Database
Critical WordPress vulnerabilities (page 1369)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.2 | Cross-Site Scripting | CVE-2013-3529 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2700 | — | |
| Critical9.8 | SQL Injection | — | — | |
| Critical9.8 | SQL Injection | — | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-2741 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-2742 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-2743 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2013-2744 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2013-2640 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-0731 | — | |
| High7.2 | SQL Injection | CVE-2013-1852 | — | |
| Medium6.1 | Cross-Site Scripting via playerID | CVE-2013-2714 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2013-2501 | — | |
| Critical10.0 | SQL Injection | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7472 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2013-7480 | — | |
| Critical9.8 | Multiple Vulnerabilities | — | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| Critical9.8 | SQL Injection | — | — | |
| Critical9.8 | SQL Injection | CVE-2013-0735 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2013-0734 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1765 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1759 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1758 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1808 | — | |
| Critical9.1 | SQL Injection | — | — | |
| High7.5 | 1.9.11 - Full Path Disclosure | CVE-2013-0291 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2013-0286 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2013-10023 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-1409 | — |
- High7.2Cross-Site Scripting
WP FuneralPress
≤1.1.6Update to 1.1.7
- High8.8Cross-Site Request Forgery
WP125
≤1.4.9Update to 1.5.0
- Critical9.8SQL Injection
Finalist
all versionsNo patch available
- Critical9.8SQL Injection
Level Four Store Front
≤8.1Update to 8.1.1
- Critical9.8Authentication Bypass
BackupBuddy
<3.0Update to 3.0
- Critical9.8Authentication Bypass
BackupBuddy
<3.0Update to 3.0
- Critical9.8Authentication Bypass
BackupBuddy
<3.0Update to 3.0
- Medium5.3Sensitive Information Disclosure
BackupBuddy
<3.0Update to 3.0
- Medium6.4Cross-Site Scripting
MailUp newsletter sign-up form
<1.3.2Update to 1.3.2
- Medium6.1Cross-Site Scripting
MailUp newsletter sign-up form
<1.3.3Update to 1.3.3
- High7.2SQL Injection
LeagueManager
<3.8.1Update to 3.8.1
- Medium6.1Cross-Site Scripting via playerID
podpress
≤8.8.10.17No patch available
- Medium6.4Stored Cross-Site Scripting
Terillion Reviews
<1.2Update to 1.2
- Critical10.0SQL Injection
Timely All-in-One Events Calendar
<1.10Update to 1.10
- Medium6.1Cross-Site Scripting
Count per Day
<3.2.6Update to 3.2.6
- Medium6.1Multiple Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.3.6Update to 5.3.6.1
- Critical9.8Multiple Vulnerabilities
Google Alert and Twitter Plugin
3.1.5 – 3.1.5No patch available
- Critical9.8Arbitrary File Upload
Magn WP Drag And Drop Media Uploader
≤1.2.0Update to 1.2.1
- Critical9.8SQL Injection
Comment Rating
≤2.9.32No patch available
- Critical9.8SQL Injection
Mingle Forum
≤1.0.33.3Update to 1.0.34
- High7.2Stored Cross-Site Scripting
Mingle Forum
≤1.0.33.3Update to 1.0.34
- Medium6.1Cross-Site Scripting
Smart Flv
≤1.0No patch available
- Medium6.1Cross-Site Scripting
Responsive Logo Slideshow
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
Marekkis Watermark-Plugin
≤0.9.4No patch available
- Medium6.1Cross-Site Scripting
Zendesk Chat
<1.2.6Update to 1.2.6
- Critical9.1SQL Injection
WP Easy Gallery – WordPress Gallery Plugin
≤2.7Update to 2.7.1
- High7.51.9.11 - Full Path Disclosure
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
1.9.10 – 1.9.11Update to 2.0.0
- Medium5.4Cross-Site Scripting
Pinboard
≤1.1.11Update to 1.1.12
- High7.2Authenticated (Admin+) SQL Injection
Editorial Calendar
≤2.6Update to 2.7
- Medium6.1Reflected Cross-Site Scripting
CommentLuv
<2.92.4Update to 2.92.4