Overview 411 matches · 0 in Waratek scope · 0 protected · 20 exploited · 5 CISA KEV · 98 public PoC · 16 EPSS ≥ 0.5
411matches
0in Waratek scope0.0%
0protected0.0%
20exploited4.9%
5CISA KEV1.2%
98public PoC23.8%
16EPSS ≥ 0.53.9%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
0.2%
Not applicable
410
99.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
411
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 48 / year
20042
Not applicable2
Medium2
not blocked2
Working exploit published2
200510
Not applicable10
High4
Medium6
not blocked10
Working exploit published2
No public exploit8
200616
Not applicable16
High3
Medium12
Low1
not blocked16
Working exploit published3
No public exploit13
200747
Not applicable47
Critical1
High6
Medium37
Low3
not blocked47
Working exploit published15
No public exploit32
200848
Not applicable48
High23
Medium25
not blocked48
Working exploit published26
No public exploit22
200916
Not applicable16
High3
Medium12
Low1
not blocked16
Working exploit published7
No public exploit9
20102
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
201112
Not applicable12
High5
Medium6
Low1
not blocked12
No public exploit12
201232
Not applicable32
High4
Medium23
Low5
not blocked32
Working exploit published12
No public exploit20
201320
Not applicable20
High2
Medium15
Low3
not blocked20
Working exploit published2
No public exploit18
201429
Not applicable29
High3
Medium24
Low2
not blocked29
Working exploit published2
Proof of concept only1
No public exploit26
201511
Not applicable11
High1
Medium9
Low1
not blocked11
Exploited1
No public exploit10
201622
Not applicable22
Critical2
High10
Medium10
not blocked22
Exploited1
Working exploit published1
No public exploit20
201746
Outside Waratek scope1
Not applicable45
Critical3
High13
Medium30
not blocked46
Exploited5
Working exploit published5
No public exploit36
201818
Not applicable18
Critical1
High8
Medium9
not blocked18
Exploited1
Working exploit published1
Forecast only1
No public exploit15
201923
Not applicable23
Critical3
High4
Medium16
not blocked23
Exploited1
Working exploit published3
No public exploit19
202021
Not applicable21
Critical5
High4
Medium10
Low2
not blocked21
Exploited1
Working exploit published1
No public exploit19
20219
Not applicable9
Critical3
High3
Medium3
not blocked9
Exploited1
Working exploit published1
No public exploit7
20229
Not applicable9
High4
Medium5
not blocked9
Exploited3
Proof of concept only1
No public exploit5
20239
Not applicable9
High3
Medium6
not blocked9
Exploited1
Working exploit published1
No public exploit7
20245
Not applicable5
Critical1
High3
Medium1
not blocked5
Exploited1
Working exploit published1
No public exploit3
20250
20264
Not applicable4
Critical1
High2
Medium1
not blocked4
Exploited4
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2010-5297 | Low | 2014-01-21 | Not applicable | No public exploit | WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change. |
| CVE-2010-5296 | Medium | 2014-01-21 | Not applicable | No public exploit | wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action. |
| CVE-2010-5295 | Medium | 2014-01-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action. |
| CVE-2010-5294 | Medium | 2014-01-21 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allow remote servers to inject arbitrary web script or HTML by providing a crafted error message for a (1) FTP or (2) SSH connection attempt. |
| CVE-2010-5293 | Medium | 2014-01-21 | Not applicable | No public exploit | wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote attackers to bypass intended spam restrictions via a crafted URL, as demonstrated by a URL that triggers a substring match. |
| CVE-2013-7240 | Medium | 2014-01-03 | Not applicable | Working exploit published | Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dew_file parameter. |
| CVE-2013-7233 | Medium | 2013-12-30 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the authentication of administrators for requests that move comments to the moderation list. |
| CVE-2013-5739 | Low | 2013-09-12 | Not applicable | No public exploit | The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php. |
| CVE-2013-5738 | Medium | 2013-09-12 | Not applicable | No public exploit | The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability for uploads of .htm and .html files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file. |
| CVE-2013-4340 | Low | 2013-09-12 | Not applicable | No public exploit | wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified user_ID parameter. |
| CVE-2013-4339 | High | 2013-09-12 | Not applicable | No public exploit | WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted string. |
| CVE-2013-4338 | High | 2013-09-12 | Not applicable | No public exploit | wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations. |
| CVE-2012-3414 | Medium | 2013-07-19 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function. |
| CVE-2013-2205 | Medium | 2013-07-08 | Not applicable | No public exploit | The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site. |
| CVE-2013-2204 | Medium | 2013-07-08 | Not applicable | No public exploit | moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRING, which allows remote attackers to pass arbitrary parameters to a Flash application, and conduct content-spoofing attacks, via a crafted string after a ? (question mark) character. |
| CVE-2013-2203 | Medium | 2013-07-08 | Not applicable | No public exploit | WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message. |
| CVE-2013-2202 | Medium | 2013-07-08 | Not applicable | No public exploit | WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. |
