Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
wordpress wordpress 2.6.1 vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2009-2762
wp-login.php in WordPress 2.8.3 and previous versions allows remote malicious users to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key i...
Wordpress Wordpress
3 EDB exploits
1 Github repository
NA
CVE-2009-1030
Cross-site scripting (XSS) vulnerability in the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU (WPMU) prior to 2.7 allows remote malicious users to inject arbitrary web script or HTML via the HTTP Host header.
Wordpress Wordpress Mu 1.0
Wordpress Wordpress Mu 1.2.4
Wordpress Wordpress Mu 1.2.5a
Wordpress Wordpress Mu 2.6.3
Wordpress Wordpress Mu 2.6.5
Wordpress Wordpress Mu 1.2.2
Wordpress Wordpress Mu 1.1.1
Wordpress Wordpress Mu 1.1
Wordpress Wordpress Mu 1.5
Wordpress Wordpress Mu 1.5.1
Wordpress Wordpress Mu 1.3
Wordpress Wordpress Mu 1.2.3
Wordpress Wordpress Mu 1.3.2
Wordpress Wordpress Mu 1.3.3
Wordpress Wordpress Mu 2.7
Wordpress Wordpress Mu
Wordpress Wordpress Mu 1.3.1
Wordpress Wordpress Mu 1.2
Wordpress Wordpress Mu 1.2.1
Wordpress Wordpress Mu 2.6.1
Wordpress Wordpress Mu 2.6.2
1 EDB exploit
NA
CVE-2009-2853
Wordpress prior to 2.8.3 allows remote malicious users to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-form-comment.php, (5) edit-link-category-form.php, (6) edit-link-form.php, (7) edit-page-form.p...
Wordpress Wordpress 1.2
Wordpress Wordpress 0.72
Wordpress Wordpress 1.5
Wordpress Wordpress 1.5.1
Wordpress Wordpress 1.5.1.3
Wordpress Wordpress 1.5.2
Wordpress Wordpress 2.0
Wordpress Wordpress 2.2.3
Wordpress Wordpress 2.3
Wordpress Wordpress 2.3.1
Wordpress Wordpress 2.5.1
Wordpress Wordpress 2.1.1
Wordpress Wordpress 1.0
Wordpress Wordpress 1.0.1
Wordpress Wordpress 2.0.7
Wordpress Wordpress 2.1
Wordpress Wordpress 2.1.2
Wordpress Wordpress 2.6.1
Wordpress Wordpress 2.6.2
Wordpress Wordpress 2.6.3
Wordpress Wordpress 2.7
Wordpress Wordpress 2.7.1
NA
CVE-2010-5293
wp-includes/comment.php in WordPress prior to 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote malicious users to bypass intended spam restrictions via a crafted URL, as demonstrated by a URL that triggers a substring match.
Wordpress Wordpress 2.0.11
Wordpress Wordpress 2.0.2
Wordpress Wordpress 2.0.4
Wordpress Wordpress 2.0.5
Wordpress Wordpress 2.3.1
Wordpress Wordpress 2.3.2
Wordpress Wordpress 2.3.3
Wordpress Wordpress 2.5
Wordpress Wordpress 2.8.4
Wordpress Wordpress 2.8.5
Wordpress Wordpress 2.8.5.1
Wordpress Wordpress 2.8.5.2
Wordpress Wordpress 2.0
Wordpress Wordpress 2.0.10
Wordpress Wordpress 2.0.6
Wordpress Wordpress 2.0.8
Wordpress Wordpress 2.1
Wordpress Wordpress 2.2.1
Wordpress Wordpress 2.2.3
Wordpress Wordpress 2.6
Wordpress Wordpress 2.6.2
Wordpress Wordpress 2.8
NA
CVE-2010-5295
Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress prior to 3.0.2 might allow remote malicious users to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action.
Wordpress Wordpress 2.0.4
Wordpress Wordpress 2.0.5
Wordpress Wordpress 2.0.6
Wordpress Wordpress 2.0.7
Wordpress Wordpress 2.0.8
Wordpress Wordpress 2.3.3
Wordpress Wordpress 2.5
Wordpress Wordpress 2.5.1
Wordpress Wordpress 2.6
Wordpress Wordpress 2.8.5.1
Wordpress Wordpress 2.8.5.2
Wordpress Wordpress 2.8.6
Wordpress Wordpress 2.9
Wordpress Wordpress 2.0.10
Wordpress Wordpress 2.0.2
Wordpress Wordpress 2.1
Wordpress Wordpress 2.1.2
Wordpress Wordpress 2.2.3
Wordpress Wordpress 2.3.1
Wordpress Wordpress 2.6.2
Wordpress Wordpress 2.6.5
Wordpress Wordpress 2.8.4
NA
CVE-2010-5294
Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPress prior to 3.0.2 allow remote servers to inject arbitrary web script or HTML by providing a crafted error message for a (1) FTP or (2) SSH c...
