Database

Critical WordPress vulnerabilities (page 1333)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

Critical WordPress vulnerabilities (page 1333)
Severity	Vulnerability	CVE	Installs	Published
Medium6.3	Cross-Site Request Forgery Multicons<3.0Update to 3.0	CVE-2015-9424	—	Aug 25, 2015
Medium6.1	Reflected Cross-Site Scripting OnePress Social Locker<4.2.5Update to 4.2.5	CVE-2015-9425	—	Aug 25, 2015
Medium6.5	Cross-Site Request Forgery leading to Stored Cross-Site Scripting plugnedit<6.2.0Update to 6.2.0	CVE-2015-9422	—	Aug 25, 2015
Medium5.4	Authenticated Stored Cross-Site Scripting plugnedit<6.2.0Update to 6.2.0	CVE-2015-9423	—	Aug 25, 2015
High8.8	Authenticated Blind SQL Injection GoCodes≤1.3.5No patch available	CVE-2015-9398	—	Aug 25, 2015
Medium6.1	Reflected Cross-Site Scripting Simple Fields<1.4.11Update to 1.4.11	CVE-2015-9302	—	Aug 25, 2015
High8.8	SQL Injection WordPress Meta Robots≤2.1No patch available	CVE-2015-9400	—	Aug 25, 2015
Medium6.1	Cross-Site Request Forgery to Stored Cross-Site Scripting Cincopa video and media plug-in<1.137Update to 1.137	CVE-2015-10109	—	Aug 25, 2015
High7.2	SQL Injection GigPress<2.3.11Update to 2.3.11	CVE-2015-9353	—	Aug 24, 2015
Medium4.7	Cross-Site Scripting Analyticator<6.4.9.6Update to 6.4.9.6	CVE-2015-6238	—	Aug 24, 2015
Medium6.1	Reflected Cross-Site Scripting Manual Image Crop<1.11Update to 1.11	CVE-2015-9426	—	Aug 24, 2015
Medium6.1	Reflected Cross-Site Scripting GigPress≤2.3.10Update to 2.3.11	CVE-2015-9354	—	Aug 24, 2015
Medium6.1	Cross-Site Request Forgery to Cross-Site Scripting Googmonify≤0.5.1No patch available	CVE-2015-9427	—	Aug 23, 2015
Critical9.8	Blind SQL Injection DukaPress≤2.5.9Update to 2.5.9.1	CVE-2015-1000011	—	Aug 22, 2015
High8.8	Cross-Site Request Forgery WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings<2.3.10Update to 2.3.10	CVE-2015-9307	—	Aug 21, 2015
High8.8	Cross-Site Request Forgery WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings<2.3.10Update to 2.3.10	CVE-2015-9308	—	Aug 21, 2015
Medium6.1	Reflected Cross-Site Scripting qTranslate X<3.4.4Update to 3.4.4	CVE-2015-9431	—	Aug 21, 2015
Medium5.4	Cross-Site Scripting Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages<1.1Update to 1.1	CVE-2015-9428	—	Aug 21, 2015
High8.8	Cross-Site Request Forgery WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings<2.3.10Update to 2.3.10	CVE-2015-9309	—	Aug 21, 2015
High7.2	Stored Cross-Site Scripting Crazy Bone<0.6.0Update to 0.6.0	CVE-2015-9430	—	Aug 21, 2015
Critical9.8	SQL Injection 404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring<2.0.3Update to 2.0.3	CVE-2015-9323	—	Aug 20, 2015
Medium6.1	Reflected Cross-Site Scripting Alpine Photo Tile for Instagram<1.2.7.6Update to 1.2.7.6	CVE-2015-9432	—	Aug 20, 2015
Medium6.1	Cross-Site Scripting Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin≤1.3.17Update to 1.3.18	CVE-2015-9304	—	Aug 20, 2015
Medium6.1	Cross-Site Scripting MDC Private Message≤1.0.1No patch available	CVE-2015-6805	—	Aug 20, 2015
Medium6.5	Cross-Site Scripting WP Social Bookmarking Light<1.7.10Update to 1.7.10	CVE-2015-9433	—	Aug 19, 2015
Medium6.1	Cross-Site Scripting WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export<3.8.1Update to 3.8.1	CVE-2015-9306	—	Aug 18, 2015
Critical9.1	Open Proxy google-adsense-and-hotel-booking≤1.05No patch available	CVE-2015-1000009	—	Aug 15, 2015
Medium6.1	Reflected Cross-Site Scripting WP Latest Posts≤3.7.4Update to 3.7.5	CVE-2016-10913	—	Aug 15, 2015
Medium6.1	Cross-Site Scripting All-In-One Security (AIOS) – Security and Firewall<3.9.8Update to 3.9.8	CVE-2015-9293	—	Aug 15, 2015
Critical9.8	Pseudorandom Number Generation WP OAuth Server (OAuth Authentication)<3.1.5Update to 3.1.5	CVE-2015-9435	—	Aug 12, 2015