| CVE-2013-2201 | Medium | 2013-07-08 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files, (2) editing of media files, (3) installation of plugins, (4) updates to plugins, (5) installation of themes, or (6) updates to themes. |
| CVE-2013-2200 | Medium | 2013-07-08 | Not applicable | No public exploit | WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing and authorship reassignment via unspecified vectors. |
| CVE-2013-2199 | Medium | 2013-07-08 | Not applicable | No public exploit | The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery (SSRF) issue, a similar vulnerability to CVE-2013-0235. |
| CVE-2013-0237 | Medium | 2013-07-08 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter. |
| CVE-2013-0236 | Medium | 2013-07-08 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery shortcodes or (2) the content of a post. |
| CVE-2013-0235 | Medium | 2013-07-08 | Not applicable | No public exploit | The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue. |
| CVE-2013-3250 | Medium | 2013-06-21 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings. |
| CVE-2013-2173 | Medium | 2013-06-21 | Not applicable | No public exploit | wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attackers to cause a denial of service (CPU consumption) via a crafted value of a certain wp-postpass cookie. |
| CVE-2012-6527 | Low | 2013-01-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the My Calendar plugin before 1.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. |
| CVE-2012-5868 | Low | 2012-12-27 | Not applicable | No public exploit | WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack. |
| CVE-2011-5216 | High | 2012-10-25 | Not applicable | No public exploit | SQL injection vulnerability in ajax.php in SCORM Cloud For WordPress plugin before 1.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the active parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2012-5350 | Medium | 2012-10-09 | Not applicable | Working exploit published | SQL injection vulnerability in the Pay With Tweet plugin before 1.2 for WordPress allows remote authenticated users with certain permissions to execute arbitrary SQL commands via the id parameter in a paywithtweet shortcode. |
| CVE-2012-5349 | Low | 2012-10-09 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in pay.php in the Pay With Tweet plugin before 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) link, (2) title, or (3) dl parameter. |
| CVE-2012-5229 | Medium | 2012-10-01 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in css/gallery-css.php in the Slideshow Gallery2 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the border parameter. |
| CVE-2012-4448 | Medium | 2012-09-28 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard_incoming_links edit action. |
| CVE-2011-5182 | Medium | 2012-09-20 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor disputes this issue, stating "Lanoba's plug in does sanitize user input, and because that input is never sent to the browser, an attacker has no way of executing script or code on a user's behalf. |
| CVE-2012-4422 | Low | 2012-09-14 | Not applicable | No public exploit | wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveraging the Administrator role. |
| CVE-2012-4421 | Medium | 2012-09-14 | Not applicable | No public exploit | The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticated users to bypass intended access restrictions and publish new posts by leveraging the Contributor role and using the Atom Publishing Protocol (aka AtomPub) feature. |
| CVE-2010-5106 | Medium | 2012-09-14 | Not applicable | No public exploit | The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended access restrictions, and publish, edit, or delete posts, by leveraging the Author or Contributor role. |
| CVE-2011-5107 | Medium | 2012-08-23 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in post_alert.php in Alert Before Your Post plugin, possibly 0.1.1 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the name parameter. |
| CVE-2012-4271 | Medium | 2012-08-13 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in bad-behavior-wordpress-admin.php in the Bad Behavior plugin before 2.0.47 and 2.2.x before 2.2.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, (2) httpbl_key, (3) httpbl_maxage, (4) httpbl_threat, (5) reverse_proxy_addresses, or (6) reverse_proxy_header parameter. |
| CVE-2012-3385 | Medium | 2012-07-22 | Not applicable | No public exploit | WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors. |
| CVE-2012-3384 | Medium | 2012-07-22 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. |
| CVE-2012-3383 | Low | 2012-07-22 | Not applicable | No public exploit | The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capability, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks by leveraging the Administrator or Editor role and composing crafted text. |
| CVE-2011-4957 | Medium | 2012-06-27 | Not applicable | No public exploit | The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attackers to cause a denial of service (crash) via a comment with a crafted URL that triggers many recursive calls. |
| CVE-2011-4956 | Medium | 2012-06-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-3588 | Medium | 2012-06-19 | Not applicable | Working exploit published | Directory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the data parameter. |
| CVE-2012-3578 | Medium | 2012-06-17 | Not applicable | Working exploit published | Unrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with a file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in html/images. |
| CVE-2012-2633 | Medium | 2012-06-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header. |
