VulnCrest
Search
Create account
Report an incident
Radar sectionsCritical
Check my site

Database

Critical WordPress vulnerabilities (page 1354)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

Signals
Software

41,564 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

Critical WordPress vulnerabilities (page 1354)
SeverityVulnerabilityCVEInstallsPublished
Medium6.3Cross-Site Request Forgery
Iptanus File Upload<2.4.2Update to 2.4.2
CVE-2014-5199—
Medium6.5Unauthenticated Stored Cross-Site Scripting
Job Board by BestWebSoft≤1.0.0Update to 1.0.1
CVE-2014-125100—
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
BestWebSoft's Twitter≤1.3.2Update to 1.3.7
CVE-2014-125103—
High7.2Unauthenticated Stored Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress≤3.81Update to 3.82
CVE-2014-125095—
High7.1Reflected Cross-Site Scripting
SI Captcha Anti-spam<2.7.6Update to 2.7.6
CVE-2014-5190—
Medium6.1Open Redirect
Feed Statistics<4.0Update to 4.0
CVE-2018-17074—
High8.8Cross-Site Request Forgery to Authentication Takeover
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-9033—
Medium5.3XML External Entity (XXE) Weakness
WordPress<3.9.2Update to 3.9.2
CVE-2014-2053—
Low2.7Denial of Service via XML
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5265—
High8.8Cross-Site Request Forgery Protection Bypass
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5204—
Medium6.1Cross-Site Scripting
WordPress Spreadsheet≤0.62No patch available
CVE-2014-8364—
High7.2Deserialization via Widgets
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5203—
Critical9.8SQL Injection
WordPress Spreadsheet≤0.62No patch available
CVE-2014-8363—
Low3.8Authenticated Cross-Site Scripting via Avatar URL
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5240—
Medium6.5Brute Force of Cross-Site Request Forgery Tokens
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5205—
Medium6.5Denial of Service via XML #2
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5266—
Critical9.8Arbitrary File Upload
Gmedia Photo Gallery<1.2.2Update to 1.2.2
——
Critical9.8Cross-Site Request Forgery to SQL Injection
WordPress Automatic Plugin≤2.0.3Update to 2.0.4
——
Critical9.8SQL Injection
Yoast Duplicate Post≤2.5Update to 2.6
CVE-2014-10379—
Critical9.8SQL Injection
Global Flash Gallery≤0.15.1Update to 0.15.2
——
Medium6.1Cross-Site Scripting
Events Manager Pro<2.2.9Update to 2.2.9
CVE-2013-1407—
Medium6.3Cross-Site Request Forgery
Cart66 Lite :: WordPress Ecommerce<1.5.1.15Update to 1.5.1.15
CVE-2013-5977—
Critical9.9Authenticated SQL Injection
BSK PDF Manager<1.5Update to 1.5
CVE-2014-4944—
High8.8Remote Code Execution
WP Super Cache≤1.2Update to 1.3
CVE-2013-2009—
High7.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Quick Page/Post Redirect Plugin<5.0.5Update to 5.0.5
CVE-2014-2598—
Critical9.8Arbitrary File Upload
Uploader≤1.0.4No patch available
——
Critical9.8SQL Injection
myftp-ftp-like-plugin-for-wordpress≤1.1No patch available
——
Medium6.1Cross-Site Scripting
wp-media-player≤0.8No patch available
CVE-2014-4589—
Medium6.1Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More≤0.4.4Update to 0.4.5
CVE-2013-46251M+
Critical9.8Arbitrary File Upload
WordPress Font Uploader≤1.3Update to 1.3.1
CVE-2012-3814—

Search VulnCrest Radar

Jump to

Are you sure?