Skip to content
Noroxi

WonderCMS records

37 published records for vendor wondercms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 2.7%
Pre-auth RCE
10
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

37 records
  • CVE-2023-41425
    60This week

    Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted scrip

    MediumCVSS 6.1WeaponizedEPSS 54%

    wondercms · wondercmsNov 7, 2023

  • CVE-2020-35313
    53Plan

    A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows rem

    CriticalCVSS 9.8Proof of conceptEPSS 45%

    wondercms · wondercmsApr 20, 2021

  • CVE-2020-35314
    47Plan

    A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attacker

    CriticalCVSS 9.8Proof of conceptEPSS 26%

    wondercms · wondercmsApr 20, 2021

  • CVE-2014-8704
    40Plan

    Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a

    CriticalCVSS 9.8No exploitEPSS 2%

    wondercms · wondercmsMar 17, 2017

  • CVE-2014-8705
    39Monitor

    PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a UR

    CriticalCVSS 9.8No exploitEPSS 1%

    wondercms · wondercmsMar 17, 2017

  • CVE-2024-32340
    38Monitor

    A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or

    CriticalCVSS 9.6No exploitEPSS 0%

    wondercms · wondercmsApr 17, 2024

  • CVE-2017-14521
    37Monitor

    In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload.

    HighCVSS 8.8Proof of conceptEPSS 7%

    wondercms · wondercmsJan 26, 2018

  • CVE-2018-14387
    35Monitor

    An issue was discovered in WonderCMS before 2.5.2.

    HighCVSS 8.8No exploitEPSS 1%

    wondercms · wondercmsJul 18, 2018

  • CVE-2017-7951
    35Monitor

    WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context.

    HighCVSS 8.8No exploitEPSS 0%

    wondercms · wondercmsApr 20, 2017

  • CVE-2017-14523
    32Monitor

    WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack.

    HighCVSS 7.5Proof of conceptEPSS 8%

    wondercms · wondercmsJan 26, 2018

  • CVE-2024-27561
    32Monitor

    A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the applic

    HighCVSS 8.1No exploitEPSS 0%

    wondercms · wondercmsMar 5, 2024

  • CVE-2014-8701
    30Monitor

    Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed pa

    HighCVSS 7.5No exploitEPSS 1%

    wondercms · wondercmsMar 17, 2017

  • CVE-2019-5956
    27Monitor

    Directory traversal vulnerability in WonderCMS 2.6.0 and earlier allows remote attackers to delete arbitrary files via unspecified vectors.

    MediumCVSS 6.5No exploitEPSS 1%

    wondercms · wondercmsSep 12, 2019

  • CVE-2025-57055
    26Monitor

    WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    wondercms · wondercmsSep 17, 2025

  • CVE-2017-14522
    24Monitor

    In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript.

    MediumCVSS 6.1No exploitEPSS 1%

    wondercms · wondercmsJan 26, 2018

  • CVE-2014-8703
    24Monitor

    Cross-site scripting (XSS) vulnerability in Wonder CMS 2014 allows remote attackers to inject arbitrary web script or HTML.

    MediumCVSS 6.1No exploitEPSS 0%

    wondercms · wondercmsMar 17, 2017

  • CVE-2022-43332
    24Monitor

    A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo

    MediumCVSS 6.1Proof of conceptEPSS 0%

    wondercms · wondercmsNov 17, 2022

  • CVE-2024-32337
    24Monitor

    A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or

    MediumCVSS 6.1No exploitEPSS 0%

    wondercms · wondercmsApr 17, 2024

  • CVE-2024-32339
    24Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in the HOW TO page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts

    MediumCVSS 6.1No exploitEPSS 0%

    wondercms · wondercmsApr 17, 2024

  • CVE-2024-32745
    23Monitor

    A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or

    MediumCVSS 5.9No exploitEPSS 0%

    wondercms · wondercmsApr 17, 2024

  • CVE-2024-32743
    22Monitor

    A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or

    MediumCVSS 5.5No exploitEPSS 0%

    wondercms · wondercmsApr 17, 2024

  • CVE-2020-29469
    21Monitor

    WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component.

    MediumCVSS 5.4Proof of conceptEPSS 1%

    wondercms · wondercmsDec 30, 2020

  • CVE-2014-8702
    21Monitor

    Wonder CMS 2014 allows remote attackers to obtain sensitive information by logging into the application with an array for the password, whic

    MediumCVSS 5.3No exploitEPSS 1%

    wondercms · wondercmsMar 17, 2017

  • CVE-2020-29233
    21Monitor

    WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component.

    MediumCVSS 5.4Proof of conceptEPSS 1%

    wondercms · wondercmsDec 30, 2020

  • CVE-2021-42233
    21Monitor

    The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting (XSS) vulnerability.

    MediumCVSS 5.4No exploitEPSS 0%

    wondercms · wondercmsMay 23, 2022