Database
Critical WordPress vulnerabilities (page 1343)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2015-9531 | — | |
| Medium6.1 | Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting | CVE-2015-9510 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9522 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9526 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9378 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9372 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9516 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9366 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9525 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9506 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9535 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9517 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9364 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9536 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9523 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9377 | — | |
| Critical9.8 | SQL Injection | CVE-2015-3314 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9368 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9373 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9524 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9527 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9520 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9294 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9515 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9513 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9532 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-10110 | — | |
| Critical9.8 | SQL Injection | — | — | |
| High7.5 | Missing Access Controls | CVE-2015-9337 | — | |
| Medium5.3 | Cross-Site Scripting | CVE-2014-4518 | — |
- Medium6.1Cross-Site Scripting
Easy Digital Downloads - Wish Lists
≤1.1Update to 1.1.1
- Medium6.1Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting
Easy Digital Downloads - Cross-Sell and Upsell
≤1.1.2Update to 1.1.3
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads - QR Codes
≤1.1.0Update to 1.1.1
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads - Product Reviews
≤1.3.8Update to 1.3.10
- Medium6.1Reflected Cross-Site Scripting
Market
<5.1.27Update to 5.1.27
- Medium6.1Reflected Cross-Site Scripting
Exchange Addon Membership
<1.3.0Update to 1.3.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Invoices
≤1.0.3Update to 1.0.4
- Medium6.1Reflected Cross-Site Scripting
Exchange Addon Custom URL Tracking
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads - Recurring Payments
≤2.3Update to 2.3.1
- Medium6.1Cross-Site Scripting
Easy Digital Downloads - Amazon S3
≤2.1.3Update to 2.1.4
- Medium6.1Cross-Site Scripting
Shoppette
<1.0.5Update to 1.0.5
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads – Manual Purchases
<1.9.1Update to 1.9.1
- Medium6.1Reflected Cross-Site Scripting
2Checkout Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
Twenty Twelve EDD
≤1.1Update to 1.1.1
- Medium6.1Cross-Site Scripting
Recommended Products - EDD
≤1.2.3.2Update to 1.2.3.3
- Medium6.1Reflected Cross-Site Scripting
BuilderChild-Depot
<5.0.30Update to 5.0.30
- Critical9.8SQL Injection
Tune Library
<1.5.5Update to 1.5.5
- Medium6.1Reflected Cross-Site Scripting
Easy EU Value Added (VAT) Taxes Add-on
<1.2.0Update to 1.2.0
- Medium6.1Cross-Site Scripting
PayPal Pro Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Recount Earnings
<2.3.7Update to 2.3.7
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Simple Shipping
≤2.1.3Update to 2.1.4
- Medium6.1Cross-Site Scripting
Easy Digital Downloads – Per Product Emails
<1.0.9Update to 1.0.9
- Medium6.1Reflected Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<3.9.5Update to 3.9.5
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads – htaccess Editor
1.0.0 – 1.0.0Update to 1.0.1
- Medium6.1Cross-Site Scripting
EDD Favorites
≤1.0.6Update to 1.0.7
- Medium6.1Cross-Site Scripting
Easy Digital Downloads (EDD) Digital Store
<1.3.3Update to 1.3.3
- Medium6.1Reflected Cross-Site Scripting
TinyChat Room Spy
≤1.2.8Update to 1.2.9
- Critical9.8SQL Injection
AJAX Store Locator
≤1.2No patch available
- High7.5Missing Access Controls
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤2.1.3Update to 2.1.4
- Medium5.3Cross-Site Scripting
Contact Form by ContactMe.com
≤2.3No patch available