Vulnerability database

16,071 results · page 322 of 322

• Jun 14, 2007404.php in the Vistered-Little theme for: Cross-site scripting (XSS)CVE-2007-3240 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in 404.php in the Vistered-Little theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI (REQUEST_URI) that accesses index.php. NOTE: this can be leveraged for PHP code execution in an administrative session.

  Product

  404.php in the Vistered-Little theme for

  What to do

  Update 404.php in the Vistered-Little theme for to the newest version.

  Full record and what to do →NVD recordosvdb.orgsecurityreason.com

• Jun 14, 2007functions.php in the default theme in WordPress 2.2: Cross-site scripting (XSS)CVE-2007-3238 · WordPress plugins & themes · reported by MITREMedium 6

  Cross-site scripting (XSS) vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the PATH_INFO (REQUEST_URI) to wp-admin/themes.php, a different vulnerability than CVE-2007-1622. NOTE: this might not cross privilege boundaries in some configurations, since the Administrator role has the unfiltered_html capability.

  Product

  functions.php in the default theme in WordPress 2.2

  What to do

  Update functions.php in the default theme in WordPress 2.2 to the newest version.

  Full record and what to do →NVD recordblogsecurity.netcodex.wordpress.org

• Jun 14, 2007blogroll.php in the cordobo-green-park theme for: Cross-site scripting (XSS)CVE-2007-3241 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in blogroll.php in the cordobo-green-park theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF portion of a URI.

  Product

  blogroll.php in the cordobo-green-park theme for

  What to do

  Update blogroll.php in the cordobo-green-park theme for to the newest version.

  Full record and what to do →NVD recordosvdb.orgsecurityreason.com

• Jun 14, 2007Cross-site scripting (XSS) vulnerability in searchform.php in the AndyBlue theme before 20070607 for WordPress allows remote attackers to inject arbitrary web sCVE-2007-3239 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in searchform.php in the AndyBlue theme before 20070607 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF portion of a URI to index.php. NOTE: this can be leveraged for PHP code execution in an administrative session.

  Product

  AndyBlue

  Fixed in

  20070607

  What to do

  Update AndyBlue to 20070607 or newer.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• May 22, 2007adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for: Cross-site request forgery (CSRF)CVE-2007-2828 · WordPress plugins & themes · reported by MITREMedium 6

  Cross-site request forgery (CSRF) vulnerability in adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for WordPress allows remote attackers to perform unspecified actions as arbitrary users via unspecified vectors.

  Product

  adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for

  What to do

  Update adsense-deluxe.php in the AdSense-Deluxe 0.x plugin for to the newest version.

  Full record and what to do →NVD recordmichaeldaw.orgosvdb.org

• May 11, 2007sidebar.php in WordPress, when custom 404 pages that call get_sidebar are used,: Cross-site scripting (XSS)CVE-2007-2627 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site scripting (XSS) vulnerability in sidebar.php in WordPress, when custom 404 pages that call get_sidebar are used, allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF), a different vulnerability than CVE-2007-1622.

  Product

  sidebar.php in WordPress, when custom 404 pages that call get_sidebar are used,

  What to do

  Update sidebar.php in WordPress, when custom 404 pages that call get_sidebar are used, to the newest version.

  Full record and what to do →NVD recordosvdb.orgsecurityreason.com

• Apr 9, 2007wp-includes/general-template.php in WordPress before 20070309: Cross-site scripting (XSS)CVE-2007-1894 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in wp-includes/general-template.php in WordPress before 20070309 allows remote attackers to inject arbitrary web script or HTML via the year parameter in the wp_title function.

  Product

  wp-includes/general-template.php in WordPress before 20070309

  Fixed in

  20070309

  What to do

  Update wp-includes/general-template.php in WordPress before 20070309 to 20070309 or newer.

  Full record and what to do →NVD recordchxsecurity.orgsecunia.com

• Mar 28, 2007an mt import in wp-admin/admin.php in WordPress 2.1.2: Cross-site scripting (XSS)CVE-2007-1732 · WordPress plugins & themes · reported by MITRELow 3.5

  Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: another researcher disputes this issue, stating that this is legitimate functionality for administrators. However, it has been patched by at least one vendor

  Product

  an mt import in wp-admin/admin.php in WordPress 2.1.2

  What to do

  Update an mt import in wp-admin/admin.php in WordPress 2.1.2 to the newest version.

  Full record and what to do →NVD recordcodex.wordpress.orgmarc.info

• Mar 22, 2007wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series,: Cross-site scripting (XSS)CVE-2007-1622 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote authenticated users with theme privileges to inject arbitrary web script or HTML via the PATH_INFO in the administration interface, related to loose regular expression processing of PHP_SELF.

  Product

  wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series,

  Fixed in

  2.0.10

  What to do

  Update wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, to 2.0.10 or newer.

  Full record and what to do →NVD recordsecunia.comsecunia.com

• Mar 3, 2007the AdminPanel in WordPress 2.1.1 and earlier: Cross-site request forgery (CSRF)CVE-2007-1244 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks and steal cookies via the post parameter.

