Database
Critical WordPress vulnerabilities (page 1364)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.1 | SQL Injection | CVE-2014-2316 | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-1906 | — | |
| Medium6.5 | Authorization Bypass | CVE-2014-1889 | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2014-2040 | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100016 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-125090 | — | |
| Medium6.1 | Open Redirect | CVE-2014-1750 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2012-6629 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-100026 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4563 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-1232 | — | |
| High7.5 | Directory Traversal | CVE-2013-7240 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6991 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-6992 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7276 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7279 | — | |
| Critical9.1 | Arbitrary File Deletion | — | — | |
| High8.8 | Cross-Site Request Forgery to Denial of Service | CVE-2013-7233 | — | |
| Critical9.1 | Arbitrary File Download | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6993 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2013-7319 | — | |
| Critical9.8 | SQL Injection | CVE-2013-7187 | — | |
| Critical9.8 | Local File Inclusion | — | — | |
| Critical9.8 | SQL Injection | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7129 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-7419 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-7102 | — |
- Critical9.1SQL Injection
Search Everything
<7.0.3Update to 7.0.3
- Critical9.8Arbitrary File Upload
kiddo
all versionsNo patch available
- High7.1Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
- Medium6.5Authorization Bypass
BuddyPress
<1.9.2Update to 1.9.2
- Critical9.8Arbitrary File Upload
Dendelion
≤2.6.5Update to 2.6.6
- Medium6.4Stored Cross-Site Scripting
Media File Renamer: Rename Images & Files for SEO (AI-Powered)
<1.9.4Update to 1.9.4
- Critical9.8Arbitrary File Upload
amerisale-re
all versionsNo patch available
- Medium6.1Cross-Site Scripting
Photocrati
≤4.8.0Update to 4.8.1
- Medium6.1Reflected Cross-Site Scripting
Media Downloader
≤0.1.992Update to 0.1.993
- Medium6.1Open Redirect
Nokia Maps & Places
<1.6.7Update to 1.6.7
- High8.8Cross-Site Request Forgery
Newsletter Manager
<1.4Update to 1.4
- Medium6.1Reflected Cross-Site Scripting
April's Super Functions Pack
≤1.4.7Update to 1.4.8
- Medium6.1Cross-Site Scripting
URL Cloak & Encrypt
<3.8.0Update to 3.8.0
- Medium6.1Cross-Site Scripting
Foliopress WYSIWYG
<2.6.8.5Update to 2.6.8.5
- High7.5Directory Traversal
Advanced Dewplayer
≤1.2Update to 1.3
- Medium6.1Cross-Site Scripting
WP-Cron Dashboard
<1.1.6Update to 1.1.6
- High8.8Cross-Site Request Forgery
AskApache Firefox Adsense
≤3.0No patch available
- Medium6.1Cross-Site Scripting
Recommend to a friend
≤2.2.2No patch available
- Medium6.1Cross-Site Scripting
S3 Video Plugin
≤0.982Update to 0.983
- Critical9.1Arbitrary File Deletion
Method
≤2.1Update to 2.2
- High8.8Cross-Site Request Forgery to Denial of Service
WordPress
≤2.0.11Update to 2.1
- Critical9.1Arbitrary File Download
DejaVu
≤2.4Update to 2.5
- Medium6.1Cross-Site Scripting
ad-minister
≤0.6No patch available
- High7.2Stored Cross-Site Scripting
Download Manager
≤2.5.8Update to 2.5.9
- Critical9.8SQL Injection
FormCraft
≤1.3.7Update to 1.3.8
- Critical9.8Local File Inclusion
Spicy Blogroll
≤1.0.0No patch available
- Critical9.8SQL Injection
Easy Career Openings
≤0.4No patch available
- Medium6.1Cross-Site Scripting
Bloog
≤1.1Update to 1.2
- Medium6.1Reflected Cross-Site Scripting
JS Multi Hotel
≤2.2.1No patch available
- Critical9.8Arbitrary File Upload
OptimizePress
<1.6Update to 1.6