Vulmon Recent Vulnerabilities Product List Research Posts Trends Blog About Contact

wordpress wordpress 2.3 vulnerabilities and exploits

(subscribe to this query)
NA

CVE-2014-4725

The MailPoet Newsletters (wysija-newsletters) plugin prior to 2.6.7 for WordPress allows remote malicious users to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/...
Mailpoet Mailpoet Newsletters 2.1.1Mailpoet Mailpoet Newsletters 2.0.6Mailpoet Mailpoet Newsletters 1.1.5Mailpoet Mailpoet Newsletters 2.0Mailpoet Mailpoet Newsletters 2.1.2Mailpoet Mailpoet Newsletters 2.6.3Mailpoet Mailpoet Newsletters 1.0.1Mailpoet Mailpoet Newsletters 2.5.4Mailpoet Mailpoet Newsletters 0.9.2Mailpoet Mailpoet Newsletters 2.3.1Mailpoet Mailpoet Newsletters 2.4.1Mailpoet Mailpoet Newsletters 2.3.2Mailpoet Mailpoet Newsletters 2.6Mailpoet Mailpoet Newsletters 2.5.9.3Mailpoet Mailpoet Newsletters 2.0.7Mailpoet Mailpoet Newsletters 2.0.8Mailpoet Mailpoet Newsletters 2.0.9Mailpoet Mailpoet Newsletters 2.4.4Mailpoet Mailpoet Newsletters 2.6.4Mailpoet Mailpoet Newsletters 2.5.3Mailpoet Mailpoet Newsletters 2.3.3Mailpoet Mailpoet Newsletters 2.0.5
NA

CVE-2013-3476

Cross-site request forgery (CSRF) vulnerability in the WordPress Related Posts plugin prior to 2.6.2 for WordPress allows remote malicious users to hijack the authentication of users for requests that change settings via unspecified vectors.
Zemanta Related Posts 2.5.1Zemanta Related Posts 1.3Zemanta Related Posts 2.3Zemanta Related Posts 1.3.2Zemanta Related Posts 1.3.1Zemanta Related Posts 1.5Zemanta Related Posts 1.1Zemanta Related Posts 1.0Zemanta Related Posts 1.8Zemanta Related PostsZemanta Related Posts 1.8.1Zemanta Related Posts 2.4.1Zemanta Related Posts 1.6Zemanta Related Posts 1.7Zemanta Related Posts 1.2Zemanta Related Posts 1.3.3Zemanta Related Posts 1.4
NA

CVE-2013-3257

Cross-site request forgery (CSRF) vulnerability in the Related Posts plugin prior to 2.7.2 for WordPress allows remote malicious users to hijack the authentication of users for requests that modify settings via unspecified vectors.
Zemanta Related PostsZemanta Related Posts 2.5.1Zemanta Related Posts 1.3Zemanta Related Posts 2.3Zemanta Related Posts 2.6Zemanta Related Posts 1.3.2Zemanta Related Posts 1.3.1Zemanta Related Posts 1.5Zemanta Related Posts 1.1Zemanta Related Posts 1.0Zemanta Related Posts 1.8Zemanta Related Posts 1.8.1Zemanta Related Posts 2.4.1Zemanta Related Posts 1.6Zemanta Related Posts 1.7Zemanta Related Posts 1.2Zemanta Related Posts 1.3.3Zemanta Related Posts 2.7Zemanta Related Posts 1.4
NA

CVE-2010-4403

The Register Plus plugin 3.5.1 and previous versions for WordPress allows remote malicious users to obtain sensitive information via a direct request to (1) dash_widget.php and (2) register-plus.php, which reveals the installation path in an error message.
Devbits Register-plusDevbits Register-plus 1.1Devbits Register-plus 1.2Devbits Register-plus 2.0Devbits Register-plus 2.1Devbits Register-plus 2.2Devbits Register-plus 2.3Devbits Register-plus 2.4Devbits Register-plus 2.5Devbits Register-plus 2.6Devbits Register-plus 2.7Devbits Register-plus 2.8Devbits Register-plus 2.9Devbits Register-plus 3.0Devbits Register-plus 3.0.1Devbits Register-plus 3.0.2Devbits Register-plus 3.1Devbits Register-plus 3.2Devbits Register-plus 3.3Devbits Register-plus 3.4Devbits Register-plus 3.4.1Devbits Register-plus 3.5
NA

CVE-2010-4402

Multiple cross-site scripting (XSS) vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and previous versions for WordPress allow remote malicious users to inject arbitrary web script or HTML via the (1) firstname, (2) lastname, (3) website, (4) aim, (5) yahoo, (6) ...
Devbits Register-plusDevbits Register-plus 1.1Devbits Register-plus 1.2Devbits Register-plus 2.0Devbits Register-plus 2.1Devbits Register-plus 2.2Devbits Register-plus 2.3Devbits Register-plus 2.4Devbits Register-plus 2.5Devbits Register-plus 2.6Devbits Register-plus 2.7Devbits Register-plus 2.8Devbits Register-plus 2.9Devbits Register-plus 3.0Devbits Register-plus 3.0.1Devbits Register-plus 3.0.2Devbits Register-plus 3.1Devbits Register-plus 3.2Devbits Register-plus 3.3Devbits Register-plus 3.4Devbits Register-plus 3.4.1Devbits Register-plus 3.5
5.7
CVSSv3

CVE-2021-24752

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin prior to 1.9, To Top WordPress plugin prior to 2.3,...
Catchplugins Catch Scroll Progress BarCatchplugins Catch Sticky MenuCatchplugins Catch Themes Demo ImportCatchplugins Catch Under ConstructionCatchplugins Catch Web ToolsCatchplugins Essential Content TypesCatchplugins Generate Child ThemeCatchplugins Header EnhancementCatchplugins To TopCatchplugins Essential Widgets
NA

CVE-2014-0173

The Jetpack plugin prior to 1.9 prior to 1.9.4, 2.0.x prior to 2.0.9, 2.1.x prior to 2.1.4, 2.2.x prior to 2.2.7, 2.3.x prior to 2.3.7, 2.4.x prior to 2.4.4, 2.5.x prior to 2.5.2, 2.6.x prior to 2.6.3, 2.7.x prior to 2.7.2, 2.8.x prior to 2.8.2, and 2.9.x prior to 2.9.3 for WordP...
Automattic Jetpack 2.3.4Automattic Jetpack 2.0.4Automattic Jetpack 2.1Automattic Jetpack 2.2.2Automattic Jetpack 2.3.3Automattic Jetpack 2.9.1Automattic Jetpack 2.1.2Automattic Jetpack 2.4.2Automattic Jetpack 2.7Automattic Jetpack 2.9Automattic Jetpack 2.0.1Automattic Jetpack 2.4Automattic Jetpack 2.9.3Automattic Jetpack 2.3.5Automattic Jetpack 2.1.1Automattic Jetpack 2.2.4Automattic Jetpack 1.9Automattic Jetpack 2.6.1Automattic Jetpack 2.0Automattic Jetpack 2.0.3Automattic Jetpack 2.2.1Automattic Jetpack 2.2
NA

CVE-2014-5344

Multiple cross-site scripting (XSS) vulnerabilities in the Mobiloud (mobiloud-mobile-app-plugin) plugin prior to 2.3.8 for WordPress allow remote malicious users to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third pa...
Mobiloud Mobiloud 1.8.9Mobiloud Mobiloud 1.4.1Mobiloud Mobiloud 1.9.1Mobiloud Mobiloud 1.6.2Mobiloud Mobiloud 1.8.8Mobiloud Mobiloud 2.1Mobiloud Mobiloud 1.8.15Mobiloud Mobiloud 1.8.5Mobiloud Mobiloud 1.5Mobiloud Mobiloud 1.7Mobiloud Mobiloud 1.2.6Mobiloud MobiloudMobiloud Mobiloud 1.3.8Mobiloud Mobiloud 1.6Mobiloud Mobiloud 1.4Mobiloud Mobiloud 1.3.6Mobiloud Mobiloud 1.8.2Mobiloud Mobiloud 1.8.6Mobiloud Mobiloud 1.6.1Mobiloud Mobiloud 1.2.4Mobiloud Mobiloud 1.8.12Mobiloud Mobiloud 1.7.1
5.4
CVSSv3

CVE-2018-5214

The "Add Link to Facebook" plugin up to and including 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php.
Add Link To Facebook Project Add Link To Facebook
9.8
CVSSv3

CVE-2021-44779

Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&listid). No patched version available, plugin closed.
[gwa] Autoresponder Project [gwa] Autoresponder
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-20017administrator privilegesCVE-2024-36401CVE-2024-8521CVE-2024-8247event management systemCVE-2024-45098aspera faspexremote attackersXSSmindsdbangeljudesuarezCVE-2024-45157
Home
/
Search Results
Vulmon Logo Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook