Database

Critical WordPress vulnerabilities (page 1363)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

Critical WordPress vulnerabilities (page 1363)
Severity	Vulnerability	CVE	Installs	Published
Critical9.8	Local File Inclusion Ajax Pagination (twitter Style)≤1.1No patch available	CVE-2014-2674	—	Mar 28, 2014
High8.8	Cross-Site Request Forgery GD Star Rating≤1.9.22No patch available	CVE-2014-2838	—	Mar 28, 2014
High7.2	Blind SQL Injection GD Star Rating≤1.9.22No patch available	CVE-2014-2839	—	Mar 28, 2014
Critical9.8	SQL Injection Leaflet Maps Marker Pro<1.5.8Update to 1.5.8	—	—	Mar 27, 2014
Critical9.8	Arbitrary File Upload Leaflet Maps Marker Pro<1.5.8Update to 1.5.8	—	—	Mar 27, 2014
Critical9.8	Arbitrary File Upload Leaflet Maps Marker Pro<1.5.8Update to 1.5.8	—	—	Mar 26, 2014
Critical9.8	Arbitrary File Upload Custom Background≤3.2.2.67929No patch available	—	—	Mar 23, 2014
Critical9.8	Arbitrary File Upload appius<1.1Update to 1.1	—	—	Mar 23, 2014
Critical9.8	Arbitrary File Upload Felici - WordPress Magazine Theme \| Blog / Magazineall versionsNo patch available	—	—	Mar 22, 2014
Critical9.8	Arbitrary File Upload Vithyall versionsNo patch available	—	—	Mar 22, 2014
Critical9.8	SQL Injection Contextual Related Posts<1.8.10.2Update to 1.8.10.2	CVE-2014-3937	—	Mar 6, 2014
Critical9.8	Arbitrary File Upload Premium Gallery Managerall versionsNo patch available	—	—	Mar 6, 2014
Critical9.8	Arbitrary File Upload barclaycartall versionsNo patch available	—	—	Mar 5, 2014
Critical9.8	SQL Injection Welcart e-Commerce≤2.9.1Update to 2.9.2	CVE-2014-10017	—	Mar 4, 2014
Medium6.1	Cross-Site Scripting Welcart e-Commerce≤2.11.1Update to 2.11.2	CVE-2014-10016	—	Mar 3, 2014
Critical9.8	Arbitrary File Upload thecotton≤1.14No patch available	—	—	Mar 3, 2014
Critical9.8	Arbitrary File Upload Sixteesall versionsNo patch available	—	—	Mar 1, 2014
Critical9.8	Arbitrary File Upload Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP≤4.27.4Update to 4.29.5	CVE-2014-1905	—	Feb 27, 2014
Medium5.3	Full Path Disclosure Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP<4.29.5Update to 4.29.5	CVE-2014-1908	—	Feb 27, 2014
Critical9.8	Arbitrary File Read/Deletion Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP<4.29.5Update to 4.29.5	CVE-2014-1907	—	Feb 27, 2014
Medium6.1	Cross-Site Scripting mTouch Quiz<3.0.7Update to 3.0.7	CVE-2014-100023	—	Feb 26, 2014
Medium6.1	Cross-Site Scripting Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP≤4.29.6Update to 4.29.9	CVE-2014-2297	—	Feb 26, 2014
Critical9.8	SQL Injection mTouch Quiz<3.0.7Update to 3.0.7	CVE-2014-100022	—	Feb 26, 2014
Medium5.3	CAPTCHA Bypass Contact Form 7<3.7.2Update to 3.7.2	CVE-2014-2265	—	Feb 26, 2014
Critical9.8	SQL Injection Relevanssi – A Better Search≤3.3Update to 3.3.1	—	—	Feb 25, 2014
Medium6.1	Cross-Site Scripting Thank You Counter Button≤1.9.3No patch available	CVE-2014-2315	—	Feb 25, 2014
Critical9.8	3.9.4 - SQL Injection AdRotate Banner Manager3.9 – 3.9.4Update to 3.9.5	CVE-2014-1854	—	Feb 22, 2014
High8.8	Cross-Site Request Forgery User Domain Whitelist<1.5Update to 1.5	CVE-2014-10381	—	Feb 22, 2014
High8.8	Cross-Site Request Forgery to Cross-Site Scripting Subscribe To Comments Reloaded≤140129Update to 140219	CVE-2014-2274	—	Feb 18, 2014
High7.1	Cross-Site Scripting Nextend Social Login and Register<1.5.1Update to 1.5.1	CVE-2014-8800	—	Feb 12, 2014

