CVE-2026-115806

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine recursiveUnserializeReplace. An unauthenticated attacker can store a...

EUVD-2026-109213

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine recursiveUnserializeReplace. An unauthenticated attacker can store a...

PT-2026-122495

Name of the Vulnerable Software and Affected Versions Prime Mover versions prior to 2.2.2 Description An unauthenticated attacker can perform PHP Object Injection by submitting a crafted, base64-encoded serialized object through the standard comment-submission endpoint 'wp-comments-post.php', whi...

EUVD-2026-100914

The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname profile.php + comment wp-comments-post.php' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-107757 Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body

The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname profile.php + comment wp-comments-post.php' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-107757

The Gallery Custom Links plugin for WordPress (versions up to and including 2.3.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw is caused by insufficient input sanitization and output escaping involving the display_name (from profile.php) and comment (from wp-comments-post.php) ...

PT-2026-113720

The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display name profile.php + comment wp-comments-post.php' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2023-54351: Improper Neutralization of Input During Web Page Generation

WordPress Sonaar Music Plugin 4.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the comment functionality. Attackers can submit JavaScript payloads in the comment parameter to wp-comments-post.php which are stored an...

NOSpamPTI 2.1 - wp-comments-post.php comment_post_ID Parameter SQL Injection

The nospampti WordPress plugin was affected by a wp-comments-post.php commentpostID Parameter SQL Injection security vulnerability...

CVE-2013-5917

SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the commentpostID parameter...

CVE-2013-5917

The CVE-2013-5917 entry concerns the WordPress NOSpamPTI plugin (version 2.1). The vulnerability is a SQL injection in wp-comments-post.php via the comment_post_ID parameter, enabling remote attackers to manipulate the database and potentially exfiltrate data. Multiple connected sources confirm t...

CVE-2013-5917: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in wp-comments-post.php in the NOSpam PTI plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the commentpostID parameter...

PT-2013-5868

Name of the Vulnerable Software and Affected Versions NOSpam PTI plugin version 2.1 for WordPress Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the comment post ID parameter in the wp-comments-post.php file. Recommendations For NOSpam PTI...

WordPress NOSpamPTI 2.1 Blind SQL Injection

NOSpamPTI Wordpress plugin Blind SQL Injection Vendor product description NOSpamPTI eliminates the spam in your comment box so strong and free, developed from the idea of Nando Vieira http://bit.ly/d38gB8, but some themes do not support changes to the functions.php to this we alter this function...

DEBIAN-CVE-2012-2404

wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors...

CVE-2012-2404

wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors...

CVE-2012-2404: Improper Neutralization of Input During Web Page Generation

wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via unspecified vectors...

WordPress <= 3.3.1 - XSS #1

This vulnerability is in the wp-comments-post.php. It allows the attackers to conduct XSS attacks via unspecified vectors. Solution Update WordPress...

PT-2012-4017

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.3.2 Description The issue allows remote attackers to conduct cross-site scripting XSS attacks. This is due to the support of offsite redirects in the wp-comments-post.php file. Recommendations For versions prior t...

CVE-2012-0287

Cross-site scripting XSS vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the "Duplicate comment detected"...