Database
Critical WordPress vulnerabilities (page 1359)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4548 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4580 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4590 | — | |
| Medium4.3 | Cross-Site Request Forgery leading to player deletion | CVE-2014-4030 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3850 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-4163 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-5345 | — | |
| Critical9.8 | SQL Injection | CVE-2014-3961 | — | |
| High7.2 | Cross-Site Scripting | CVE-2014-3921 | — | |
| High7.5 | Path Traversal | CVE-2014-4941 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4513 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4541 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2014-4523 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4544 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2014-4942 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4605 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4528 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4554 | — | |
| High7.2 | Authenticated SQL Injection | CVE-2014-5186 | — | |
| Medium5.3 | Directory Traversal | CVE-2014-5181 | — | |
| High7.5 | Server-Side Request Forgery | CVE-2014-9292 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4547 | — | |
| Critical9.1 | Authenticated (Admin+) SQL Injection | CVE-2014-5180 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4574 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4527 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4597 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4514 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2014-5182 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4520 | — | |
| High7.5 | Directory Traversal | CVE-2014-4940 | — |
- Medium6.1Reflected Cross-Site Scripting
Ruven Toolkit
≤2.0No patch available
- Medium6.1Cross-Site Scripting
WP BlipBot
≤3.0.9No patch available
- High7.1Cross-Site Scripting
WP Microblogs
≤0.4.0No patch available
- Medium4.3Cross-Site Request Forgery leading to player deletion
JW Player for Flash & HTML5 Video
<2.1.4Update to 2.1.4
- Medium6.1Cross-Site Scripting
Member Approval
≤131109No patch available
- High8.8Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
- Medium6.1Reflected Cross-Site Scripting
Disqus Comment System
<2.76Update to 2.76
- Critical9.8SQL Injection
Participants Database
<1.5.4.9Update to 1.5.4.9
- High7.2Cross-Site Scripting
simple-popup-images
≤1.0Update to 1.1
- High7.5Path Traversal
Cross-RSS
≤1.7No patch available
- Medium6.1Reflected Cross-Site Scripting
ActiveHelper LiveHelp Live Chat
<3.1.5Update to 3.1.5
- Medium6.1Cross-Site Scripting
OMFG Mobile Pro
≤1.1.26No patch available
- Medium6.1Unauthenticated Cross-Site Scripting
Easy Career Openings
≤0.4No patch available
- Medium6.1Cross-Site Scripting
Podcast Channels
<0.21Update to 0.21
- Medium5.3Sensitive Information Disclosure
WP EasyCart: Shopping Cart and eCommerce Store
≤2.0.5Update to 2.0.6
- Medium6.1Cross-Site Scripting
ZdStatistics
≤2.0.1No patch available
- Medium6.1Cross-Site Scripting
Bugs Go Viral : Facebook Promotion Generator
≤1.3.4No patch available
- Medium6.1Cross-Site Scripting
SS Downloads
≤1.4.4.1Update to 1.5
- High7.2Authenticated SQL Injection
All Video Gallery Plugin for WordPress
≤1.2No patch available
- Medium5.3Directory Traversal
lastfm-rotation
≤1.0No patch available
- High7.5Server-Side Request Forgery
jRSS Widget
≤1.2No patch available
- Medium6.1Cross-Site Scripting
Rezgo Online Booking
<1.8.2Update to 1.8.2
- Critical9.1Authenticated (Admin+) SQL Injection
HDW Player Plugin (Video Player & Video Gallery)
≤2.4.2Update to 3.0
- Medium6.1Cross-Site Scripting
WebEngage Feedback, Survey and Notification
<2.0.1Update to 2.0.1
- Medium6.1Cross-Site Scripting
EnvíaloSimple: Email Marketing y Newsletters
≤1.97Update to 1.98
- Medium6.1Reflected Cross-Site Scripting
WordPress Social Invitations – Lite
≤1.4.4.2Update to 1.4.4.3
- Medium6.1Cross-Site Scripting
WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
<3.7.0Update to 3.7.0
- High8.8Authenticated SQL Injection
YAWPP (Yet Another WordPress Petition Plugin)
≤1.2.1Update to 1.2.2
- Medium6.1Cross-Site Scripting
DMCA WaterMarker
<1.1Update to 1.1
- High7.5Directory Traversal
Tera Charts
≤0.1Update to 1.0