Medium6.3
Cross-Site Request Forgery
Multicons
<3.0Update to 3.0
CVE-2015-9424Aug 25, 2015
Medium6.1
Reflected Cross-Site Scripting
OnePress Social Locker
<4.2.5Update to 4.2.5
CVE-2015-9425Aug 25, 2015
Medium6.5
Cross-Site Request Forgery leading to Stored Cross-Site Scripting
plugnedit
<6.2.0Update to 6.2.0
CVE-2015-9422Aug 25, 2015
Medium5.4
Authenticated Stored Cross-Site Scripting
plugnedit
<6.2.0Update to 6.2.0
CVE-2015-9423Aug 25, 2015
High8.8
Authenticated Blind SQL Injection
GoCodes
≤1.3.5No patch available
CVE-2015-9398Aug 25, 2015
Medium6.1
Reflected Cross-Site Scripting
Simple Fields
<1.4.11Update to 1.4.11
CVE-2015-9302Aug 25, 2015
High8.8
SQL Injection
WordPress Meta Robots
≤2.1No patch available
CVE-2015-9400Aug 25, 2015
Medium6.1
Cross-Site Request Forgery to Stored Cross-Site Scripting
Cincopa video and media plug-in
<1.137Update to 1.137
CVE-2015-10109Aug 25, 2015
High7.2
SQL Injection
GigPress
<2.3.11Update to 2.3.11
CVE-2015-9353Aug 24, 2015
Medium4.7
Cross-Site Scripting
Analyticator
<6.4.9.6Update to 6.4.9.6
CVE-2015-6238Aug 24, 2015
Medium6.1
Reflected Cross-Site Scripting
Manual Image Crop
<1.11Update to 1.11
CVE-2015-9426Aug 24, 2015
Medium6.1
Reflected Cross-Site Scripting
GigPress
≤2.3.10Update to 2.3.11
CVE-2015-9354Aug 24, 2015
Medium6.1
Cross-Site Request Forgery to Cross-Site Scripting
Googmonify
≤0.5.1No patch available
CVE-2015-9427Aug 23, 2015
Critical9.8
Blind SQL Injection
DukaPress
≤2.5.9Update to 2.5.9.1
CVE-2015-1000011Aug 22, 2015
High8.8
Cross-Site Request Forgery
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<2.3.10Update to 2.3.10
CVE-2015-9307Aug 21, 2015
High8.8
Cross-Site Request Forgery
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<2.3.10Update to 2.3.10
CVE-2015-9308Aug 21, 2015
Medium6.1
Reflected Cross-Site Scripting
qTranslate X
<3.4.4Update to 3.4.4
CVE-2015-9431Aug 21, 2015
Medium5.4
Cross-Site Scripting
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages
<1.1Update to 1.1
CVE-2015-9428Aug 21, 2015
High8.8
Cross-Site Request Forgery
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<2.3.10Update to 2.3.10
CVE-2015-9309Aug 21, 2015
High7.2
Stored Cross-Site Scripting
Crazy Bone
<0.6.0Update to 0.6.0
CVE-2015-9430Aug 21, 2015
Critical9.8
SQL Injection
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring
<2.0.3Update to 2.0.3
CVE-2015-9323Aug 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Alpine Photo Tile for Instagram
<1.2.7.6Update to 1.2.7.6
CVE-2015-9432Aug 20, 2015
Medium6.1
Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤1.3.17Update to 1.3.18
CVE-2015-9304Aug 20, 2015
Medium6.1
Cross-Site Scripting
MDC Private Message
≤1.0.1No patch available
CVE-2015-6805Aug 20, 2015
Medium6.5
Cross-Site Scripting
WP Social Bookmarking Light
<1.7.10Update to 1.7.10
CVE-2015-9433Aug 19, 2015
Medium6.1
Cross-Site Scripting
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
<3.8.1Update to 3.8.1
CVE-2015-9306Aug 18, 2015
Critical9.1
Open Proxy
google-adsense-and-hotel-booking
≤1.05No patch available
CVE-2015-1000009Aug 15, 2015
Medium6.1
Reflected Cross-Site Scripting
WP Latest Posts
≤3.7.4Update to 3.7.5
CVE-2016-10913Aug 15, 2015
Medium6.1
Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<3.9.8Update to 3.9.8
CVE-2015-9293Aug 15, 2015
Critical9.8
Pseudorandom Number Generation
WP OAuth Server (OAuth Authentication)
<3.1.5Update to 3.1.5
CVE-2015-9435Aug 12, 2015