| CVE-2012-1936 | Medium | 2012-05-03 | Not applicable | Working exploit published | The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks on specific actions and objects by sniffing the network, as demonstrated by attacks against the wp-admin/admin-ajax.php and wp-admin/user-new.php scripts. NOTE: the vendor reportedly disputes the significance of this issue because wp_create_nonce operates as intended, even if it is arguably inconsistent with certain CSRF protection details advocated by external organizations |
| CVE-2012-2404 | Medium | 2012-04-21 | Not applicable | No public exploit | wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. |
| CVE-2012-2403 | Medium | 2012-04-21 | Not applicable | No public exploit | wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. |
| CVE-2012-2402 | Medium | 2012-04-21 | Not applicable | No public exploit | wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors. |
| CVE-2012-2401 | Medium | 2012-04-21 | Not applicable | No public exploit | Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content. |
| CVE-2012-2400 | High | 2012-04-21 | Not applicable | No public exploit | Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors. |
| CVE-2012-2399 | High | 2012-04-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414. |
| CVE-2012-0937 | Medium | 2012-01-30 | Not applicable | Working exploit published | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898. NOTE: the vendor disputes the significance of this issue because an incomplete WordPress installation might be present on the network for only a short time |
| CVE-2012-0782 | Medium | 2012-01-30 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance |
| CVE-2011-4899 | High | 2012-01-30 | Not applicable | Working exploit published | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however, remote code execution makes the issue important in many realistic environments |
| CVE-2011-4898 | Medium | 2012-01-30 | Not applicable | Working exploit published | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether providing intentionally vague error messages during installation would be reasonable from a usability perspective |
| CVE-2012-0287 | Low | 2012-01-06 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the "Duplicate comment detected" feature. |
| CVE-2011-4669 | High | 2011-12-02 | Not applicable | No public exploit | SQL injection vulnerability in wp-users.php in WordPress Users plugin 1.3 and possibly earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the uid parameter to index.php. |
| CVE-2011-3818 | Medium | 2011-09-24 | Not applicable | No public exploit | WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by wp-admin/includes/user.php and certain other files. |
| CVE-2011-3130 | High | 2011-08-10 | Not applicable | No public exploit | wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibly involving SQL injection. |
| CVE-2011-3129 | High | 2011-08-10 | Not applicable | No public exploit | The file upload functionality in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running "on hosts with dangerous security settings," has unknown impact and attack vectors, possibly related to dangerous filenames. |
| CVE-2011-3128 | Medium | 2011-08-10 | Not applicable | No public exploit | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php. |
| CVE-2011-3127 | Medium | 2011-08-10 | Not applicable | No public exploit | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site. |
| CVE-2011-3126 | Medium | 2011-08-10 | Not applicable | No public exploit | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects. |
| CVE-2011-3125 | High | 2011-08-10 | Not applicable | No public exploit | Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various security hardening." |
| CVE-2011-3122 | High | 2011-08-10 | Not applicable | No public exploit | Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media security." |
| CVE-2011-0701 | Medium | 2011-03-14 | Not applicable | No public exploit | wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter. |
| CVE-2011-0700 | Low | 2011-03-14 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title), (2) post_status, (3) comment_status, (4) ping_status, and (5) escaping of tags within the tags meta box. |
| CVE-2010-4536 | Medium | 2011-01-03 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the & (ampersand) character, (2) the case of an attribute name, (3) a padded entity, and (4) an entity that is not in normalized form. |
| CVE-2010-4257 | Medium | 2010-12-07 | Not applicable | No public exploit | SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field. |
| CVE-2010-0682 | Medium | 2010-02-23 | Not applicable | Working exploit published | WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter. |
| CVE-2009-3891 | Low | 2009-11-17 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter (aka the selection variable). |
| CVE-2009-3890 | Medium | 2009-11-17 | Not applicable | Working exploit published | Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to a wp-content/uploads/ pathname, as demonstrated by a .php.jpg filename. |
| CVE-2009-3622 | Medium | 2009-10-23 | Not applicable | No public exploit | Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service (CPU consumption and server hang) via a long title parameter in conjunction with a charset parameter composed of many comma-separated "UTF-8" substrings, related to the mb_convert_encoding function in PHP. |
| CVE-2008-7216 | Medium | 2009-09-11 | Not applicable | Working exploit published | Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio CAPTCHA clips by concatenating static audio files without any additional distortion, which allows remote attackers to bypass CAPTCHA protection by reading certain bytes from the generated clip. |
