Database
Critical WordPress vulnerabilities (page 1360)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2014-4939 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4524 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4597 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4514 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4520 | — | |
| High7.5 | Path Traversal | CVE-2014-4937 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2014-4526 | — | |
| High7.5 | Directory Traversal | CVE-2014-4940 | — | |
| High7.2 | SQL Injection | CVE-2014-5184 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4554 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4527 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4574 | — | |
| Medium5.3 | Directory Traversal | CVE-2014-5181 | — | |
| Critical9.1 | Authenticated (Admin+) SQL Injection | CVE-2014-5180 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4547 | — | |
| High7.2 | Authenticated SQL Injection | CVE-2014-5186 | — | |
| High7.5 | Server-Side Request Forgery | CVE-2014-9292 | — | |
| Critical9.8 | Remote File Inclusion | — | — | |
| Medium6.1 | CBI Referral Manager <= 1.2.1 Cross-Site Scripting | CVE-2014-4517 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4583 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4555 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4522 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4576 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4542 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4545 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4521 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4536 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4606 | — | |
| Critical9.8 | Remote Media File Inclusion | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4543 | — |
- High7.2Authenticated (Admin+) SQL Injection
ENL Newsletter
≤1.0.1No patch available
- Medium6.1Cross-Site Scripting
WP Easy Post Types
<1.4.4Update to 1.4.4
- Medium6.1Reflected Cross-Site Scripting
WordPress Social Invitations – Lite
≤1.4.4.2Update to 1.4.4.3
- Medium6.1Cross-Site Scripting
WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
<3.7.0Update to 3.7.0
- Medium6.1Cross-Site Scripting
DMCA WaterMarker
<1.1Update to 1.1
- High7.5Path Traversal
BookX
≤1.7No patch available
- Medium6.1Multiple Cross-Site Scripting
efence
≤1.3.2No patch available
- High7.5Directory Traversal
Tera Charts
≤0.1Update to 1.0
- High7.2SQL Injection
stripshow
≤2.5.2No patch available
- Medium6.1Cross-Site Scripting
SS Downloads
≤1.4.4.1Update to 1.5
- Medium6.1Cross-Site Scripting
EnvíaloSimple: Email Marketing y Newsletters
≤1.97Update to 1.98
- Medium6.1Cross-Site Scripting
WebEngage Feedback, Survey and Notification
<2.0.1Update to 2.0.1
- Medium5.3Directory Traversal
lastfm-rotation
≤1.0No patch available
- Critical9.1Authenticated (Admin+) SQL Injection
HDW Player Plugin (Video Player & Video Gallery)
≤2.4.2Update to 3.0
- Medium6.1Cross-Site Scripting
Rezgo Online Booking
<1.8.2Update to 1.8.2
- High7.2Authenticated SQL Injection
All Video Gallery Plugin for WordPress
≤1.2No patch available
- High7.5Server-Side Request Forgery
jRSS Widget
≤1.2No patch available
- Critical9.8Remote File Inclusion
Podcasting Plugin by TSG
≤3.0.4.1Update to 3.0.5
- Medium6.1CBI Referral Manager <= 1.2.1 Cross-Site Scripting
CBI Referral Manager
≤1.2.1No patch available
- Medium6.1Cross-Site Scripting
WP-Contact
≤1.0No patch available
- Medium6.1Cross-Site Scripting
Style It
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
dsSearchAgent: WordPress Edition
<1.0-beta10No patch available
- Medium6.1Cross-Site Scripting
WordPress Social Login
≤2.1.5Update to 2.1.6
- Medium6.1Reflected Cross-Site Scripting
ooorl
≤1.0.0No patch available
- Medium6.1Cross-Site Scripting
proquoter
≤1.0No patch available
- Medium6.1Cross-Site Scripting
Diverse Solutions IDX Real Estate Listings & MLS Search
<2.1.1Update to 2.1.1
- Medium6.1Cross-Site Scripting
Infusionsoft Gravity Forms Add-on
<1.5.7Update to 1.5.7
- Medium6.1Cross-Site Scripting
zeenshare
≤1.0.1No patch available
- Critical9.8Remote Media File Inclusion
wp-lightpop
≤0.8.5.6No patch available
- Medium6.1Cross-Site Scripting
Pay Per Media Player
≤1.24No patch available