Database
Critical WordPress vulnerabilities (page 1366)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | Time-Based Blind SQL Injection | — | — | |
| Critical9.8 | Remote Code Execution | — | — | |
| Critical9.8 | Remote Code Execution | — | — | |
| Critical9.8 | Arbitrary Code Execution | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3491 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3263 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-3264 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-5916 | — | |
| Critical9.8 | SQL Injection | CVE-2013-5917 | — | |
| High7.2 | Cross-Site Scripting | CVE-2013-6010 | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-5962 | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| Critical9.1 | Denial of Service | — | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-5963 | — | |
| Critical9.8 | SQL injection | — | — | |
| Medium6.3 | Spoof Post Authorship | CVE-2013-4340 | — | |
| Medium6.4 | .swf and .exe File Upload | CVE-2013-5739 | — | |
| Medium5.4 | Open Redirect | CVE-2013-4339 | — | |
| Medium6.4 | HTML File Upload | CVE-2013-5738 | — | |
| High8.8 | Deserialization | CVE-2013-4338 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-5711 | — | |
| Critical9.8 | SQL Injection | CVE-2013-5673 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-5672 | — | |
| Critical9.8 | Multiple Vulnerabilities | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7481 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-5714 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-4626 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-10020 | — |
- Critical9.8Time-Based Blind SQL Injection
WPRealty
≤2.9.1No patch available
- Critical9.8Remote Code Execution
Woopra Analytics Plugin
<1.4.3.2Update to 1.4.3.2
- Critical9.8Remote Code Execution
seo-watcher
≤1.3.3No patch available
- Critical9.8Arbitrary Code Execution
wp-slimstat-ex
≤2.1.2No patch available
- Medium6.1Cross-Site Scripting
Sharebar
≤1.4.2Update to 1.4.3
- Medium6.1Cross-Site Scripting
WP Ultimate Email Marketer
≤1.2.0No patch available
- Critical9.8Authentication Bypass
WP Ultimate Email Marketer
≤1.2.0No patch available
- Medium6.1Cross-Site Scripting
Bradesco Gateway
≤2.0No patch available
- Critical9.8SQL Injection
NOSpamPTI
≤2.1No patch available
- High7.2Cross-Site Scripting
Comment Attachment
≤1.5.5No patch available
- Critical9.8Arbitrary File Upload
RokIntroScroller
≤1.8Update to 1.9
- Critical9.8Arbitrary File Upload
Complete Gallery Manager for WordPress | Galleries
<3.3.4Update to 3.3.4
- Critical9.8Arbitrary File Upload
RokStories
≤1.25Update to 1.26
- Critical9.8Arbitrary File Upload
RokNewsPager
≤1.17Update to 1.18
- Critical9.1Denial of Service
RokNewsPager
≤1.17Update to 1.18
- Critical9.8Arbitrary File Upload
Simple Dropbox Upload
<1.8.8.1Update to 1.8.8.1
- Critical9.8SQL injection
Mukioplayer For WordPress
≤1.6No patch available
- Medium6.3Spoof Post Authorship
WordPress
≤3.6Update to 3.6.1
- Medium6.4.swf and .exe File Upload
WordPress
<3.6.1Update to 3.6.1
- Medium5.4Open Redirect
WordPress
≤3.6Update to 3.6.1
- Medium6.4HTML File Upload
WordPress
≤3.6Update to 3.6.1
- High8.8Deserialization
WordPress
≤3.6Update to 3.6.1
- Medium6.1Cross-Site Scripting
Design Approval System
≤3.6Update to 3.7
- Critical9.8SQL Injection
Testimonial
<2.3Update to 2.3
- High8.8Cross-Site Request Forgery
Testimonial
<2.3Update to 2.3
- Critical9.8Multiple Vulnerabilities
Testimonial
<2.3Update to 2.3
- Medium6.1Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
≤3.34Update to 3.35
- Medium6.1Reflected Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤4.25.3Update to 4.27
- Medium6.1Cross-Site Scripting
BackWPup – WordPress Backup & Restore Plugin
<3.0.13Update to 3.0.13
- Medium6.1Reflected Cross-Site Scripting
A Forms
≤1.4.2Update to 1.4.3