WordPress vulnerabilities, page 2

39,242 vulnerabilities

Known vulnerabilities in WordPress products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 17,767 products.

7.1CVE-2020-11510wordpresslearnpressVersions below 3.2.6.9 allow an attacker to publish or trash any existing post or page, or even set it to a nonexistent status, at which point it would no longer appear on the site or be accessible from wp-admin, and could only be recovered by modifying its status in the database.5.5CVE-2022-2944wordpresswordpress-countdown-widgetThe WordPress Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 3.1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.6.4CVE-2023-23665wordpressmainwp-rocket-extensionThe MainWP Rocket Extension plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 4.0.3 due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change the plugin's settings.6.5CVE-2022-45081wordpressadd-multiple-markerThe Add Multiple Marker plugin for WordPress is vulnerable authorization bypass in versions up to, and including, 1.2. This is due to lacking authentication checks on certain user functions like addmultiplemarker_save_maps_data() which is called via a nopriv AJAX action. This makes it possible for unauthenticated attackers to make plugin settings changes.7.2CVE-2014-8803wordpresssmart-formsThe Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the rednao_smart_forms_save_form_values function in versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to edit forms, including entering stored cross-site scripting, as output is not properly escaped.6.1CVE-2014-8814wordpresswp-photo-album-plusThe WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘walbum’ parameter in versions up to, and including, 5.4.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.6.4CVE-2023-23642wordpressmainwp-clone-extensionThe MainWP Clone Extension plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 4.0.2 due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change the plugin's settings.7.1CVE-2023-23661wordpressmainwp-post-dripper-extensionThe MainWP Post Dripper Extension extension for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 4.0.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts and pages.6.4CVE-2023-23748wordpressmainwp-branding-extensionThe MainWP White Label Extension plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 4.1.1 due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change the plugin's settings.5.8CVE-2015-4339wordpressgrand-mediaThe Gmedia Photo Gallery plugin for WordPress is vulnerable to Open Proxy attacks in versions up to, and including, 1.6.4. This is due to inclusion of a script intended to load images from a url that doesn't end in an image file extension. This makes it possible for unauthenticated attackers to proxy through the server and perform anonymized attacks on other servers.8.8CVE-2026-86461foliovisionfv flowplayer video player+1
EPSS score
0.74%
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the check_mimetype function. This is due to incomplete file type validation in the check_mimetype function — while some extension checking is present, it can be bypassed, allowing attacker-supplied remote file content to be written with insufficient extension enforcement and no MIME check or WordPress upload helper. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the plugin's 'profile videos on bio' option to be enabled, as this causes the nonce to be emitted on the subscriber-accessible profile page; without this setting, authenticated users below Editor cannot obtain the required nonce.8.1CVE-2023-23653wordpressmainwp-file-uploader-extensionThe MainWP File Uploader Extension for WordPress is vulnerable to arbitrary file download. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary files from the affected site.4.3CVE-2023-40326wordpresswoocommerce-putler-connectorThe Putler Connector for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the send_resync_request() function called via an AJAX action in versions up to, and including, 2.12.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to send a sync request.7.1CVE-2023-23666wordpressmainwp-post-plus-extensionThe MainWP Post Plus Extension plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 4.0.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts and pages.9.1CVE-2022-3227wordpresssearchwp-live-ajax-searchThe SearchWP Live Ajax Search plugin for WordPress is vulnerable to Directory Traversal via the 'swpengine' parameter used by the 'searchwp_live_search' AJAX action in versions up to, and including, 1.6.2. This allows unauthenticated attackers to include and execute arbitrary local PHP files.6.4CVE-2022-2940wordpressfeed-them-socialThe Feed Them Social plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘access_token’ parameter in the function fts_instagram_token_ajax in versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, subscriber and above, to inject arbitrary web scripts stored in the plugin options.5.4CVE-2022-47156wordpressgs-instagram-portfolioThe GS Insever Portfolio plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.4. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this function, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.7.1CVE-2022-41647wordpressoptinlyThe Optinly plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several AJAX actions in versions up to, and including, 1.0.18. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change certain plugin settings.8.8CVE-2014-5155wordpresstheme-my-loginThe Theme My Login plugin for WordPress is vulnerable to Local File Inclusion in versions before 6.3.10 via the login_template attribute found in the theme-my-login shortcode. This allows authenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.5.4CVE-2023-23747wordpressmainwp-buddy-extensionThe MainWP Buddy Extension plugin for WordPress is vulnerable to authorization bypass in versions up to, and including 4.0.1 due to a missing capability check. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to activate arbitrary plugins.