Database
Critical WordPress vulnerabilities (page 1374)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | Arbitrary File Upload | — | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3575 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10064 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3578 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-2633 | — | |
| Critical9.8 | SQL Injection | — | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3574 | — | |
| Critical9.8 | Remote File Upload | CVE-2012-10027 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3577 | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| Critical9.8 | Brute Force Bypass | CVE-2012-10001 | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| High7.5 | Arbitrary File Read | CVE-2012-3588 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2012-6715 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-10026 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-6716 | — | |
| High7.2 | Cross-Site Scripting | CVE-2012-2917 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-2759 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2012-2912 | — | |
| Medium6.1 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2012-6622 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-6718 | — | |
| Critical9.8 | SQL Injection | CVE-2012-6719 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-2916 | — | |
| High7.2 | SQL Injection | CVE-2012-6625 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-6628 | — | |
| High7.1 | Cross-Site Scripting | CVE-2012-6623 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-6624 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-2913 | — |
- Critical9.8Arbitrary File Upload
Hungred Post Thumbnail
≤2.1.9No patch available
- Critical9.8Arbitrary File Upload
rbxgallery
<3.1Update to 3.1
- Critical9.8Arbitrary File Upload
Omni Secure Files
≤0.1.13Update to 0.1.14
- Critical9.8Arbitrary File Upload
FCChat Widget
<2.2.13.7Update to 2.2.13.7
- Medium6.1Cross-Site Scripting
WassUp Real Time Analytics
<1.8.3.1Update to 1.8.3.1
- Critical9.8SQL Injection
Leaflet Maps Marker Pro
<2.4Update to 2.4
- Critical9.8Arbitrary File Upload
mm-forms-community
≤2.2.6Update to 2.2.7
- Critical9.8Remote File Upload
WP-Property – WordPress Powered Real Estate and Property Management
≤1.35.0Update to 1.35.1
- Critical9.8Arbitrary File Upload
Nmedia WordPress Member Conversation
<1.4Update to 1.4
- Critical9.8Arbitrary File Upload
HTML5 AV Manager
≤0.2.7No patch available
- Critical9.8Arbitrary File Upload
Homepage SlideShow
<2.2Update to 2.2
- Critical9.8Arbitrary File Upload
3D Flick Slideshow
≤2.1Update to 2.2
- Critical9.8Brute Force Bypass
Limit Login Attempts
≤1.7.0Update to 1.7.1
- Critical9.8Arbitrary File Upload
Smart Slideshow
≤2.4No patch available
- High7.5Arbitrary File Read
Plugin: Newsletter
≤1.5No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
FormBuilder
≤0.90Update to 0.91
- Critical9.8Arbitrary File Upload
Asset Manager
≤0.3No patch available
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.1.7Update to 5.1.7
- High7.2Cross-Site Scripting
Share and Follow
≤1.80.3Update to 1.80.4
- Medium6.1Cross-Site Scripting
AJAX Auth – Fast Logins, 2FA, Redirects
≤3.0.4Update to 3.0.4.1
- Medium6.1Multiple Cross-Site Scripting
LeagueManager
≤3.7Update to 3.8
- Medium6.1Authenticated (Admin+) Stored Cross-Site Scripting
WP Forum Server
≤1.7.3Update to 1.7.4
- Medium6.1Cross-Site Scripting
Sharebar
≤1.2.1Update to 1.2.2
- Critical9.8SQL Injection
Sharebar
<1.2.2Update to 1.2.2
- Medium6.1Cross-Site Scripting
Sabre
<1.2.2Update to 1.2.2
- High7.2SQL Injection
WP Forum Server
<1.7.4Update to 1.7.4
- Medium6.1Cross-Site Scripting
Newsletter Manager
<1.0.2Update to 1.0.2
- High7.1Cross-Site Scripting
WP Forum Server
<1.7.5Update to 1.7.5
- Medium6.1Cross-Site Scripting
SoundCloud Is Gold
≤2.2Update to 2.2.1
- Medium6.1Cross-Site Scripting
Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)
≤2.3Update to 2.3.1