WordPress Broken Link Checker < 2.4.12 - Remote Code Execution

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables on the server when a classic non-block theme is active. id:...

VulnCheck KEV: CVE-2026-86444

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

CVE-2026-86444: Improper Neutralization of Input During Web Page Generation

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

CVE-2026-18937: Improper Control of Generation of Code

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...

Malware in classic-theme

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-144 Malicious code in classic-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3cb03e37c1447989072f9a80053fe136e78cf080ecbd90ab1aba93b467aff6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classic-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3cb03e37c1447989072f9a80053fe136e78cf080ecbd90ab1aba93b467aff6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2008-0231

Technical details about CVE-2008-0231 are not publicly provided in the supplied documents. Monitor for updates from official advisories.

DEBIAN-CVE-2007-4483

Cross-site scripting XSS vulnerability in index.php in the WordPress Classic 1.5 theme in WordPress before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO PHPSELF...

CVE-2007-4483

CVE-2007-4483 affects the WordPress Classic theme (1.5) prior to WordPress 2.1.3. The issue is a cross-site scripting (XSS) flaw in index.php via PATH_INFO (PHP_SELF). Impact: remote attackers can inject arbitrary web script or HTML.Remediation: update the WordPress Classic theme (or apply the fi...

WordPress Classic Theme <= 1.5 - XSS

Because of this vulnerability in index.php, the attackers can inject arbitrary web script or HTML via the PATHINFO. Solution Update the theme...

CVE-2007-4483: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in the WordPress Classic 1.5 theme in WordPress before 2.1.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO PHPSELF...

Vulnerability in theme WordPress Classic 1.5

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Cross-Site Scripting уязвимости в теме WordPress Classic 1.5. XSS: http://site/index.php/223E3Cscript3Ealertdocument.cookie3C/script3E Уязвимость связана с недостаточной фильтрацией переменной PHPSELF. Подобная уязвимость ранее уже была найдена в...