VulnCrest
Search
Create account
Report an incident
Radar sectionsCritical
Check my site

Database

Critical WordPress vulnerabilities (page 1334)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

Signals
Software

41,567 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

Critical WordPress vulnerabilities (page 1334)
SeverityVulnerabilityCVEInstallsPublished
Medium4.8Authenticated Cross-Site Scripting
WordPress Share Buttons Plugin – AddThis<5.0.13Update to 5.0.13
CVE-2015-9439—
Medium6.1Refletced Cross-Site Scripting
Dynamic Widgets<1.5.11Update to 1.5.11
CVE-2015-9437—
Medium5.4Cross-Site Scripting
Dynamic Widgets<1.5.11Update to 1.5.11
CVE-2015-9436—
Medium5.4Authenticated Cross-Site Scripting
Display Widgets≤2.03Update to 2.04
CVE-2015-9438—
Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.6Update to 5.6
CVE-2015-9297—
Critical9.8Code Injection
Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.6Update to 5.6
CVE-2015-9298—
Medium6.4Stored Cross-Site Scripting
iframe≤4.0Update to 4.1
CVE-2015-6738—
Medium5.4Cross-Site Request Forgery to Cross-Site Scripting
bookmarkify≤1.1.3No patch available
CVE-2015-9441—
Critical9.8Unauthenticated SQL Injection
WP Symposium<15.8Update to 15.8
CVE-2015-6522—
Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Monetize≤1.03No patch available
CVE-2015-9440—
Medium6.5Cross-Site Scripting
Avenir-soft Direct Download≤1.0No patch available
CVE-2015-9442—
Medium6.1Reflected Cross-Site Scripting
Qtranslate Slug≤1.1.16Update to 1.1.17
CVE-2015-10092—
Medium6.1< 0.7.23 - Stored Cross-Site Scripting
Job Manager<0.7.23Update to 0.7.23
CVE-2015-2321—
Medium6.1Cross-Site Scripting in Theme Preview
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-5734—
High8.8SQL Injection
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-2213—
Medium5.5Cross-Site Scripting via Widget Title
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-5732—
Medium5.3Timing Side-Channel Attack
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-5730—
Critical9.6Cross-Site Request Forgery to Post Lockage
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-5731—
Medium5.4Stored Cross-Site Scripting via accessibility-helper Title
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-5733—
Medium6.5Remote File Download
Simple Image Manipulator≤1.0No patch available
CVE-2015-1000010—
Medium6.1Reflected Cross-Site Scripting
YITH Maintenance Mode≤1.1.4Update to 1.2.0
CVE-2015-9429—
Medium5.5Authenticated (Admin+) Cross-Site Scripting
Content Grabber≤1.0No patch available
CVE-2015-9469—
Medium6.1Cross-Site Scripting
The Holiday Calendar<1.11.3Update to 1.11.3
CVE-2015-9270—
Medium6.1Cross-Site Scripting
qTranslate≤2.5.39No patch available
CVE-2015-5535—
Medium6.1Reflected Cross-Site Scripting
Flickr Justified Gallery<3.4.0Update to 3.4.0
CVE-2015-9327—
Critical9.8SQL Injection
Email Before Download≤3.4Update to 3.4.1
——
Medium6.1Reflected Cross-Site Scripting
Clean Login≤1.5Update to 1.5.1
CVE-2015-9336—
High8.8Cross-Site Request Forgery & Authenticated SQL Injection
Unite Gallery Lite≤1.4.6Update to 1.5
CVE-2015-9445—
High7.2Cross-Site Request Forgery and SQL Injection
Unite Gallery Lite<1.5Update to 1.5
CVE-2015-9447—
High8.8SQL Injection
Unite Gallery Lite<1.5Update to 1.5
CVE-2015-9446—

Search VulnCrest Radar

Jump to

Are you sure?