CVE-2020-28038

WordPress before 5.5.2 allows stored XSS via post slugs...

PT-2019-7674 · WordPress · Wp-Google-Map-Plugin

Name of the Vulnerable Software and Affected Versions: wp-google-map-plugin versions prior to 3.1.2 Description: The issue is related to a Cross-Site Scripting XSS problem. XSS is a type of security vulnerability that allows an attacker to inject malicious scripts into a website, potentially...

CVE-2019-8942

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

WordPress 4.7.x < 4.7.7 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. - When domain-based...

CVE-2012-6707

WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a...

WordPress <= 4.7 - Post via Email Checks mail.example.com by Default

...

CVE-2016-5835

WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php...

CVE-2016-2221

Open redirect vulnerability in the wpvalidateredirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an...

WordPress 4.2 - Stored XSS Vulnerability

Exploit for php platform in category web applications Overview Current versions of WordPress are vulnerable to a stored XSS. An unauthenticated attacker can inject JavaScript in WordPress comments. The script is triggered when the comment is viewed. If triggered by a logged-in administrator, unde...

Wordpress <= 2.3.1 Charset Remote SQL Injection Vulnerability

No description provided by source...

WordPress 3.8.2 cookie forgery vulnerability analysis-vulnerability warning-the black bar safety net

0x00 background See the WordPress 3.8.2 patch analysis HMAC timing attack, the eye opener, the original can also use the time difference to determine the HMAC. But I think this vulnerability is not a simple fix to this problem. To view the official information provided by:“the vulnerability is fr...

CVE-2012-6635

wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft...

CVE-2010-0682

WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter...

CVE-2009-2431

WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source...

Path Disclosure - Wordpress 2.1.2

Product : Wordpress 2.1.2 Vulnerability Details : All the sites running on the latest version of wordpress 2.1.2 are exposed to a full path disclosure vulnerability. Proof of Concept: http://www.anysite.com/Pathtowordpress/wp-includes/vars.php Error Returned: Fatal error: Call to undefined functi...

wordpress absolute path disclosure+analysis-vulnerability warning-the black bar safety net

Inadvertently change on storm path, it should be all versions are tested the official version and several beta version, the specific version of the exploit code where the line number is different, and is an array and the variables of the old issues, I believe that many places are also there. The...

CVE-2007-0109

wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

CVE-2006-6017

WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service application crash via a string that represents a 1 malformed or 2 large serialized object, because the object...

wpcmdexec.pl.txt

!/usr/bin/perl -w Wordpress 1.5.1.2 Strayhorn // XMLRPC Interface SQL Injection By James Bercegay // http://www.gulftech.org/ // June 21 2005 Quick and dirty proof of concept that uses the XML RPC server vulnerabilities I discovered to extract a password hash & use that hash to execute shell...