  Product

  the AdminPanel in WordPress 2.1.1 and earlier

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update the AdminPanel in WordPress 2.1.1 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org

• Mar 2, 2007Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web CVE-2007-1230 · WordPress plugins & themes · reported by MITREMedium 5.8

  Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via (1) the Referer HTTP header or (2) the URI, a different vulnerability than CVE-2007-1049.

  Fixed in

  2.1.2-alpha

  What to do

  Update the plugin to 2.1.2-alpha or newer.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• Feb 21, 2007the wp_explain_nonce function in the nonce AYS functionality: Cross-site scripting (XSS)CVE-2007-1049 · WordPress plugins & themes · reported by MITREMedium 4.3

  Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.

  Product

  the wp_explain_nonce function in the nonce AYS functionality

  Fixed in

  2.0.9

  What to do

  Update the wp_explain_nonce function in the nonce AYS functionality to 2.0.9 or newer.

  Full record and what to do →NVD recorddownloads.securityfocus.comosvdb.org

• Jan 8, 2007the CSRF protection scheme in WordPress before 2.0.6: Cross-site scripting (XSS)CVE-2007-0106 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when WordPress generates a new link to verify the request.

  Product

  the CSRF protection scheme in WordPress before 2.0.6

  Fixed in

  2.0.6

  What to do

  Update the CSRF protection scheme in WordPress before 2.0.6 to 2.0.6 or newer.

  Full record and what to do →NVD recordosvdb.orgsecunia.com

• Dec 28, 2006wp-admin/templates.php in WordPress 2.0.5: Cross-site scripting (XSS)CVE-2006-6808 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the get_file_description function in wp-admin/admin-functions.php.

  Product

  wp-admin/templates.php in WordPress 2.0.5

  What to do

  Update wp-admin/templates.php in WordPress 2.0.5 to the newest version.

  Full record and what to do →NVD recordmarc.infomichaeldaw.org

• Apr 17, 2006Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions beforCVE-2006-1796 · WordPress plugins & themes · reported by MITREMedium 6.8

  Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions before 2.0.1, allows remote attackers to inject arbitrary web script or HTML to Internet Explorer users via the request URI ($_SERVER['REQUEST_URI']).

  Fixed in

  2.0.1

  What to do

  Update the plugin to 2.0.1 or newer.

  Full record and what to do →NVD recordbugs.debian.orgtrac.wordpress.org

• Mar 18, 2006Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unCVE-2006-1263 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

  Fixed in

  2.0.2

  What to do

  Update the plugin to 2.0.2 or newer.

  Full record and what to do →NVD recordwordpress.orgsecurityfocus.com

• Mar 3, 2006Multiple cross-site scripting (XSS) vulnerabilities in the "post comment" functionality of WordPress 2.0.1 and earlier allow remote attackers to inject arbitrarCVE-2006-0985 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in the "post comment" functionality of WordPress 2.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) website, and (3) comment parameters.

  Affected

  up to 2.0.1

  What to do

  Affects up to 2.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordneosecurityteam.netsecunia.com

• Feb 16, 2006WordPress 2.0.0: Cross-site scripting (XSS)CVE-2006-0733 · WordPress plugins & themes · reported by MITRELow 2.6

  Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2) onblur in the "author's website" field. NOTE: followup comments to the researcher's web log suggest that this issue is only exploitable by the same user who injects the XSS, so this might not be a vulnerability

  Product

  WordPress 2.0.0

  What to do

  Update WordPress 2.0.0 to the newest version.

  Full record and what to do →NVD recordmyimei.comsecurityfocus.com

• Jul 5, 2005Multiple cross-site scripting (XSS) vulnerabilities in post.php in WordPress 1.5.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML vCVE-2005-2107 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in post.php in WordPress 1.5.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) p or (2) comment parameter.

  Affected

  up to 1.5.1.2

  What to do

  Affects up to 1.5.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordmarc.infosecunia.com

• May 2, 2005Multiple cross-site scripting (XSS) vulnerabilities in template-functions-post.php in WordPress 1.5 and earlier allow remote attackers to execute arbitrary commCVE-2005-1102 · WordPress plugins & themes · reported by MITREMedium 6.8

  Multiple cross-site scripting (XSS) vulnerabilities in template-functions-post.php in WordPress 1.5 and earlier allow remote attackers to execute arbitrary commands via the (1) content or (2) title of the post.

  Affected

  up to 1.5

  What to do

  Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordbugs.gentoo.orgmarc.info

• Dec 31, 2004Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, textCVE-2004-1559 · WordPress plugins & themes · reported by MITREMedium 4.3

  Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, text, popupurl, or popuptitle parameters to wp-login.php, (2) redirect_url parameter to admin-header.php, (3) popuptitle, popupurl, content, or post_title parameters to bookmarklet.php, (4) cat_ID parameter to categories.php, (5) s parameter to edit.php, or (6) s or mode parameter to edit-comments.php.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordmarc.infosecunia.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.