3379 matches found
CVE-2025-4133 Blog2Social: Social Media Auto Post & Scheduler < 8.4.0 - Contributor+ Stored XSS
The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in a dashboard, which could allow users with the contributor role to perform Cross-Site Scripting attacks...
CVE-2011-4342
PHP remote file inclusion vulnerability in wpxmlexport.php in the BackWPup plugin before 1.7.2 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the wpabs parameter...
CVE-2012-6713
The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues...
CVE-2011-5254
Unspecified vulnerability in the Connections plugin before 0.7.1.6 for WordPress has unknown impact and attack vectors...
CVE-2013-3684
NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload...
CVE-2019-15832
The visitors-traffic-real-time-statistics plugin before 1.13 for WordPress has CSRF...
CVE-2019-15834
The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF...
CVE-2011-1762
A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publishposts' permission...
CVE-2014-9099
Cross-site request forgery CSRF vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the whydoworkadsense page in wp-admin/options-general.php...
CVE-2017-18596
The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions...
CVE-2012-6629
Multiple cross-site request forgery CSRF vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change an email address or 2 conduct script insertion attacks. NOTE: the provenance o...
CVE-2015-9412
The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter...
CVE-2014-3843
Cross-site request forgery CSRF vulnerability in the Search Everything plugin before 8.1.1 for WordPress allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...
CVE-2019-15826
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field...
CVE-2011-4803
SQL injection vulnerability in wptouch/ajax.php in the WPTouch plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter...
CVE-2019-15646
The rsvpmaker plugin before 6.2 for WordPress has SQL injection...
CVE-2019-15644
The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS...
CVE-2011-3865
Cross-site scripting XSS vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php...
CVE-2012-6707
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a...