Database

Critical WordPress vulnerabilities (page 1365)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

Critical WordPress vulnerabilities (page 1365)
Severity	Vulnerability	CVE	Installs	Published
Critical9.8	Arbitrary File Upload iThemes2<1.4.3Update to 1.4.3	—	—	Nov 13, 2013
Critical9.8	Arbitrary File Upload Elemin<1.4.3Update to 1.4.3	CVE-2013-20002	—	Nov 13, 2013
Critical9.8	Premium WordPress Blog & Magazine Theme \| News / Editorial (All Versions) - Arbitrary File Upload Kernel - Premium WordPress Blog & Magazine Theme \| News / Editorialall versionsNo patch available	—	—	Nov 6, 2013
Critical9.8	Arbitrary File Upload Anthology≤1.4.4Update to 1.4.5	—	—	Nov 4, 2013
Critical9.8	Arbitrary File Upload Magnitudo - Powerful Business Themeall versionsNo patch available	—	—	Nov 4, 2013
Critical9.8	Arbitrary File Upload Amoveo Multipurpose Wordpress Theme≤2.0No patch available	—	—	Nov 2, 2013
Critical9.8	Arbitrary File Uploads chameleon<3.9Update to 3.9	—	—	Nov 2, 2013
Critical9.8	Arbitrary File Upload Think Responsive≤1.0No patch available	—	—	Nov 1, 2013
Critical9.8	Arbitrary File Upload ThisWay≤1.7.0No patch available	—	—	Nov 1, 2013
Critical9.8	Powerful WordPress Theme <= 1.3.2 - Arbitrary File Upload switchblade≤1.3.2No patch available	—	—	Nov 1, 2013
Critical9.8	Arbitrary File Upload coldfusion<1.2Update to 1.2	—	—	Oct 31, 2013
Critical9.8	Arbitrary File Upload Right Nowall versionsNo patch available	—	—	Oct 31, 2013
Critical9.8	Arbitrary File Upload WordPress Checkoutall versionsNo patch available	—	—	Oct 31, 2013
Critical9.8	Arbitrary File Upload MoneyThemeall versionsNo patch available	—	—	Oct 29, 2013
Critical9.8	Arbitrary File Upload Ghostall versionsNo patch available	—	—	Oct 29, 2013
Critical9.8	Cross-Site Request Forgery and Arbitrary File Upload curvoall versionsNo patch available	—	—	Oct 27, 2013
Critical9.8	Arbitrary File Upload Geo Places 4 Theme beta≤4betaUpdate to 5	—	—	Oct 24, 2013
Critical9.8	Arbitrary File Upload saico≤1.0.2No patch available	—	—	Oct 24, 2013
Critical9.1	Authentication Bypass Portable phpMyAdmin≤1.5.0No patch available	CVE-2013-4462	—	Oct 24, 2013
High7.1	Cross-Site Request Forgery and to Cross-Site Scripting Blue Wrench Video Widget≤1.0.5Update to 2.0.0	CVE-2013-6797	—	Oct 23, 2013
Critical9.8	Arbitrary File Upload Daily Deal by Templatic≤2.2.4No patch available	—	—	Oct 23, 2013
Critical9.8	Local File Inclusion Payment Gateways Caller for WP e-Commerce<0.1.1Update to 0.1.1	—	—	Oct 23, 2013
Critical9.8	Arbitrary File Upload WPLocalPlacesall versionsNo patch available	—	—	Oct 20, 2013
Critical9.8	Arbitrary File Upload AREA53≤1.0.5No patch available	—	—	Oct 19, 2013
Medium6.1	Cross-Site Scripting dhtmlxspreadsheet≤2.0No patch available	CVE-2013-6281	—	Oct 18, 2013
High8.8	Cross-Site Request Forgery Social Sharing Toolkit≤2.1.1Update to 2.1.2	CVE-2013-2701	—	Oct 17, 2013
Medium6.1	Cross-Site Scripting Cart66 Lite :: WordPress Ecommerce<1.5.1.15Update to 1.5.1.15	CVE-2013-5978	—	Oct 11, 2013
Critical9.8	SQL Injection WordPress Landing Pages<1.2.3Update to 1.2.3	CVE-2013-6243	—	Oct 10, 2013
Critical9.8	SQL Injection Wp-ImageZoom≤1.0.7Update to 1.1.0	—	—	Oct 9, 2013
Critical9.8	Time-Based Blind SQL Injection WPRealty≤2.9.1No patch available	—	—	Oct 8, 2013

Critical9.8
Arbitrary File Upload
iThemes2
<1.4.3Update to 1.4.3
878420ce-3a39-494d-9169-44220b2c3307Nov 13, 2013
Critical9.8
Arbitrary File Upload
Elemin
<1.4.3Update to 1.4.3
CVE-2013-20002Nov 13, 2013
Critical9.8
Premium WordPress Blog & Magazine Theme | News / Editorial (All Versions) - Arbitrary File Upload
Kernel - Premium WordPress Blog & Magazine Theme | News / Editorial
all versionsNo patch available
45e0664a-385d-4879-acf6-46e837aaa03fNov 6, 2013
Critical9.8
Arbitrary File Upload
Anthology
≤1.4.4Update to 1.4.5
373b51f0-92ad-4c9e-87b9-96b4e57cc05dNov 4, 2013
Critical9.8
Arbitrary File Upload
Magnitudo - Powerful Business Theme
all versionsNo patch available
f28dc553-32de-459e-a0e9-2fd428ef42a0Nov 4, 2013
Critical9.8
Arbitrary File Upload
Amoveo Multipurpose Wordpress Theme
≤2.0No patch available
a5706025-962f-47e2-8d1d-16bafd937c92Nov 2, 2013
Critical9.8
Arbitrary File Uploads
chameleon
<3.9Update to 3.9
403c881c-b687-4e7e-8e77-a55203cfde96Nov 2, 2013
Critical9.8
Arbitrary File Upload
Think Responsive
≤1.0No patch available
33df72a5-d2bc-4af5-b5bc-f26d7249d238Nov 1, 2013
Critical9.8
Arbitrary File Upload
ThisWay
≤1.7.0No patch available
ac1f9d9c-4d4e-4036-95b1-50d09b5cac7cNov 1, 2013
Critical9.8
Powerful WordPress Theme <= 1.3.2 - Arbitrary File Upload
switchblade
≤1.3.2No patch available
8114905a-f08c-425f-ae48-06302cfcb20aNov 1, 2013
Critical9.8
Arbitrary File Upload
coldfusion
<1.2Update to 1.2
a4b71893-b0fd-476e-aa93-5f0b239e8301Oct 31, 2013
Critical9.8
Arbitrary File Upload
Right Now
all versionsNo patch available
407b8568-0b47-48d1-a006-2c42e7cfdec3Oct 31, 2013
Critical9.8
Arbitrary File Upload
WordPress Checkout
all versionsNo patch available
345834f2-e95e-4ea1-b171-1c3f4aa17e0eOct 31, 2013
Critical9.8
Arbitrary File Upload
MoneyTheme
all versionsNo patch available
ba1004c7-52f4-4fea-b820-dd11b2264e15Oct 29, 2013
Critical9.8
Arbitrary File Upload
Ghost
all versionsNo patch available
75699831-de38-4c3b-840d-82a04fc97048Oct 29, 2013
Critical9.8
Cross-Site Request Forgery and Arbitrary File Upload
curvo
all versionsNo patch available
e8021ef2-e1ce-442a-965a-b2628fe48964Oct 27, 2013
Critical9.8
Arbitrary File Upload
Geo Places 4 Theme beta
≤4betaUpdate to 5
02fe4a33-d059-461c-a03f-b7306ce6193fOct 24, 2013
Critical9.8
Arbitrary File Upload
saico
≤1.0.2No patch available
056d26da-6e43-4cc6-b2fd-13a5947a814eOct 24, 2013
Critical9.1
Authentication Bypass
Portable phpMyAdmin
≤1.5.0No patch available
CVE-2013-4462Oct 24, 2013
High7.1
Cross-Site Request Forgery and to Cross-Site Scripting
Blue Wrench Video Widget
≤1.0.5Update to 2.0.0
CVE-2013-6797Oct 23, 2013
Critical9.8
Arbitrary File Upload
Daily Deal by Templatic
≤2.2.4No patch available
ea9ee672-76d3-4d6a-b309-cd0023ca6c0dOct 23, 2013
Critical9.8
Local File Inclusion
Payment Gateways Caller for WP e-Commerce
<0.1.1Update to 0.1.1
9766a657-1cf2-448a-bd66-a27c0ebd8261Oct 23, 2013
Critical9.8
Arbitrary File Upload
WPLocalPlaces
all versionsNo patch available
73115c27-86f1-4421-9fe5-bf5d8cf54d9fOct 20, 2013
Critical9.8
Arbitrary File Upload
AREA53
≤1.0.5No patch available
b8652b40-480c-4d53-b1c8-e1dcfbd8a4a4Oct 19, 2013
Medium6.1
Cross-Site Scripting
dhtmlxspreadsheet
≤2.0No patch available
CVE-2013-6281Oct 18, 2013
High8.8
Cross-Site Request Forgery
Social Sharing Toolkit
≤2.1.1Update to 2.1.2
CVE-2013-2701Oct 17, 2013
Medium6.1
Cross-Site Scripting
Cart66 Lite :: WordPress Ecommerce
<1.5.1.15Update to 1.5.1.15
CVE-2013-5978Oct 11, 2013
Critical9.8
SQL Injection
WordPress Landing Pages
<1.2.3Update to 1.2.3
CVE-2013-6243Oct 10, 2013
Critical9.8
SQL Injection
Wp-ImageZoom
≤1.0.7Update to 1.1.0
e57f7912-4af3-4dcb-b267-afec1c373b00Oct 9, 2013
Critical9.8
Time-Based Blind SQL Injection
WPRealty
≤2.9.1No patch available
81354461-70a9-4a5d-9a75-1f2445f7e8aaOct 8, 2013