Database
Critical WordPress vulnerabilities (page 1338)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | Path Traversal to Arbitrary File Read | CVE-2015-5065 | — | |
| Critical9.8 | Unauthenticated Local File Inclusion | CVE-2015-9480 | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-4455 | — | |
| Critical9.8 | SQL Injection | CVE-2015-4614 | — | |
| Medium5.3 | Path Traversal | CVE-2015-4617 | — | |
| Critical9.8 | SQL Injection | CVE-2015-4615 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-4010 | — | |
| Medium6.5 | Directory Traversal | CVE-2015-4616 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9315 | — | |
| Critical9.8 | SQL Injection | — | — | |
| Critical9.8 | Directory Traversal | CVE-2015-4414 | — | |
| Critical9.8 | Local File Inclusion | — | — | |
| Critical9.8 | Local File Inclusion | CVE-2015-4153 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-4465 | — | |
| Critical9.8 | Multiple SQL Injection Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin≤1.5.15Update to 1.5.16 | CVE-2015-4109 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9299 | — | |
| High8.8 | Cross-Site Request Forgery to Remote Code Execution | CVE-2015-4179 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9303 | — | |
| Critical9.8 | SQL Injection | — | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-9471 | — | |
| Medium6.1 | Open Redirect | CVE-2015-4070 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-4139 | — | |
| Medium6.1 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2015-4140 | — | |
| High8.8 | SQL Injection | CVE-2014-5183 | — | |
| Critical9.8 | SQL Injection | CVE-2015-2090 | — | |
| Critical9.8 | Local File Inclusion | — | — | |
| Medium5.8 | Open Proxy | CVE-2015-4339 | — | |
| High8.8 | SQL Injection | CVE-2015-4066 | — | |
| High8.8 | Multiple Cross-Site Request Forgery | CVE-2015-4089 | — |
- Medium5.3Path Traversal to Arbitrary File Read
PayPal Currency Converter BASIC for WooCommerce
≤1.3Update to 1.4
- Critical9.8Unauthenticated Local File Inclusion
robotcpa
≤5No patch available
- Critical9.8Arbitrary File Upload
Frontend File Manager Plugin
≤3.7Update to 3.8
- Critical9.8Arbitrary File Upload
Aviary Image Editor Add-on For Gravity Forms
≤3.0 (Beta r7)No patch available
- Critical9.8SQL Injection
Easy2Map
<1.2.5Update to 1.2.5
- Medium5.3Path Traversal
Easy2Map Photos
≤1.0.9Update to 1.1.0
- Critical9.8SQL Injection
Easy2Map Photos
≤1.0.9Update to 1.1.0
- Medium6.1Cross-Site Scripting
Encrypted Contact Form
<1.1Update to 1.1
- Medium6.5Directory Traversal
Easy2Map
<1.2.5Update to 1.2.5
- Critical9.8SQL Injection
NewStatPress
≤1.0.0Update to 1.0.1
- Critical9.8SQL Injection
Ultimate Product Catalog
<3.1.3Update to 3.1.3
- Critical9.8Directory Traversal
SE HTML5 Album Audio Player
≤1.1.0No patch available
- Critical9.8Local File Inclusion
Really Simple Guest Post
≤1.0.6Update to 1.0.7
- Critical9.8Local File Inclusion
ZM Ajax Login & Register
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
ZM Ajax Login & Register
≤1.0.9Update to 1.1.0
- Critical9.8Multiple SQL Injection
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
≤1.5.15Update to 1.5.16
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.5.7.1Update to 5.5.7.1
- High8.8Cross-Site Request Forgery to Remote Code Execution
Codestyling Localization
≤1.99.30No patch available
- Medium6.1Reflected Cross-Site Scripting
Simple Share Buttons Adder
<6.0.1Update to 6.0.1
- Critical9.8SQL Injection
LeagueManager
<4.0.5Update to 4.0.5
- Critical9.8Arbitrary File Upload
ZoomSounds - WordPress Wave Audio Player with Playlist
<3.0Update to 3.0
- Medium6.1Open Redirect
Wow Moodboard Lite
≤1.1.1.1No patch available
- Medium6.1Cross-Site Scripting
wp-smiley
≤1.4.1No patch available
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
wp-smiley
≤1.4.1No patch available
- High8.8SQL Injection
Simple Retail Menus
≤4.0.1Update to 4.1
- Critical9.8SQL Injection
WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress
<1.2Update to 1.2
- Critical9.8Local File Inclusion
Gmedia Photo Gallery
<1.6.5Update to 1.6.5
- Medium5.8Open Proxy
Gmedia Photo Gallery
<1.6.5Update to 1.6.5
- High8.8SQL Injection
GigPress
<2.3.9Update to 2.3.9
- High8.8Multiple Cross-Site Request Forgery
WP Fastest Cache – WordPress Cache Plugin
<0.8.3.5Update to 0.8.3.5