| CVE-2009-2854 | Medium | 2009-08-18 | Not applicable | No public exploit | Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to (1) edit-comments.php, (2) edit-pages.php, (3) edit.php, (4) edit-category-form.php, (5) edit-link-category-form.php, (6) edit-tag-form.php, (7) export.php, (8) import.php, or (9) link-add.php in wp-admin/. |
| CVE-2009-2853 | High | 2009-08-18 | Not applicable | No public exploit | Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-form-comment.php, (5) edit-link-category-form.php, (6) edit-link-form.php, (7) edit-page-form.php, and (8) edit-tag-form.php in wp-admin/. |
| CVE-2009-2851 | Medium | 2009-08-18 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via a comment author URL. |
| CVE-2009-2762 | High | 2009-08-13 | Not applicable | Working exploit published | wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array. |
| CVE-2009-2432 | Medium | 2009-07-10 | Not applicable | No public exploit | WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an error message. |
| CVE-2009-2431 | Medium | 2009-07-10 | Not applicable | No public exploit | WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source. |
| CVE-2009-2336 | Medium | 2009-07-10 | Not applicable | No public exploit | The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience." |
| CVE-2009-2335 | Medium | 2009-07-10 | Not applicable | Working exploit published | WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience." |
| CVE-2009-2334 | Medium | 2009-07-10 | Not applicable | Working exploit published | wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service. |
| CVE-2008-6767 | High | 2009-04-28 | Not applicable | No public exploit | wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to upgrade the application, and possibly cause a denial of service (application outage), via a direct request. |
| CVE-2008-6762 | Medium | 2009-04-28 | Not applicable | No public exploit | Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backto parameter. |
| CVE-2009-1030 | Medium | 2009-03-20 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU (WPMU) before 2.7 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header. |
| CVE-2008-5752 | Medium | 2008-12-30 | Not applicable | Working exploit published | Directory traversal vulnerability in getConfig.php in the Page Flip Image Gallery plugin 0.2.2 and earlier for WordPress, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the book_id parameter. NOTE: some of these details are obtained from third party information. |
| CVE-2008-5695 | High | 2008-12-19 | Not applicable | Working exploit published | wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated users with manage_options and upload_files capabilities to execute arbitrary code by uploading a PHP script and adding this script's pathname to active_plugins. |
| CVE-2008-5278 | Medium | 2008-11-28 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) for WordPress before 2.6.5 allows remote attackers to inject arbitrary web script or HTML via the Host header (HTTP_HOST variable). |
| CVE-2008-5113 | Medium | 2008-11-17 | Not applicable | No public exploit | WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site request forgery (CSRF) attacks via crafted cookies, as demonstrated by attacks that (1) delete user accounts or (2) cause a denial of service (loss of application access). NOTE: this issue relies on the presence of an independent vulnerability that allows cookie injection. |
| CVE-2008-4796 | High | 2008-10-30 | Not applicable | No public exploit | The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs. |
| CVE-2008-4769 | High | 2008-10-28 | Not applicable | Working exploit published | Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and possibly execute arbitrary PHP files via the cat parameter in index.php. NOTE: some of these details are obtained from third party information. |
| CVE-2008-4671 | Medium | 2008-10-22 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in wp-admin/wp-blogs.php in Wordpress MU (WPMU) before 2.6 allows remote attackers to inject arbitrary web script or HTML via the (1) s and (2) ip_address parameters. |
| CVE-2008-4616 | Medium | 2008-10-20 | Not applicable | Working exploit published | The SpamBam plugin for WordPress allows remote attackers to bypass restrictions and add blog comments by using server-supplied values to calculate a shared key. |
| CVE-2008-4106 | Medium | 2008-09-18 | Not applicable | No public exploit | WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the user_login column, and does not properly handle space characters when comparing usernames, which allows remote attackers to change an arbitrary user's password to a random value by registering a similar username and then requesting a password reset, related to a "SQL column truncation vulnerability." NOTE: the attacker can discover the random password by also exploiting CVE-2008-4107. |
| CVE-2008-3747 | High | 2008-08-27 | Not applicable | No public exploit | The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in the intended situations, which might allow remote attackers to gain administrative access by sniffing the network for a cookie. |
| CVE-2008-3362 | High | 2008-07-30 | Not applicable | Working exploit published | Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the upfile parameter, then accessing it via a direct request to the file in wp-content/plugins/downloads-manager/upload/. |
| CVE-2008-3233 | Medium | 2008-07-18 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in WordPress before 2.6, SVN development versions only, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |