Database

Critical WordPress vulnerabilities (page 1361)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

Critical WordPress vulnerabilities (page 1361)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting WordPress Social Login≤2.1.5Update to 2.1.6	CVE-2014-4576	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting Movies≤0.6No patch available	CVE-2014-4539	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting Local Weather≤1.0No patch available	CVE-2014-4561	—	May 25, 2014
Medium6.1	Cross-Site Scripting proquoter≤1.0No patch available	CVE-2014-4545	—	May 25, 2014
Medium6.1	Cross-Site Scripting WP-Business Directory≤1.0.2No patch available	CVE-2014-4599	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting ooorl≤1.0.0No patch available	CVE-2014-4542	—	May 25, 2014
Critical9.8	Remote File Inclusion Podcasting Plugin by TSG≤3.0.4.1Update to 3.0.5	—	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting dsSearchAgent: WordPress Edition<1.0-beta10No patch available	CVE-2014-4522	—	May 25, 2014
Medium6.1	Cross-Site Scripting WP-Contact≤1.0No patch available	CVE-2014-4583	—	May 25, 2014
Medium6.1	Cross-Site Scripting GarageSale<1.2.3Update to 1.2.3	CVE-2014-4532	—	May 25, 2014
Medium6.1	Cross-Site Scripting Social Connect≤0.10.1Update to 0.10.2	CVE-2014-4551	—	May 25, 2014
Medium6.1	Cross-Site Scripting Import Legacy Media≤0.1No patch available	CVE-2014-4535	—	May 25, 2014
Medium6.1	Stored Cross-Site Scripting WP Ultimate Email Marketer≤1.1.0No patch available	CVE-2014-4600	—	May 25, 2014
Medium6.1	Cross-Site Scripting Style It≤1.0No patch available	CVE-2014-4555	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting HTML5 Video Player with Playlist≤2.4.0No patch available	CVE-2014-4534	—	May 25, 2014
Medium6.1	Cross-Site Scripting verwei.se – WordPress – Twitter≤1.0.2No patch available	CVE-2014-4566	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting Votecount For Balatarin≤0.1.1No patch available	CVE-2014-4572	—	May 25, 2014
Critical9.8	Remote File Inclusion µAudio Player≤0.6.2No patch available	—	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting WP-Planet≤0.1No patch available	CVE-2014-4592	—	May 25, 2014
Critical9.8	Remote File Inclusion pb-embedflash≤1.5.1No patch available	—	—	May 25, 2014
Medium6.1	Cross-Site Scripting WP-RSS-Spreadshirt-3DCube-Gallery≤1.3No patch available	CVE-2014-4553	—	May 25, 2014
Medium6.1	Multiple Cross-Site Scripting WP e-Commerce Swipe plugin≤3.1.0No patch available	CVE-2014-4559	—	May 25, 2014
Medium6.1	Cross-Site Scripting Conversion Ninjaall versionsNo patch available	CVE-2014-4017	—	May 22, 2014
High8.8	SQL Injection Pinpoint Booking System – Legacy version<1.3Update to 1.3	CVE-2014-3210	—	May 21, 2014
Medium6.1	3.9.001 - Cross-Site Scripting iMember360is3.8.012 – <3.9.002Update to 3.9.002	CVE-2014-3842	—	May 14, 2014
High8.8	Cross-Site Request Forgery Login rebuilder<1.2.0Update to 1.2.0	CVE-2014-3882	—	May 14, 2014
High8.8	Cross-Site Request Forgery Photo Gallery by 10Web – Mobile-Friendly Image Gallery<1.2.42Update to 1.2.42	CVE-2015-9380	—	May 7, 2014
Medium4.3	Cross-Site Request Forgery Search Everything<8.1.1Update to 8.1.1	CVE-2014-3843	—	May 6, 2014
Critical9.8	Authentication Bypass User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor<1.1.60Update to 1.1.60	—	—	May 6, 2014
Medium4.3	Cross-Site Request Forgery TinyMCE Color Picker<1.2Update to 1.2	CVE-2014-3845	—	May 1, 2014

