Vulnerabilities > Wordpress
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2013-06-21 | CVE-2013-3250 | Cross-Site Request Forgery (CSRF) vulnerability in Wordpress WP Maintenance Mode Plugin Cross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode plugin before 1.8.8 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings. | 6.8 |
| 2013-06-21 | CVE-2013-2173 | Cryptographic Issues vulnerability in Wordpress 3.5.1 wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attackers to cause a denial of service (CPU consumption) via a crafted value of a certain wp-postpass cookie. | 4.3 |
| 2013-06-01 | CVE-2013-3261 | Cross-Site Scripting vulnerability in Photogallerycreator Flash-Album-Gallery Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in a flag-manage-gallery action. | 4.3 |
| 2013-05-31 | CVE-2013-3720 | Cross-Site Scripting vulnerability in Feedweb Cross-site scripting (XSS) vulnerability in widget_remove.php in the Feedweb plugin before 1.9 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wp_post_id parameter. | 3.5 |
| 2013-05-10 | CVE-2013-3532 | SQL Injection vulnerability in Webdorado Spider Video Player 2.1 SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the theme parameter. | 7.5 |
| 2013-05-10 | CVE-2013-3530 | SQL Injection vulnerability in Fabricio Zuardi Xspf Player Plugin 0.1 SQL injection vulnerability in playlist.php in the Spiffy XSPF Player plugin 0.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the playlist_id parameter. | 7.5 |
| 2013-05-10 | CVE-2013-3529 | Cross-Site Scripting vulnerability in Smartypantsplugins Wp-Funeral-Press Multiple cross-site scripting (XSS) vulnerabilities in user/obits.php in the WP FuneralPress plugin before 1.1.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) message, (2) photo-message, or (3) youtube-message parameter. | 4.3 |
| 2013-05-10 | CVE-2013-3526 | Cross-Site Scripting vulnerability in Wptrafficanalyzer Trafficanalyzer Cross-site scripting (XSS) vulnerability in js/ta_loaded.js.php in the Traffic Analyzer plugin, possibly 3.3.2 and earlier, for WordPress allows remote attackers to inject arbitrary web script or HTML via the aoid parameter. | 4.3 |
| 2013-05-10 | CVE-2013-3254 | Cross-Site Scripting vulnerability in Wppa.Opajaap Wp-Photo-Album-Plus 5.0.0/5.0.1/5.0.2 Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppa_manage_comments edit action. | 4.3 |
| 2013-05-10 | CVE-2013-2707 | Cross-Site Request Forgery (CSRF) vulnerability in Netweblogic Login With Ajax Cross-site request forgery (CSRF) vulnerability in the Login With Ajax plugin before 3.1 for WordPress allows remote attackers to hijack the authentication of arbitrary users for requests that modify this plugin's settings. | 6.8 |