Wordpress Wordpress 2.0.2
Wordpress Wordpress 2.0.4
Wordpress Wordpress 2.0.5
Wordpress Wordpress 2.0.6
Wordpress Wordpress 2.0.7
Wordpress Wordpress 2.3.2
Wordpress Wordpress 2.3.3
Wordpress Wordpress 2.5
Wordpress Wordpress 2.5.1
Wordpress Wordpress 2.8.5
Wordpress Wordpress 2.8.5.1
Wordpress Wordpress 2.8.5.2
Wordpress Wordpress 2.8.6
Wordpress Wordpress 2.0.1
Wordpress Wordpress 2.0.11
Wordpress Wordpress 2.0.9
Wordpress Wordpress 2.1.1
Wordpress Wordpress 2.2.2
Wordpress Wordpress 2.3
Wordpress Wordpress 2.6.1
Wordpress Wordpress 2.6.3
Wordpress Wordpress 2.8.3
NA
CVE-2010-5296
wp-includes/capabilities.php in WordPress prior to 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.
Wordpress Wordpress 2.0.6
Wordpress Wordpress 2.0.7
Wordpress Wordpress 2.0.8
Wordpress Wordpress 2.0.9
Wordpress Wordpress 2.5
Wordpress Wordpress 2.5.1
Wordpress Wordpress 2.6
Wordpress Wordpress 2.6.1
Wordpress Wordpress 2.6.2
Wordpress Wordpress 2.8.5.2
Wordpress Wordpress 2.8.6
Wordpress Wordpress 2.9
Wordpress Wordpress 2.9.1
Wordpress Wordpress 2.0.11
Wordpress Wordpress 2.0.4
Wordpress Wordpress 2.1.1
Wordpress Wordpress 2.1.3
Wordpress Wordpress 2.3
Wordpress Wordpress 2.3.2
Wordpress Wordpress 2.6.3
Wordpress Wordpress 2.7
Wordpress Wordpress 2.8.4
NA
CVE-2010-5297
WordPress prior to 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances ...
Wordpress Wordpress 2.0.7
Wordpress Wordpress 2.0.8
Wordpress Wordpress 2.0.9
Wordpress Wordpress 2.1
Wordpress Wordpress 2.5.1
Wordpress Wordpress 2.6
Wordpress Wordpress 2.6.1
Wordpress Wordpress 2.6.2
Wordpress Wordpress 2.6.3
Wordpress Wordpress 2.8.6
Wordpress Wordpress 2.9
Wordpress Wordpress 2.9.1
Wordpress Wordpress 2.9.1.1
Wordpress Wordpress 2.0.2
Wordpress Wordpress 2.0.5
Wordpress Wordpress 2.1.2
Wordpress Wordpress 2.2
Wordpress Wordpress 2.3.1
Wordpress Wordpress 2.3.3
Wordpress Wordpress 2.6.5
Wordpress Wordpress 2.7.1
Wordpress Wordpress 2.8.5
NA
CVE-2009-2432
WordPress and WordPress MU prior to 2.8.1 allow remote malicious users to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an error message.
Wordpress Wordpress 2.6
Wordpress Wordpress 2.5.1
Wordpress Wordpress 2.3
Wordpress Wordpress 2.2 Revision5003
Wordpress Wordpress 2.1
Wordpress Wordpress 2.1.3 Rc2
Wordpress Wordpress 2.0.8
Wordpress Wordpress 2.0.7
Wordpress Wordpress 2.0.10 Rc1
Wordpress Wordpress 2.0.10
Wordpress Wordpress 1.5.1.1
Wordpress Wordpress 1.5.1
Wordpress Wordpress 1.2.1
Wordpress Wordpress 1.2-mingus
Wordpress Wordpress 1.0.2
Wordpress Wordpress 1.0.1-miles
Wordpress Wordpress 0.72
Wordpress Wordpress 0.711
Wordpress Wordpress 0.6.2
Wordpress Wordpress 2.6.1
Wordpress Wordpress 2.6.3
Wordpress Wordpress Mu 1.2.4
NA
CVE-2009-2334
wp-admin/admin.php in WordPress and WordPress MU prior to 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote malicious users to specify a configuration file in the page parameter to obtain sensitive information or mod...
Wordpress Wordpress 2.3.3
Wordpress Wordpress 2.3.2
Wordpress Wordpress 2.2.2
Wordpress Wordpress 2.2.1
Wordpress Wordpress 2.1.1
Wordpress Wordpress 2.1
Wordpress Wordpress 2.6
Wordpress Wordpress 2.3.1
Wordpress Wordpress 2.2.0
Wordpress Wordpress 2.2
Wordpress Wordpress 2.0.9
Wordpress Wordpress 2.0.8
Wordpress Wordpress 2.0.11
Wordpress Wordpress 2.0.10 Rc2
Wordpress Wordpress 1.5.1.3
Wordpress Wordpress 1.5.1.2
Wordpress Wordpress 1.2.2
Wordpress Wordpress 1.2.1
Wordpress Wordpress 2.5.1
Wordpress Wordpress 2.5
Wordpress Wordpress 2.3
Wordpress Wordpress 2.2 Revision5003
1 EDB exploit
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-32976
CVE-2024-33557
CVE-2024-36801
CVE-2024-35654
authentication bypass
CVE-2024-24919
CSRF
code execution
CVE-2024-27348
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
5
NEXT »