Medium6.1
Cross-Site Scripting
WordPress Social Login
≤2.1.5Update to 2.1.6
CVE-2014-4576May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
Movies
≤0.6No patch available
CVE-2014-4539May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
Local Weather
≤1.0No patch available
CVE-2014-4561May 25, 2014
Medium6.1
Cross-Site Scripting
proquoter
≤1.0No patch available
CVE-2014-4545May 25, 2014
Medium6.1
Cross-Site Scripting
WP-Business Directory
≤1.0.2No patch available
CVE-2014-4599May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
ooorl
≤1.0.0No patch available
CVE-2014-4542May 25, 2014
Critical9.8
Remote File Inclusion
Podcasting Plugin by TSG
≤3.0.4.1Update to 3.0.5
13b4efa1-3f52-476c-80fe-b36ccb62a24bMay 25, 2014
Medium6.1
Reflected Cross-Site Scripting
dsSearchAgent: WordPress Edition
<1.0-beta10No patch available
CVE-2014-4522May 25, 2014
Medium6.1
Cross-Site Scripting
WP-Contact
≤1.0No patch available
CVE-2014-4583May 25, 2014
Medium6.1
Cross-Site Scripting
GarageSale
<1.2.3Update to 1.2.3
CVE-2014-4532May 25, 2014
Medium6.1
Cross-Site Scripting
Social Connect
≤0.10.1Update to 0.10.2
CVE-2014-4551May 25, 2014
Medium6.1
Cross-Site Scripting
Import Legacy Media
≤0.1No patch available
CVE-2014-4535May 25, 2014
Medium6.1
Stored Cross-Site Scripting
WP Ultimate Email Marketer
≤1.1.0No patch available
CVE-2014-4600May 25, 2014
Medium6.1
Cross-Site Scripting
Style It
≤1.0No patch available
CVE-2014-4555May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
HTML5 Video Player with Playlist
≤2.4.0No patch available
CVE-2014-4534May 25, 2014
Medium6.1
Cross-Site Scripting
verwei.se – WordPress – Twitter
≤1.0.2No patch available
CVE-2014-4566May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
Votecount For Balatarin
≤0.1.1No patch available
CVE-2014-4572May 25, 2014
Critical9.8
Remote File Inclusion
µAudio Player
≤0.6.2No patch available
634303eb-b120-4384-9780-b950de491099May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
WP-Planet
≤0.1No patch available
CVE-2014-4592May 25, 2014
Critical9.8
Remote File Inclusion
pb-embedflash
≤1.5.1No patch available
672edfd2-ca4b-4937-8237-3c0a4acc8690May 25, 2014
Medium6.1
Cross-Site Scripting
WP-RSS-Spreadshirt-3DCube-Gallery
≤1.3No patch available
CVE-2014-4553May 25, 2014
Medium6.1
Multiple Cross-Site Scripting
WP e-Commerce Swipe plugin
≤3.1.0No patch available
CVE-2014-4559May 25, 2014
Medium6.1
Cross-Site Scripting
Conversion Ninja
all versionsNo patch available
CVE-2014-4017May 22, 2014
High8.8
SQL Injection
Pinpoint Booking System – Legacy version
<1.3Update to 1.3
CVE-2014-3210May 21, 2014
Medium6.1
3.9.001 - Cross-Site Scripting
iMember360is
3.8.012 – <3.9.002Update to 3.9.002
CVE-2014-3842May 14, 2014
High8.8
Cross-Site Request Forgery
Login rebuilder
<1.2.0Update to 1.2.0
CVE-2014-3882May 14, 2014
High8.8
Cross-Site Request Forgery
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.2.42Update to 1.2.42
CVE-2015-9380May 7, 2014
Medium4.3
Cross-Site Request Forgery
Search Everything
<8.1.1Update to 8.1.1
CVE-2014-3843May 6, 2014
Critical9.8
Authentication Bypass
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<1.1.60Update to 1.1.60
c62d8146-e4b1-4c86-9d8a-c3a9bbfb0763May 6, 2014
Medium4.3
Cross-Site Request Forgery
TinyMCE Color Picker
<1.2Update to 1.2
CVE-2014-3845May 1, 2014