CVSS: 8.8EPSS: 0%CPEs: 83EXPL: 3CVE-2012-1936 – WordPress Core 3.3.1 - Multiple Cross-Site Request Forgery Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-1936
03 May 2012 — The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks on specific actions and objects by sniffing the network, as demonstrated by attacks against the wp-admin/admin-ajax.php and wp-admin/user-new.php scripts. NOTE: the vendor reportedly disputes the significance of this issue because wp_create_nonce operates ... • https://www.exploit-db.com/exploits/18791 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 2%CPEs: 80EXPL: 0CVE-2012-2404 – WordPress Core <= 3.3.1 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-2404
21 Apr 2012 — wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. wp-comments-post.php en WordPress antes de v3.3.2 soporta redirecciones afuera del sitio, lo que hace que facilita a los atacantes remotos a la hora de realizar ataques de ejecuciónde comandos en sitios cruzados (XSS) a través de vectores no especificados. • http://core.trac.wordpress.org/changeset/20486/branches/3.3/wp-comments-post.php • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 6%CPEs: 80EXPL: 0CVE-2012-2399 – WordPress Core <= 3.5.1 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-2399
21 Apr 2012 — Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414. Vulnerabilidad no especificada en wp-includes/js/swfupload/swfupload.swf en WordPress antes de v3.3.2 tiene un impacto y vectores de ataque desconocidos. • http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/swfupload/swfupload.swf?rev=20503 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 2%CPEs: 80EXPL: 0CVE-2012-2400 – WordPress Core < 3.3.2 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-2400
20 Apr 2012 — Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors. Vulnerabilidad no especificada en wp-includes/js/swfobject.js en WordPress antes de v3.3.2 tiene un impacto y vectores de ataque desconocidos. • http://core.trac.wordpress.org/changeset/20499/branches/3.3/wp-includes/js/swfobject.js • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 89EXPL: 0CVE-2012-2401 – WordPress Core <= 3.3.1 - Same Origin Policy Bypass
https://notcve.org/view.php?id=CVE-2012-2401
20 Apr 2012 — Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content. Plupload antes de v1.5.4, tal y como se utiliza en wp-includes/js/plupload/ en WordPress antes de v3.3.2 y otros productos, permite ejecutar secuencias de comandos, independientemente del dominio desde el que se cargó el contenido SWF, lo qu... • http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload/changelog.txt?rev=20487 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.4EPSS: 2%CPEs: 80EXPL: 0CVE-2012-2403 – WordPress Core < 3.3.2 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-2403
20 Apr 2012 — wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. wp-includes/formatting.php en WordPress antes de v3.3.2 intenta habilitar los enlaces 'clicables' dentro de los atributos, lo que hace que facilita a los atacantes remotos a la hora de realizar ataques de ejecución de comandos en sitios cruzados(XSS) a través de vectores no especificados. • http://core.trac.wordpress.org/changeset/20493/branches/3.3/wp-includes/capabilities.php • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 80EXPL: 0CVE-2012-2402 – WordPress Core < 3.3.2 - Authorization Bypass
https://notcve.org/view.php?id=CVE-2012-2402
20 Apr 2012 — wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors. wp-admin/plugins.php en WordPress antes de v3.3.2 permite eludir restricciones de acceso a los administradores autenticados del sitio y desactivar plugins de red a través de vectores no especificados. • http://core.trac.wordpress.org/changeset/20526/branches/3.3/wp-admin/plugins.php • CWE-264: Permissions, Privileges, and Access Controls CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 1%CPEs: 76EXPL: 0CVE-2012-4033 – Zingiri Web Shop < 2.4.0 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-4033
18 Apr 2012 — Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin before 2.4.0 for WordPress have unknown impact and attack vectors. Múltiples vulnerabilidades no especificadas en el plug-in Zingiri Web Shop antes de v2.4.0 para WordPress tienen un impacto y vectores de ataque desconocidos. The Zingiri Web Shop plugin for WordPress has multiple vulnerabilities in versions up to, and including, 2.3.7. This is due to the inclusion of timthumb.php, along with several cross-site scripting and SQL injection vu... • http://forums.zingiri.com/announcements.php?aid=2 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 10.0EPSS: 48%CPEs: 99EXPL: 3CVE-2012-3576 – IDB Ecommerce (wpStoreCart 5) < 2.5.30 - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2012-3576
06 Mar 2012 — Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in uploads/wpstorecart. Vulnerabilidad de subida de fichero sin restricción en php/upload.php del plugin wpStoreCart en versiones anteriores a la 2.5.30 de WordPress. Permite a usuarios remotos ejecutar código arbitrario subiendo un archivo con una e... • https://www.exploit-db.com/exploits/19023 • CWE-264: Permissions, Privileges, and Access Controls CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 73EXPL: 4CVE-2012-0782 – WordPress Core 3.3.1 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-0782
30 Jan 2012 — Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance ** CUESTIONADA ** Varias vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en wp-admin/setup-config... • https://www.exploit-db.com/exploits/18417 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •