Vulnerabilities > Wordpress > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2008-04-02 | CVE-2008-1646 | SQL Injection vulnerability in multiple products SQL injection vulnerability in wp-download.php in the WP-Download 1.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the dl_id parameter. | 7.5 |
| 2008-02-28 | CVE-2008-1060 | Code Injection vulnerability in Wordpress Sniplets Plugin 1.1.2/1.2.2 Eval injection vulnerability in modules/execute.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via the text parameter. | 7.5 |
| 2008-02-28 | CVE-2008-1059 | Code Injection vulnerability in Wordpress Sniplets Plugin 1.1.2/1.2.2 PHP remote file inclusion vulnerability in modules/syntax_highlight.php in the Sniplets 1.1.2 and 1.2.2 plugin for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the libpath parameter. | 7.5 |
| 2008-02-25 | CVE-2008-0939 | SQL Injection vulnerability in Wordpress Photo Album Plugin 1.1 Multiple SQL injection vulnerabilities in wppa.php in the WP Photo Album (WPPA) before 1.1 plugin for WordPress allow remote attackers to execute arbitrary SQL commands via (1) the photo parameter to index.php, used by the wppa_photo_name function; or (2) the album parameter to index.php, used by the wppa_album_name function. | 7.5 |
| 2008-02-20 | CVE-2008-0845 | SQL Injection vulnerability in Wordpress Dean Logan Wp-People Plugin 1.6.1 SQL injection vulnerability in wp-people-popup.php in Dean Logan WP-People plugin 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the person parameter. | 7.5 |
| 2008-02-12 | CVE-2008-0683 | SQL Injection vulnerability in Wordpress ST Newsletter Plugin SQL injection vulnerability in shiftthis-preview.php in the ShiftThis Newsletter (st_newsletter) plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the newsletter parameter. | 7.5 |
| 2008-02-12 | CVE-2008-0682 | SQL Injection vulnerability in Wordpress Wordspew SQL injection vulnerability in wordspew-rss.php in the Wordspew plugin before 3.72 for Wordpress allows remote attackers to execute arbitrary SQL commands via the id parameter. | 7.5 |
| 2008-01-31 | CVE-2008-0520 | SQL Injection vulnerability in Wordpress Wassup Plugin 1.4 Multiple SQL injection vulnerabilities in main.php in the WassUp plugin 1.4 through 1.4.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) from_date or (2) to_date parameter to spy.php. | 7.5 |
| 2008-01-31 | CVE-2008-0507 | SQL Injection vulnerability in Wordpress Adserve 0.2 SQL injection vulnerability in adclick.php in the AdServe 0.2 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter. | 7.5 |
| 2008-01-30 | CVE-2008-0490 | SQL Injection vulnerability in Wordpress WP CAL Plugin 0.3 SQL injection vulnerability in functions/editevent.php in the WP-Cal 0.3 plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter. | 7.5 |