Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
wordpress wordpress 2.3.1 vulnerabilities and exploits
(subscribe to this query)
356
VMScore
CVE-2021-24781
The Image Source Control WordPress plugin prior to 2.3.1 allows users with a role as low as Contributor to change arbitrary post meta fields of arbitrary posts (even those they should not be able to edit)
Imagesourcecontrol Image Source Control
383
VMScore
CVE-2015-7357
Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 prior to 2.7.10 for WordPress allows remote malicious users to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #<svg onload=alert(1)>.
Udesign Project Udesign 2.7.8
Udesign Project Udesign 2.7.7
Udesign Project Udesign 2.7.6
Udesign Project Udesign 2.7.5
Udesign Project Udesign 2.4.19
Udesign Project Udesign 2.4.18
Udesign Project Udesign 2.4.17
Udesign Project Udesign 2.4.16
Udesign Project Udesign 2.4.3
Udesign Project Udesign 2.4.2
Udesign Project Udesign 2.4.1
Udesign Project Udesign 2.4.0
Udesign Project Udesign 2.3.1
Udesign Project Udesign 2.7.0
Udesign Project Udesign 2.6.0
Udesign Project Udesign 2.5.6
Udesign Project Udesign 2.5.5
Udesign Project Udesign 2.5.4
Udesign Project Udesign 2.4.11
Udesign Project Udesign 2.4.10
Udesign Project Udesign 2.4.9
Udesign Project Udesign 2.4.8
312
VMScore
CVE-2022-1299
The Slideshow WordPress plugin up to and including 2.3.1 does not sanitize and escape some of its default slideshow settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Slideshow Project Slideshow
312
VMScore
CVE-2022-1209
The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for malicious users to redirect unsuspecting victims in versions up to, and including, 2...
Ultimatemember Ultimate Member
NA
CVE-2022-3837
The Uji Countdown WordPress plugin prior to 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisit...
Wpmanage Uji Countdown
383
VMScore
CVE-2022-1951
The core plugin for kitestudio WordPress plugin prior to 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leadi...
Kitestudio Core Plugin For Kitestudio Themes
890
VMScore
CVE-2012-4033
Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin prior to 2.4.0 for WordPress have unknown impact and attack vectors.
Zingiri Zingiri Web Shop 2.3.4
Zingiri Zingiri Web Shop 2.3.3
Zingiri Zingiri Web Shop 2.2.1
Zingiri Zingiri Web Shop 2.2.0
Zingiri Zingiri Web Shop 2.0.2
Zingiri Zingiri Web Shop 2.0.1
Zingiri Zingiri Web Shop 1.6.1
Zingiri Zingiri Web Shop 1.6.0
Zingiri Zingiri Web Shop 1.5.3
Zingiri Zingiri Web Shop 1.5.2
Zingiri Zingiri Web Shop 1.4.3
Zingiri Zingiri Web Shop 1.4.2
Zingiri Zingiri Web Shop 1.3.3
Zingiri Zingiri Web Shop 1.3.2
Zingiri Zingiri Web Shop 1.2.6
Zingiri Zingiri Web Shop 1.2.5
Zingiri Zingiri Web Shop 1.0.4
Zingiri Zingiri Web Shop 1.0.3
Zingiri Zingiri Web Shop 2.3.2
Zingiri Zingiri Web Shop 2.3.1
Zingiri Zingiri Web Shop 2.1.3
Zingiri Zingiri Web Shop 2.1.2
NA
CVE-2023-4792
The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missing capability check on the duplicate_ppmc_post_as_draft function in versions up to, and including, 2.3.1. This makes it possible for auth...
Inqsys Duplicate Post Page Menu \\& Custom Post Type
NA
CVE-2024-0561
The Ultimate Posts Widget WordPress plugin prior to 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltere...
NA
CVE-2022-4824
The WP Blog and Widgets WordPress plugin prior to 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be u...
Essentialplugin Wp Blog And Widget
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
cross-site scripting
CVE-2024-5158
XML external entity
CVE-2024-4262
CVE-2024-2036
CVE-2024-4985
CVE-2024-21791
remote attackers
CVE-2023-43208
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
2
3
4
5
6
7
8
NEXT »