin 1.1.8Landing Pages Project Landing Pages Plugin 1.1.7Landing Pages Project Landing Pages Plugin 1.0.8.5Landing Pages Project Landing Pages Plugin 1.0.8.4Landing Pages Project Landing Pages Plugin 1.0.5.1Landing Pages Project Landing Pages Plugin 1.0.4.4Landing Pages Project Landing Pages Plugin 1.0.7.9Landing Pages Project Landing Pages Plugin 1.0.4.2Landing Pages Project Landing Pages Plugin 1.0.4.1Landing Pages Project Landing Pages Plugin 1.0.9.4Landing Pages Project Landing Pages Plugin 1.0.9.3
NA
CVE-2014-4532
Cross-site scripting (XSS) vulnerability in templates/printAdminUsersList_Footer.tpl.php in the GarageSale plugin prior to 1.2.3 for WordPress allows remote malicious users to inject arbitrary web script or HTML via the page parameter.
Garagesale Project Garagesale
4.3
CVSSv3
CVE-2023-0505
The Ever Compare WordPress plugin up to and including 1.2.3 does not have CSRF check when activating plugins, which could allow malicious users to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Hasthemes Ever Compare
4.3
CVSSv3
CVE-2023-1087
The WC Sales Notification WordPress plugin prior to 1.2.3 does not have CSRF check when activating plugins, which could allow malicious users to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack
Hasthemes Wc Sales Notification
5.4
CVSSv3
CVE-2021-24643
The WP Map Block WordPress plugin prior to 1.2.3 does not escape some attributes of the WP Map Block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Wp Map Block Project Wp Map Block
4.8
CVSSv3
CVE-2022-1559
The Clipr WordPress plugin up to and including 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed
Clipr Clipr
6.1
CVSSv3
CVE-2024-0239
The Contact Form 7 Connector WordPress plugin prior to 1.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against administrators.
Ari-soft Contact Form 7 Connector
6.1
CVSSv3
CVE-2021-38351
The OSD Subscribe WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the osd_subscribe_message parameter found in the ~/options/osd_subscribe_options_subscribers.php file which allows malicious users to inject arbitrary web scripts, in versions up to and includi...
Outsidesource Osd Subscribe
5.3
CVSSv3
CVE-2023-1868
The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when clearing the plugin cache via the yrc_clear_cache GET parameter in versions up to, and including, 1.2.3. This makes it possible for unauthenticated malicious use...
Plugin Yourchannel
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
injectionCVE-2024-30983CVE-2023-4235CVE-2024-21338privilegeencryptionCVE-2023-4232CVE-2024-31497CVE-2024-32341
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook