CWE-352Vulnerability type

WordPress CSRF vulnerabilities (page 1371)

Actions that skip nonce checks, letting an attacker trick a logged-in admin into changing settings or data.

WordPress CSRF vulnerabilities (page 1371)
Severity	Vulnerability	CVE	Installs	Published
High8.8	Arbitrary File Upload WordPress≤2.2Update to 2.2.1	CVE-2007-3543	—	Aug 5, 2007
Medium6.4	Cross-Site Scripting WordPress≤2.2.1Update to 2.0.11 or 2.2.2	CVE-2007-4139	—	Aug 5, 2007
Medium6.1	Reflected Cross-Site Scripting Blix≤0.9.1No patch available	CVE-2007-4014	—	Jul 18, 2007
High7.2	Cross-Site Scripting FeedStats<2.4Update to 2.4	CVE-2007-4104	—	Jul 13, 2007
Medium6.1	Cross-Site Scripting WordPress≤2.2Update to 2.2.1	CVE-2007-2627	—	Jun 21, 2007
High8.8	SQL Injection WordPress≤2.2Update to 2.2.1	CVE-2007-3140	—	Jun 21, 2007
High7.2	Stored Cross-Site Scripting stats≤1.0Update to 1.1	CVE-2007-3288	—	Jun 20, 2007
Medium6.1	Cross-Site Scripting Cordobo Green Parkall versionsNo patch available	CVE-2007-3241	—	Jun 19, 2007
Medium6.1	Cross-Site Scripting Vistered Littleall versionsNo patch available	CVE-2007-3240	—	Jun 14, 2007
Medium6.1	Cross-Site Scripting andyblue<1.5Update to 1.5	CVE-2007-3239	—	Jun 8, 2007
Medium6.1	Cross-Site Scripting Unnamed≤1.2.17Update to 1.2.17.1	CVE-2007-4166	—	Jun 6, 2007
High8.8	Cross-Site Request Forgery AdSense-Deluxe≤0.8No patch available	CVE-2007-2828	—	May 22, 2007
Medium6.1	Cross-Site Scripting Akismet Anti-spam: Spam Protection≤2.0.1Update to 2.0.2	CVE-2007-2714	—	May 14, 2007
Critical9.8	Directory Traversal and File Inclusion wordTube≤1.43Update to 1.44	CVE-2007-2482	—	May 1, 2007
Critical9.8	Remote File Inclusion Myflash≤1.00Update to 1.11	CVE-2007-2485	—	May 1, 2007
Critical9.8	Local File Inclusion WP-Table≤1.43Update to 1.44	CVE-2007-2483	—	May 1, 2007
Critical9.8	Remote File Inclusion wordTube≤1.43Update to 1.44	CVE-2007-2481	—	May 1, 2007
Critical9.8	SQL Injection The Hacker's Diet≤0.9.6bUpdate to 0.9.7b	CVE-2007-10003	—	Apr 30, 2007
Critical9.8	Remote File Inclusion MySliderGallery≤1.2.1Update to 1.4b5	CVE-2007-2426	—	Apr 29, 2007
High8.8	SQL Injection WordPress<2.1.3Update to 2.1.3	CVE-2007-1897	—	Apr 3, 2007
Medium6.1	Cross-Site Scripting WordPress≤2.1.1Update to 2.0.10 or 2.1.2	CVE-2007-1622	—	Apr 3, 2007
Medium6.1	Open Redirect WordPress<2.0.10Update to 2.0.10	CVE-2007-1599	—	Apr 3, 2007
High7.2	Cross-Site Scripting WordPress≤2.0.9Update to 2.0.10	CVE-2008-0192	—	Apr 3, 2007
Medium6.4	Cross-Site Scripting WordPress≤2.1.2Update to 2.0.10 or 2.1.3	CVE-2007-1894	—	Apr 3, 2007
Medium4.3	Authorization Bypass WordPress≤2.1.2Update to 2.1.3	CVE-2007-1893	—	Apr 3, 2007
Critical9.8	Backdoor WordPress2.2.1 – 2.2.1Update to 2.2.2	CVE-2007-1277	—	Mar 3, 2007
Medium6.4	Cross-Site Scripting WordPress≤2.1.1Update to 2.1.2	CVE-2007-1244	—	Mar 2, 2007
Medium6.4	Cross-Site Scripting WordPress≤2.1.1Update to 2.1.2	CVE-2007-1230	—	Mar 2, 2007
High7.2	Cross-Site Scripting WordPress≤2.1Update to 2.0.9 or 2.1.1	CVE-2007-1049	—	Feb 21, 2007
Medium6.4	Cross-Site Scripting WordPress≤3.0.4Update to 3.0.5	CVE-2011-0700	—	Feb 11, 2007

High8.8
Arbitrary File Upload
WordPress
≤2.2Update to 2.2.1
CVE-2007-3543Aug 5, 2007
Medium6.4
Cross-Site Scripting
WordPress
≤2.2.1Update to 2.0.11 or 2.2.2
CVE-2007-4139Aug 5, 2007
Medium6.1
Reflected Cross-Site Scripting
Blix
≤0.9.1No patch available
CVE-2007-4014Jul 18, 2007
High7.2
Cross-Site Scripting
FeedStats
<2.4Update to 2.4
CVE-2007-4104Jul 13, 2007
Medium6.1
Cross-Site Scripting
WordPress
≤2.2Update to 2.2.1
CVE-2007-2627Jun 21, 2007
High8.8
SQL Injection
WordPress
≤2.2Update to 2.2.1
CVE-2007-3140Jun 21, 2007
High7.2
Stored Cross-Site Scripting
stats
≤1.0Update to 1.1
CVE-2007-3288Jun 20, 2007
Medium6.1
Cross-Site Scripting
Cordobo Green Park
all versionsNo patch available
CVE-2007-3241Jun 19, 2007
Medium6.1
Cross-Site Scripting
Vistered Little
all versionsNo patch available
CVE-2007-3240Jun 14, 2007
Medium6.1
Cross-Site Scripting
andyblue
<1.5Update to 1.5
CVE-2007-3239Jun 8, 2007
Medium6.1
Cross-Site Scripting
Unnamed
≤1.2.17Update to 1.2.17.1
CVE-2007-4166Jun 6, 2007
High8.8
Cross-Site Request Forgery
AdSense-Deluxe
≤0.8No patch available
CVE-2007-2828May 22, 2007
Medium6.1
Cross-Site Scripting
Akismet Anti-spam: Spam Protection
≤2.0.1Update to 2.0.2
CVE-2007-2714May 14, 2007
Critical9.8
Directory Traversal and File Inclusion
wordTube
≤1.43Update to 1.44
CVE-2007-2482May 1, 2007
Critical9.8
Remote File Inclusion
Myflash
≤1.00Update to 1.11
CVE-2007-2485May 1, 2007
Critical9.8
Local File Inclusion
WP-Table
≤1.43Update to 1.44
CVE-2007-2483May 1, 2007
Critical9.8
Remote File Inclusion
wordTube
≤1.43Update to 1.44
CVE-2007-2481May 1, 2007
Critical9.8
SQL Injection
The Hacker's Diet
≤0.9.6bUpdate to 0.9.7b
CVE-2007-10003Apr 30, 2007
Critical9.8
Remote File Inclusion
MySliderGallery
≤1.2.1Update to 1.4b5
CVE-2007-2426Apr 29, 2007
High8.8
SQL Injection
WordPress
<2.1.3Update to 2.1.3
CVE-2007-1897Apr 3, 2007
Medium6.1
Cross-Site Scripting
WordPress
≤2.1.1Update to 2.0.10 or 2.1.2
CVE-2007-1622Apr 3, 2007
Medium6.1
Open Redirect
WordPress
<2.0.10Update to 2.0.10
CVE-2007-1599Apr 3, 2007
High7.2
Cross-Site Scripting
WordPress
≤2.0.9Update to 2.0.10
CVE-2008-0192Apr 3, 2007
Medium6.4
Cross-Site Scripting
WordPress
≤2.1.2Update to 2.0.10 or 2.1.3
CVE-2007-1894Apr 3, 2007
Medium4.3
Authorization Bypass
WordPress
≤2.1.2Update to 2.1.3
CVE-2007-1893Apr 3, 2007
Critical9.8
Backdoor
WordPress
2.2.1 – 2.2.1Update to 2.2.2
CVE-2007-1277Mar 3, 2007
Medium6.4
Cross-Site Scripting
WordPress
≤2.1.1Update to 2.1.2
CVE-2007-1244Mar 2, 2007
Medium6.4
Cross-Site Scripting
WordPress
≤2.1.1Update to 2.1.2
CVE-2007-1230Mar 2, 2007
High7.2
Cross-Site Scripting
WordPress
≤2.1Update to 2.0.9 or 2.1.1
CVE-2007-1049Feb 21, 2007
Medium6.4
Cross-Site Scripting
WordPress
≤3.0.4Update to 3.0.5
CVE-2011-0700Feb 11, 2007