Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

wordpress wordpress 1.4 vulnerabilities and exploits

(subscribe to this query)
5.4
CVSSv3
CVE-2022-36405
Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in amCharts: Charts and Maps plugin <= 1.4 at WordPress.
Amcharts Amcharts\\ Charts And Maps
9.8
CVSSv3
CVE-2016-10955
The cysteme-finder plugin prior to 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
Cysteme Cysteme-finder
NA
CVE-2014-5344
Multiple cross-site scripting (XSS) vulnerabilities in the Mobiloud (mobiloud-mobile-app-plugin) plugin prior to 2.3.8 for WordPress allow remote malicious users to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third pa...
Mobiloud Mobiloud 2.3.1Mobiloud Mobiloud 2.1Mobiloud Mobiloud 1.8.11Mobiloud Mobiloud 1.8.9Mobiloud Mobiloud 1.8.2Mobiloud Mobiloud 1.8.0Mobiloud Mobiloud 1.6.2Mobiloud Mobiloud 1.6Mobiloud Mobiloud 1.4Mobiloud Mobiloud 1.3.7Mobiloud Mobiloud 1.2.5Mobiloud Mobiloud 1.0Mobiloud Mobiloud 1.8.8Mobiloud Mobiloud 1.8.7Mobiloud Mobiloud 1.8.6Mobiloud Mobiloud 1.8.5Mobiloud Mobiloud 1.5.3Mobiloud Mobiloud 1.5.2Mobiloud Mobiloud 1.5.1Mobiloud Mobiloud 1.5Mobiloud Mobiloud 1.9.0Mobiloud Mobiloud 1.8.16
6.1
CVSSv3
CVE-2019-15772
The nd-donations plugin prior to 1.4 for WordPress has a nopriv_ AJAX action that allows modification of the siteurl setting.
Donations Project Donations
5.3
CVSSv3
CVE-2022-1595
The HC Custom WP-Admin URL WordPress plugin up to and including 1.4 leaks the secret login URL when sending a specific crafted request
Hc Custom Wp-admin Url Project Hc Custom Wp-admin Url
5.7
CVSSv3
CVE-2021-24752
Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin prior to 1.9, To Top WordPress plugin prior to 2.3,...
Catchplugins Catch Scroll Progress BarCatchplugins Catch Sticky MenuCatchplugins Catch Themes Demo ImportCatchplugins Catch Under ConstructionCatchplugins Catch Web ToolsCatchplugins Essential Content TypesCatchplugins Generate Child ThemeCatchplugins Header EnhancementCatchplugins To TopCatchplugins Essential Widgets
4.8
CVSSv3
CVE-2019-14795
The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=update_title_options isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter.
Toggle-the-title Project Toggle-the-title
NA
CVE-2013-2710
Cross-site request forgery (CSRF) vulnerability in the Contextual Related Posts plugin prior to 1.8.7 for WordPress allows remote malicious users to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via unspecified vectors.
Ajaydsouza Contextual Related Posts 1.8.1Ajaydsouza Contextual Related Posts 1.8Ajaydsouza Contextual Related Posts 1.6.3Ajaydsouza Contextual Related Posts 1.6.2Ajaydsouza Contextual Related Posts 1.4Ajaydsouza Contextual Related Posts 1.3.1Ajaydsouza Contextual Related Posts 1.8.5Ajaydsouza Contextual Related Posts 1.8.4Ajaydsouza Contextual Related Posts 1.7.1Ajaydsouza Contextual Related Posts 1.7Ajaydsouza Contextual Related Posts 1.5.2Ajaydsouza Contextual Related Posts 1.5.1Ajaydsouza Contextual Related Posts 1.5Ajaydsouza Contextual Related Posts 1.2.1Ajaydsouza Contextual Related Posts 1.2Ajaydsouza Contextual Related Posts 1.8.3Ajaydsouza Contextual Related Posts 1.8.2Ajaydsouza Contextual Related Posts 1.6.5Ajaydsouza Contextual Related Posts 1.6.4Ajaydsouza Contextual Related Posts 1.4.2Ajaydsouza Contextual Related Posts 1.4.1Ajaydsouza Contextual Related Posts 1.1.1
NA
CVE-2014-2558
The File Gallery plugin prior to 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function.
Skyphe File-gallery 1.7.2Skyphe File-gallery 1.7.1Skyphe File-gallery 1.7Skyphe File-gallery 1.6.5.5Skyphe File-gallery 1.6.6Skyphe File-gallery 1.6.5.4Skyphe File-gallery 1.6.5.3Skyphe File-gallery 1.5.7Skyphe File-gallery 1.5.6Skyphe File-gallery 1.5.5Skyphe File-gallery 1.5.4Skyphe File-gallery 1.7.5.3Skyphe File-gallery 1.7.5.1Skyphe File-gallery 1.7.5Skyphe File-gallery 1.6.3Skyphe File-gallery 1.6.2Skyphe File-gallery 1.6.0.1Skyphe File-gallery 1.6Skyphe File-gallery 1.5Skyphe File-gallerySkyphe File-gallery 1.7.7Skyphe File-gallery 1.7.4.1
6.1
CVSSv3
CVE-2022-0621
The dTabs WordPress plugin up to and including 1.4 does not sanitize and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Dtabs Project Dtabs
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-1183hard-codedCVE-2024-28254CVE-2023-43790buffer overflowbypassCVE-2024-32633CVE-2024-1874CVE-2024-23558
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook