Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

wordpress wordpress 3.6 vulnerabilities and exploits

(subscribe to this query)
187
VMScore
CVE-2014-5240
Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress prior to 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL.
Wordpress Wordpress 3.0.5Wordpress Wordpress 3.0.6Wordpress Wordpress 3.1Wordpress Wordpress 3.1.1Wordpress Wordpress 3.5.0Wordpress Wordpress 3.5.1Wordpress Wordpress 3.6Wordpress Wordpress 3.6.1Wordpress Wordpress 3.0.1Wordpress Wordpress 3.0.3Wordpress Wordpress 3.1.3Wordpress Wordpress 3.2Wordpress Wordpress 3.3.2Wordpress Wordpress 3.4.0Wordpress Wordpress 3.4.2Wordpress Wordpress 3.7Wordpress Wordpress 3.8Wordpress Wordpress 3.0Wordpress Wordpress 3.2.1Wordpress Wordpress 3.3Wordpress Wordpress 3.3.1Wordpress Wordpress 3.9.0
755
VMScore
CVE-2008-0682
SQL injection vulnerability in wordspew-rss.php in the Wordspew plugin prior to 3.72 for Wordpress allows remote malicious users to execute arbitrary SQL commands via the id parameter.
Wordpress WordspewWordpress Wordspew 3.7Wordpress Wordspew 3.31Wordpress Wordspew 3.3Wordpress Wordspew 3.01Wordpress Wordspew 3.0Wordpress Wordspew 2.85Wordpress Wordspew 2.8Wordpress Wordspew 2.2Wordpress Wordspew 2.1Wordpress Wordspew 3.6Wordpress Wordspew 3.52Wordpress Wordspew 3.2Wordpress Wordspew 3.16Wordpress Wordspew 2.95Wordpress Wordspew 2.94Wordpress Wordspew 2.7Wordpress Wordspew 2.6Wordpress Wordspew 2.0Wordpress Wordspew 1.8Wordpress Wordspew 1.7Wordpress Wordspew 3.33
356
VMScore
CVE-2014-0165
WordPress prior to 3.7.2 and 3.8.x prior to 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.
Wordpress Wordpress 3.7Wordpress WordpressWordpress Wordpress 3.4.2Wordpress Wordpress 3.4.1Wordpress Wordpress 3.2Wordpress Wordpress 3.0.4Wordpress Wordpress 3.0.3Wordpress Wordpress 2.9Wordpress Wordpress 3.8Wordpress Wordpress 3.8.1Wordpress Wordpress 3.4.0Wordpress Wordpress 3.3.3Wordpress Wordpress 3.1.4Wordpress Wordpress 3.1.3Wordpress Wordpress 3.0.2Wordpress Wordpress 3.0.1Wordpress Wordpress 2.8.5.2Wordpress Wordpress 2.8.5.1Wordpress Wordpress 3.6.1Wordpress Wordpress 3.6Wordpress Wordpress 3.3.2Wordpress Wordpress 3.3.1
570
VMScore
CVE-2014-0166
The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress prior to 3.7.2 and 3.8.x prior to 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote malicious users to obtain access via a forged cookie.
Wordpress Wordpress 3.6Wordpress Wordpress 3.5.1Wordpress Wordpress 3.3.1Wordpress Wordpress 3.3Wordpress Wordpress 3.1Wordpress Wordpress 3.0.6Wordpress Wordpress 2.9.2Wordpress Wordpress 2.9.1.1Wordpress Wordpress 2.8.4Wordpress WordpressWordpress Wordpress 3.8Wordpress Wordpress 3.4.1Wordpress Wordpress 3.4.0Wordpress Wordpress 3.1.4Wordpress Wordpress 3.1.3Wordpress Wordpress 3.0.3Wordpress Wordpress 3.0.2Wordpress Wordpress 2.8.6Wordpress Wordpress 2.8.5.2Wordpress Wordpress 2.8Wordpress Wordpress 2.7.1Wordpress Wordpress 2.5.1
446
VMScore
CVE-2017-14719
Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.
Wordpress Wordpress 4.7.1Wordpress Wordpress 4.7.2Wordpress Wordpress 4.6.6Wordpress Wordpress 4.6.5Wordpress Wordpress 4.6.4Wordpress Wordpress 4.5.7Wordpress Wordpress 4.5.6Wordpress Wordpress 4.5Wordpress Wordpress 4.4.9Wordpress Wordpress 4.4.11Wordpress Wordpress 4.4.10Wordpress Wordpress 4.3.5Wordpress Wordpress 4.3.4Wordpress Wordpress 4.3Wordpress Wordpress 4.2.9Wordpress Wordpress 4.2.16Wordpress Wordpress 4.2.15Wordpress Wordpress 4.2Wordpress Wordpress 4.1.9Wordpress Wordpress 4.1.2Wordpress Wordpress 4.1.19Wordpress Wordpress 4.1.11
445
VMScore
CVE-2014-5265
The Incutio XML-RPC (IXR) Library, as used in WordPress prior to 3.9.2 and Drupal 6.x prior to 6.33 and 7.x prior to 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote malicious users to cause a denial of service (memory a...
Wordpress Wordpress 3.0Wordpress Wordpress 3.0.1Wordpress Wordpress 3.0.2Wordpress Wordpress 3.3.1Wordpress Wordpress 3.3.2Wordpress Wordpress 3.3.3Wordpress Wordpress 3.4.0Wordpress Wordpress 3.1Wordpress Wordpress 3.1.1Wordpress Wordpress 3.1.2Wordpress Wordpress 3.1.3Wordpress Wordpress 3.1.4Wordpress Wordpress 3.6Wordpress Wordpress 3.6.1Wordpress Wordpress 3.7Wordpress Wordpress 3.7.1Wordpress Wordpress 3.0.4Wordpress Wordpress 3.0.6Wordpress Wordpress 3.2Wordpress Wordpress 3.3Wordpress Wordpress 3.4.1Wordpress Wordpress 3.5.0
540
VMScore
CVE-2014-5266
The Incutio XML-RPC (IXR) Library, as used in WordPress prior to 3.9.2 and Drupal 6.x prior to 6.33 and 7.x prior to 7.31, does not limit the number of elements in an XML document, which allows remote malicious users to cause a denial of service (CPU consumption) via a large docu...
Wordpress Wordpress 3.0Wordpress Wordpress 3.0.1Wordpress Wordpress 3.0.2Wordpress Wordpress 3.0.3Wordpress Wordpress 3.3.1Wordpress Wordpress 3.3.2Wordpress Wordpress 3.3.3Wordpress Wordpress 3.4.0Wordpress Wordpress 3.0.4Wordpress Wordpress 3.0.6Wordpress Wordpress 3.2Wordpress Wordpress 3.3Wordpress Wordpress 3.4.1Wordpress Wordpress 3.5.0Wordpress Wordpress 3.8.1Wordpress WordpressWordpress Wordpress 3.1.1Wordpress Wordpress 3.1.2Wordpress Wordpress 3.1.3Wordpress Wordpress 3.1.4Wordpress Wordpress 3.6Wordpress Wordpress 3.6.1
605
VMScore
CVE-2013-2705
Cross-site request forgery (CSRF) vulnerability in the WordPress Simple Paypal Shopping Cart plugin prior to 3.6 for WordPress allows remote malicious users to hijack the authentication of administrators for requests that change plugin settings.
Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 3.3.1Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 3.2.9Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 2.5Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 2.3Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 2.1Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 1.6Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 1.4Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 3.2.8Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 3.2.7Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 2.8Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 2.6Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 1.2.2Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 1.2Tipsandtricks-hq Wordpress Simple Paypal Shopping CartTipsandtricks-hq Wordpress Simple Paypal Shopping Cart 3.4Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 2.0Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 1.9Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 1.8Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 1.7Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 3.3.2Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 3.3.0Tipsandtricks-hq Wordpress Simple Paypal Shopping Cart 2.4
383
VMScore
CVE-2013-5711
Cross-site scripting (XSS) vulnerability in admin/walkthrough/walkthrough.php in the Design Approval System plugin prior to 3.7 for WordPress allows remote malicious users to inject arbitrary web script or HTML via the step parameter.
Slickremix Design Approval System Plugin 2.6Slickremix Design Approval System Plugin 2.5Slickremix Design Approval System Plugin 2.4Slickremix Design Approval System Plugin 2.3Slickremix Design Approval System Plugin 3.4Slickremix Design Approval System Plugin 3.3Slickremix Design Approval System Plugin 3.2Slickremix Design Approval System Plugin 3.1Slickremix Design Approval System Plugin 1.8Slickremix Design Approval System Plugin 1.7Slickremix Design Approval System Plugin 1.6Slickremix Design Approval System Plugin 1.5Slickremix Design Approval System Plugin 1.4Slickremix Design Approval System Plugin 3.5Slickremix Design Approval System Plugin 3.0Slickremix Design Approval System Plugin 2.8Slickremix Design Approval System Plugin 2.1Slickremix Design Approval System Plugin 1.9Slickremix Design Approval System Plugin 1.2Slickremix Design Approval System Plugin 1.0Slickremix Design Approval System PluginSlickremix Design Approval System Plugin 2.9
760
VMScore
CVE-2011-4671
SQL injection vulnerability in adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions prior to 3.6.8, for WordPress allows remote malicious users to execute arbitrary SQL commands via the track parameter (aka redirect URL).
Adrotateplugin Adrotate 3.6.3Adrotateplugin Adrotate 3.6.2Adrotateplugin Adrotate 3.3Adrotateplugin Adrotate 3.2.2Adrotateplugin Adrotate 3.0.1Adrotateplugin Adrotate 3.0Adrotateplugin Adrotate 2.4.1Adrotateplugin Adrotate 2.4Adrotateplugin Adrotate 1.0Adrotateplugin Adrotate 0.8Adrotateplugin Adrotate 0.2Adrotateplugin Adrotate 0.1Adrotateplugin AdrotateAdrotateplugin Adrotate 3.6.6Adrotateplugin Adrotate 3.5.1Adrotateplugin Adrotate 3.5Adrotateplugin Adrotate 3.1.1Adrotateplugin Adrotate 3.1Adrotateplugin Adrotate 2.5Adrotateplugin Adrotate 2.4.4Adrotateplugin Adrotate 2.2Adrotateplugin Adrotate 2.1
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-21111CVE-2024-32884IDORCVE-2023-1000CVE-2024-33260CVE-2024-3682reflected XSSrace conditionCVE-2024-3400
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook