Database

Critical WordPress vulnerabilities (page 1368)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

Critical WordPress vulnerabilities (page 1368)
Severity	Vulnerability	CVE	Installs	Published
High8.8	Remote Code Execution WP CleanFix<5.0.0Update to 5.0.0	CVE-2013-2109	—	May 18, 2013
High8.8	Cross-Site Request Forgery Mail On Update<5.3.0Update to 5.3.0	CVE-2013-2107	—	May 16, 2013
Critical10.0	Multiple Vulnerabilities I LOVE IT!≤2.3Update to 2.4	—	—	May 16, 2013
Medium6.1	Reflected Cross-Site Scripting Debug Bar≤0.8Update to 0.8.1	CVE-2013-10021	—	May 15, 2013
Critical9.8	SQL Injection WORDPRESS VIDEO GALLERY<2.1Update to 2.1	CVE-2013-3478	—	May 14, 2013
Medium4.3	Cross-Site Request Forgery Related Posts<2.7.2Update to 2.7.2	CVE-2013-3257	—	May 14, 2013
High8.8	Cross-Site Request Forgery WP-PostViews<1.63Update to 1.63	CVE-2013-3252	—	May 8, 2013
High8.8	Cross-Site Request Forgery share-this≤7.0.5Update to 7.0.6	CVE-2013-3479	—	May 7, 2013
High8.8	Cross-Site Request Forgery Related Posts by Zemanta≤1.3.1Update to 1.3.2	CVE-2013-3477	—	May 7, 2013
Medium6.1	Cross-Site Scripting WP Photo Album Plus<5.0.3Update to 5.0.3	CVE-2013-3254	—	May 6, 2013
Medium6.3	Cross-Site Request Forgery AJAX Auth – Fast Logins, 2FA, Redirects<3.1Update to 3.1	CVE-2013-2707	—	May 6, 2013
Critical9.1	External Entity Injection Advanced XML Reader≤0.3.4No patch available	—	—	May 2, 2013
Medium6.3	Cross-Site Request Forgery Easy Plugin for AdSense<6.10Update to 6.10	CVE-2013-2702	—	Apr 30, 2013
Critical10.0	Multiple Vulnerabilities Feather12all versionsNo patch available	—	—	Apr 24, 2013
Critical10.0	Multiple Vulnerabilities Music≤1.5No patch available	—	—	Apr 24, 2013
Critical10.0	Multiple Vulnerabilities Imperial Themes Fairytaleall versionsNo patch available	—	—	Apr 24, 2013
Critical10.0	Multiple Vulnerabilities Photocratiall versionsNo patch available	—	—	Apr 24, 2013
High7.6	Cross-Site Request Forgery Facebook Members<5.0.5Update to 5.0.5	CVE-2013-2703	—	Apr 22, 2013
High8.8	Cross-Site Request Forgery to Cross-Site Scripting FourSquare Checkins<1.3Update to 1.3	CVE-2013-2709	—	Apr 19, 2013
High7.1	Cross-Site Request Forgery WP Webmaster<8.2.4Update to 8.2.4	CVE-2013-2696	—	Apr 19, 2013
Critical9.1	Multiple Vulnerabilities Colormixall versionsNo patch available	—	—	Apr 18, 2013
Medium6.1	Reflected Cross-Site Scripting EELV Newsletter≤3.3.0Update to 3.3.1	CVE-2013-10028	—	Apr 17, 2013
Critical9.8	SQL Injection SpiderVPlayer≤2.1No patch available	CVE-2013-3532	—	Apr 11, 2013
Critical9.8	SQL Injection Spiffy XSPF Player≤0.1No patch available	CVE-2013-3530	—	Apr 10, 2013
Medium6.1	Cross-Site Scripting Traffic Analyzer≤3.4.1Update to 3.4.2	CVE-2013-3526	—	Apr 9, 2013
Medium6.1	Cross-Site Scripting wp-download-manager<1.61Update to 1.61	CVE-2013-2697	—	Apr 8, 2013
Critical9.8	Arbitrary File Upload Social Media Widget≤4.0Update to 4.0.1	CVE-2013-1949	—	Apr 8, 2013
High7.1	Cross-Site Request Forgery WP-Print<2.52Update to 2.52	CVE-2013-2693	—	Apr 5, 2013
Medium5.5	Authenticated (Admin+) Stored Cross-Site Scripting Feedweb<1.9Update to 1.9	CVE-2013-3720	—	Apr 3, 2013
High8.8	Cross-Site Request Forgery Simple Fields<1.2Update to 1.2	CVE-2013-7476	—	Apr 1, 2013

High8.8
Remote Code Execution
WP CleanFix
<5.0.0Update to 5.0.0
CVE-2013-2109May 18, 2013
High8.8
Cross-Site Request Forgery
Mail On Update
<5.3.0Update to 5.3.0
CVE-2013-2107May 16, 2013
Critical10.0
Multiple Vulnerabilities
I LOVE IT!
≤2.3Update to 2.4
b8205bfe-4586-42e9-b4f7-e46947396b6bMay 16, 2013
Medium6.1
Reflected Cross-Site Scripting
Debug Bar
≤0.8Update to 0.8.1
CVE-2013-10021May 15, 2013
Critical9.8
SQL Injection
WORDPRESS VIDEO GALLERY
<2.1Update to 2.1
CVE-2013-3478May 14, 2013
Medium4.3
Cross-Site Request Forgery
Related Posts
<2.7.2Update to 2.7.2
CVE-2013-3257May 14, 2013
High8.8
Cross-Site Request Forgery
WP-PostViews
<1.63Update to 1.63
CVE-2013-3252May 8, 2013
High8.8
Cross-Site Request Forgery
share-this
≤7.0.5Update to 7.0.6
CVE-2013-3479May 7, 2013
High8.8
Cross-Site Request Forgery
Related Posts by Zemanta
≤1.3.1Update to 1.3.2
CVE-2013-3477May 7, 2013
Medium6.1
Cross-Site Scripting
WP Photo Album Plus
<5.0.3Update to 5.0.3
CVE-2013-3254May 6, 2013
Medium6.3
Cross-Site Request Forgery
AJAX Auth – Fast Logins, 2FA, Redirects
<3.1Update to 3.1
CVE-2013-2707May 6, 2013
Critical9.1
External Entity Injection
Advanced XML Reader
≤0.3.4No patch available
120e6a19-fae3-4083-a72e-36867e7eb18aMay 2, 2013
Medium6.3
Cross-Site Request Forgery
Easy Plugin for AdSense
<6.10Update to 6.10
CVE-2013-2702Apr 30, 2013
Critical10.0
Multiple Vulnerabilities
Feather12
all versionsNo patch available
1261ad29-e4c1-4385-9f41-d3f3eecbb7dcApr 24, 2013
Critical10.0
Multiple Vulnerabilities
Music
≤1.5No patch available
712887d9-25fd-4d8f-a2e6-e6f2855f5ddbApr 24, 2013
Critical10.0
Multiple Vulnerabilities
Imperial Themes Fairytale
all versionsNo patch available
9b41efbd-bd47-415f-8de7-f30b3a7cf326Apr 24, 2013
Critical10.0
Multiple Vulnerabilities
Photocrati
all versionsNo patch available
99746867-597b-49df-aa9e-548456a58542Apr 24, 2013
High7.6
Cross-Site Request Forgery
Facebook Members
<5.0.5Update to 5.0.5
CVE-2013-2703Apr 22, 2013
High8.8
Cross-Site Request Forgery to Cross-Site Scripting
FourSquare Checkins
<1.3Update to 1.3
CVE-2013-2709Apr 19, 2013
High7.1
Cross-Site Request Forgery
WP Webmaster
<8.2.4Update to 8.2.4
CVE-2013-2696Apr 19, 2013
Critical9.1
Multiple Vulnerabilities
Colormix
all versionsNo patch available
b50f98ca-6a51-4de8-9e89-004532ba8f96Apr 18, 2013
Medium6.1
Reflected Cross-Site Scripting
EELV Newsletter
≤3.3.0Update to 3.3.1
CVE-2013-10028Apr 17, 2013
Critical9.8
SQL Injection
SpiderVPlayer
≤2.1No patch available
CVE-2013-3532Apr 11, 2013
Critical9.8
SQL Injection
Spiffy XSPF Player
≤0.1No patch available
CVE-2013-3530Apr 10, 2013
Medium6.1
Cross-Site Scripting
Traffic Analyzer
≤3.4.1Update to 3.4.2
CVE-2013-3526Apr 9, 2013
Medium6.1
Cross-Site Scripting
wp-download-manager
<1.61Update to 1.61
CVE-2013-2697Apr 8, 2013
Critical9.8
Arbitrary File Upload
Social Media Widget
≤4.0Update to 4.0.1
CVE-2013-1949Apr 8, 2013
High7.1
Cross-Site Request Forgery
WP-Print
<2.52Update to 2.52
CVE-2013-2693Apr 5, 2013
Medium5.5
Authenticated (Admin+) Stored Cross-Site Scripting
Feedweb
<1.9Update to 1.9
CVE-2013-3720Apr 3, 2013
High8.8
Cross-Site Request Forgery
Simple Fields
<1.2Update to 1.2
CVE-2013-7476Apr 1, 2013