Database
Critical WordPress vulnerabilities (page 1342)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Quota < 1.2.5 - Cross-Site Scripting | CVE-2015-9534 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9370 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9528 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9376 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-10013 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9518 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9296 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9533 | — | |
| Medium5.4 | Cross-Site Scripting via Ephox in Plupload | CVE-2015-3439 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9507 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9375 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9367 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9374 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9359 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9363 | — | |
| Medium6.1 | Cross-Site Scripting Easy Digital Downloads – eCommerce Payments and Subscriptions made easy≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7 | CVE-2015-9512 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9532 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9520 | — | |
| Medium5.3 | Reflected Cross Site Scripting | CVE-2015-10098 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9513 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9524 | — | |
| Critical9.8 | SQL Injection | CVE-2015-3314 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9356 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9362 | — | |
| Critical9.8 | SQL Injection | CVE-2015-3313 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9529 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9365 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9368 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9511 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9519 | — |
- Medium6.1Quota < 1.2.5 - Cross-Site Scripting
Easy Digital Downloads - Quota
<1.2.5Update to 1.2.5
- Medium6.1Reflected Cross-Site Scripting
Exchange Addon Invoices
<1.4.0Update to 1.4.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Software Licensing
<3.2.3Update to 3.2.3
- Medium6.1Reflected Cross-Site Scripting
Mobile
<1.2.8Update to 1.2.8
- Medium6.1Reflected Cross-Site Scripting
Taxonomy Switcher
≤1.0.3Update to 1.0.4
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Invoices
<1.0.4Update to 1.0.4
- Medium6.1Reflected Cross-Site Scripting
Download Monitor
<1.7.1Update to 1.7.1
- Medium6.1Cross-Site Scripting
Lattice
<1.1.5Update to 1.1.5
- Medium5.4Cross-Site Scripting via Ephox in Plupload
WordPress
≤4.1.1Update to 3.7.6 or 3.8.6 or 3.9.4 or 4.0.2 or 4.1.2
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads – Attach Accounts to Orders
≤2.0.1Update to 2.0.2
- Medium6.1Cross-Site Scripting
exchange-addon-table-rate-shipping
<1.1.0Update to 1.1.0
- Medium6.1Reflected Cross-Site Scripting
Easy Canadian Sales Taxes Add-On for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Reflected Cross-Site Scripting
Stripe Add-on for iThemes Exchange
<1.2.0Update to 1.2.0
- Medium6.1Reflected Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<3.4.3Update to 3.4.3
- Medium6.1Cross-Site Scripting
ithemes-exchange
<1.12.0Update to 1.12.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
- Medium6.1Cross-Site Scripting
Easy Digital Downloads (EDD) Digital Store
<1.3.3Update to 1.3.3
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Per Product Emails
<1.0.9Update to 1.0.9
- Medium5.3Reflected Cross Site Scripting
Broken Link Checker
<1.10.6Update to 1.10.6
- Medium6.1Cross-Site Scripting
EDD Favorites
≤1.0.6Update to 1.0.7
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Recount Earnings
<2.3.7Update to 2.3.7
- Critical9.8SQL Injection
Tune Library
<1.5.5Update to 1.5.5
- Medium6.1Cross-Site Scripting
WP-ViperGB
<1.3.16Update to 1.3.16
- Medium6.1Reflected Cross-Site Scripting
Post Connector
<1.0.4Update to 1.0.4
- Critical9.8SQL Injection
Community Events
≤1.3Update to 1.4
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads (EDD) Stripe
≤2.1.2Update to 2.1.3
- Medium6.1Reflected Cross-Site Scripting
Authorize.net Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Reflected Cross-Site Scripting
Easy EU Value Added (VAT) Taxes Add-on
<1.2.0Update to 1.2.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Conditional Success Redirects
<1.1.1Update to 1.1.1
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – PDF stamper
≤1.0No patch available