Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
wordpress wordpress 2.3.1 vulnerabilities and exploits
(subscribe to this query)
4.3
CVSSv3
CVE-2021-24781
The Image Source Control WordPress plugin prior to 2.3.1 allows users with a role as low as Contributor to change arbitrary post meta fields of arbitrary posts (even those they should not be able to edit)
Imagesourcecontrol Image Source Control
6.1
CVSSv3
CVE-2015-7357
Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 prior to 2.7.10 for WordPress allows remote malicious users to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #<svg onload=alert(1)>.
Udesign Project Udesign 2.7.8
Udesign Project Udesign 2.7.7
Udesign Project Udesign 2.7.6
Udesign Project Udesign 2.7.5
Udesign Project Udesign 2.4.19
Udesign Project Udesign 2.4.18
Udesign Project Udesign 2.4.17
Udesign Project Udesign 2.4.16
Udesign Project Udesign 2.4.3
Udesign Project Udesign 2.4.2
Udesign Project Udesign 2.4.1
Udesign Project Udesign 2.4.0
Udesign Project Udesign 2.3.1
Udesign Project Udesign 2.7.0
Udesign Project Udesign 2.6.0
Udesign Project Udesign 2.5.6
Udesign Project Udesign 2.5.5
Udesign Project Udesign 2.5.4
Udesign Project Udesign 2.4.11
Udesign Project Udesign 2.4.10
Udesign Project Udesign 2.4.9
Udesign Project Udesign 2.4.8
4.8
CVSSv3
CVE-2022-1299
The Slideshow WordPress plugin up to and including 2.3.1 does not sanitize and escape some of its default slideshow settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Slideshow Project Slideshow
5.4
CVSSv3
CVE-2022-1209
The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for malicious users to redirect unsuspecting victims in versions up to, and including, 2...
Ultimatemember Ultimate Member
4.8
CVSSv3
CVE-2022-3837
The Uji Countdown WordPress plugin prior to 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisit...
Wpmanage Uji Countdown
6.1
CVSSv3
CVE-2022-1951
The core plugin for kitestudio WordPress plugin prior to 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leadi...
Kitestudio Core Plugin For Kitestudio Themes
NA
CVE-2012-4033
Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin prior to 2.4.0 for WordPress have unknown impact and attack vectors.
Zingiri Zingiri Web Shop 2.3.4
Zingiri Zingiri Web Shop 2.3.3
Zingiri Zingiri Web Shop 2.2.1
Zingiri Zingiri Web Shop 2.2.0
Zingiri Zingiri Web Shop 2.0.2
Zingiri Zingiri Web Shop 2.0.1
Zingiri Zingiri Web Shop 1.6.1
Zingiri Zingiri Web Shop 1.6.0
Zingiri Zingiri Web Shop 1.5.3
Zingiri Zingiri Web Shop 1.5.2
Zingiri Zingiri Web Shop 1.4.3
Zingiri Zingiri Web Shop 1.4.2
Zingiri Zingiri Web Shop 1.3.3
Zingiri Zingiri Web Shop 1.3.2
Zingiri Zingiri Web Shop 1.2.6
Zingiri Zingiri Web Shop 1.2.5
Zingiri Zingiri Web Shop 1.0.4
Zingiri Zingiri Web Shop 1.0.3
Zingiri Zingiri Web Shop 2.3.2
Zingiri Zingiri Web Shop 2.3.1
Zingiri Zingiri Web Shop 2.1.3
Zingiri Zingiri Web Shop 2.1.2
4.3
CVSSv3
CVE-2023-4792
The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missing capability check on the duplicate_ppmc_post_as_draft function in versions up to, and including, 2.3.1. This makes it possible for auth...
Inqsys Duplicate Post Page Menu \\& Custom Post Type
NA
CVE-2024-0561
The Ultimate Posts Widget WordPress plugin prior to 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltere...
5.4
CVSSv3
CVE-2022-4765
The Portfolio for Elementor WordPress plugin prior to 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could ...
Pwrplugins Portfolio For Elementor
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
encryption
CVE-2024-4331
CVE-2024-26925
arbitrary code
CVE-2006-4304
CVE-2024-25458
CVE-2024-27077
reflected XSS
CVE-2024-4059
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
2
3
4
5
6
7
8
NEXT »