Critical9.8
Local File Inclusion
Ajax Pagination (twitter Style)
≤1.1No patch available
CVE-2014-2674Mar 28, 2014
High8.8
Cross-Site Request Forgery
GD Star Rating
≤1.9.22No patch available
CVE-2014-2838Mar 28, 2014
High7.2
Blind SQL Injection
GD Star Rating
≤1.9.22No patch available
CVE-2014-2839Mar 28, 2014
Critical9.8
SQL Injection
Leaflet Maps Marker Pro
<1.5.8Update to 1.5.8
11349bc4-b432-4225-82a4-30bc9d0057f9Mar 27, 2014
Critical9.8
Arbitrary File Upload
Leaflet Maps Marker Pro
<1.5.8Update to 1.5.8
da95e282-54b9-4296-99f3-9187c04dcaacMar 27, 2014
Critical9.8
Arbitrary File Upload
Leaflet Maps Marker Pro
<1.5.8Update to 1.5.8
66969472-4b3c-4d56-b761-523ea854e3dbMar 26, 2014
Critical9.8
Arbitrary File Upload
Custom Background
≤3.2.2.67929No patch available
b65cdbe0-e258-4bb5-9a36-cbf57b75ce77Mar 23, 2014
Critical9.8
Arbitrary File Upload
appius
<1.1Update to 1.1
efbea599-3d04-42d2-9b91-6b68210d8b01Mar 23, 2014
Critical9.8
Arbitrary File Upload
Felici - WordPress Magazine Theme | Blog / Magazine
all versionsNo patch available
7a44873c-5f14-4ff5-85ed-a6575aaa9347Mar 22, 2014
Critical9.8
Arbitrary File Upload
Vithy
all versionsNo patch available
20077e55-fe75-49c7-ba3f-ccd683a3f722Mar 22, 2014
Critical9.8
SQL Injection
Contextual Related Posts
<1.8.10.2Update to 1.8.10.2
CVE-2014-3937Mar 6, 2014
Critical9.8
Arbitrary File Upload
Premium Gallery Manager
all versionsNo patch available
c274a9b2-c95e-4898-afa4-d6e2f6006f91Mar 6, 2014
Critical9.8
Arbitrary File Upload
barclaycart
all versionsNo patch available
d84ad258-8a0c-44b2-9897-03ad214e8493Mar 5, 2014
Critical9.8
SQL Injection
Welcart e-Commerce
≤2.9.1Update to 2.9.2
CVE-2014-10017Mar 4, 2014
Medium6.1
Cross-Site Scripting
Welcart e-Commerce
≤2.11.1Update to 2.11.2
CVE-2014-10016Mar 3, 2014
Critical9.8
Arbitrary File Upload
thecotton
≤1.14No patch available
bb979c91-6795-4365-a61b-2cf67a9c8223Mar 3, 2014
Critical9.8
Arbitrary File Upload
Sixtees
all versionsNo patch available
3a325371-e531-4cd9-bc39-d1b8f40a728fMar 1, 2014
Critical9.8
Arbitrary File Upload
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤4.27.4Update to 4.29.5
CVE-2014-1905Feb 27, 2014
Medium5.3
Full Path Disclosure
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
CVE-2014-1908Feb 27, 2014
Critical9.8
Arbitrary File Read/Deletion
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
CVE-2014-1907Feb 27, 2014
Medium6.1
Cross-Site Scripting
mTouch Quiz
<3.0.7Update to 3.0.7
CVE-2014-100023Feb 26, 2014
Medium6.1
Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤4.29.6Update to 4.29.9
CVE-2014-2297Feb 26, 2014
Critical9.8
SQL Injection
mTouch Quiz
<3.0.7Update to 3.0.7
CVE-2014-100022Feb 26, 2014
Medium5.3
CAPTCHA Bypass
Contact Form 7
<3.7.2Update to 3.7.2
CVE-2014-2265Feb 26, 2014
Critical9.8
SQL Injection
Relevanssi – A Better Search
≤3.3Update to 3.3.1
4b8d057b-1909-46d4-8e0a-d5c7c9f7001cFeb 25, 2014
Medium6.1
Cross-Site Scripting
Thank You Counter Button
≤1.9.3No patch available
CVE-2014-2315Feb 25, 2014
Critical9.8
3.9.4 - SQL Injection
AdRotate Banner Manager
3.9 – 3.9.4Update to 3.9.5
CVE-2014-1854Feb 22, 2014
High8.8
Cross-Site Request Forgery
User Domain Whitelist
<1.5Update to 1.5
CVE-2014-10381Feb 22, 2014
High8.8
Cross-Site Request Forgery to Cross-Site Scripting
Subscribe To Comments Reloaded
≤140129Update to 140219
CVE-2014-2274Feb 18, 2014
High7.1
Cross-Site Scripting
Nextend Social Login and Register
<1.5.1Update to 1.5.1
CVE-2014-8800Feb 12, 2014