Database

Critical WordPress vulnerabilities (page 1375)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

Critical WordPress vulnerabilities (page 1375)
Severity	Vulnerability	CVE	Installs	Published
High7.2	SQL Injection WP Forum Server<1.7.4Update to 1.7.4	CVE-2012-6625	—	May 15, 2012
Medium6.1	Cross-Site Scripting WP-FaceThumb≤0.1Update to 0.2	CVE-2012-2371	—	May 13, 2012
Medium6.1	Reflected Cross-Site Scripting BulletProof Security<.47.1Update to .47.1	CVE-2012-4268	—	May 11, 2012
Medium6.1	Cross-Site Scripting 2 Click Social Media Buttons<0.34Update to 0.34	CVE-2012-4273	—	May 11, 2012
High7.2	Cross-Site Scripting Kadence Security – Password, Two Factor Authentication, and Brute Force Protection<3.2.5Update to 3.2.5	CVE-2012-4263	—	May 11, 2012
Medium6.1	Multiple Cross-Site Scripting 2 Click Social Media Buttons≤0.33Update to 0.34	CVE-2012-4272	—	May 11, 2012
Medium6.1	2.2.4 - Cross-Site Scripting Bad Behavior<2.2.5Update to 2.0.47 or 2.2.5	CVE-2012-4271	—	May 11, 2012
Medium6.1	Multiple Cross-Site Scripting Kadence Security – Password, Two Factor Authentication, and Brute Force Protection≤3.2.4Update to 3.2.5	CVE-2012-4264	—	May 11, 2012
Medium6.1	Cross-Site Scripting User Photo≤0.9.5Update to 0.9.5.2	CVE-2012-2920	—	May 9, 2012
Medium6.1	Cross-Site Scripting AJAX Auth – Fast Logins, 2FA, Redirects<3.0.4.1Update to 3.0.5	CVE-2012-4283	—	May 7, 2012
Medium6.1	Reflected Cross-Site Scripting Redirection<2.2.12Update to 2.2.12	CVE-2012-6717	—	May 4, 2012
Critical9.8	Remote Code Execution via Shortcodes Wootique≤1.3.1Update to 1.3.2	—	—	Apr 28, 2012
Medium6.1	Cross-Site Scripting zingiri-web-shop<2.4.2Update to 2.4.2	CVE-2012-6506	—	Apr 26, 2012
Medium5.3	Sensitive Information Disclosure ShareYourCart<1.7.1Update to 1.7.1	CVE-2012-4332	—	Apr 24, 2012
Medium6.1	Multiple Cross-Site Scripting Organizer≤1.2.1No patch available	CVE-2012-6511	—	Apr 23, 2012
Medium5.4	Cross-Site Scripting WordPress≤3.3.1Update to 3.3.2	CVE-2012-2404	—	Apr 21, 2012
High7.2	Cross-Site Scripting WordPress≤3.5.1Update to 3.5.2	CVE-2012-2399	—	Apr 21, 2012
High7.2	Cross-Site Scripting WordPress≤3.3.1Update to 3.3.2	CVE-2012-2400	—	Apr 20, 2012
Medium5.4	Authorization Bypass WordPress≤3.3.1Update to 3.3.2	CVE-2012-2402	—	Apr 20, 2012
Medium6.5	Same Origin Policy Bypass WordPress<3.3.2Update to 3.3.2	CVE-2012-2401	—	Apr 20, 2012
Medium6.4	Cross-Site Scripting WordPress≤3.3.1Update to 3.3.2	CVE-2012-2403	—	Apr 20, 2012
Critical9.8	Multiple Vulnerabilities zingiri-web-shop<2.4.0Update to 2.4.0	CVE-2012-4033	—	Apr 18, 2012
High7.5	Path Disclosure Organizer≤1.2.1No patch available	CVE-2012-6512	—	Apr 14, 2012
High7.1	Cross-Site Scripting Timely All-in-One Events Calendar<1.6Update to 1.6	CVE-2012-1835	—	Apr 11, 2012
Critical9.8	Arbitrary File Upload WP Marketplace – Complete Shopping Cart / eCommerce Solution<1.2.2Update to 1.2.2	—	—	Apr 8, 2012
Critical9.8	Arbitrary File Upload Front-end Editor<2.3Update to 2.3	CVE-2012-10019	—	Apr 7, 2012
Critical9.8	SQL Injection TagGator<1.33Update to 1.33	—	—	Apr 5, 2012
High7.2	Arbitrary File Upload AWP Classifieds<2.0Update to 2.0	CVE-2012-4874	—	Apr 3, 2012
Medium6.1	Cross-Site Scripting WordPress Integrator≤1.32No patch available	CVE-2012-5913	—	Mar 28, 2012
Critical9.8	Arbitrary File Upload Dean's FCKEditor≤1.0.0No patch available	—	—	Mar 28, 2012

High7.2
SQL Injection
WP Forum Server
<1.7.4Update to 1.7.4
CVE-2012-6625May 15, 2012
Medium6.1
Cross-Site Scripting
WP-FaceThumb
≤0.1Update to 0.2
CVE-2012-2371May 13, 2012
Medium6.1
Reflected Cross-Site Scripting
BulletProof Security
<.47.1Update to .47.1
CVE-2012-4268May 11, 2012
Medium6.1
Cross-Site Scripting
2 Click Social Media Buttons
<0.34Update to 0.34
CVE-2012-4273May 11, 2012
High7.2
Cross-Site Scripting
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
<3.2.5Update to 3.2.5
CVE-2012-4263May 11, 2012
Medium6.1
Multiple Cross-Site Scripting
2 Click Social Media Buttons
≤0.33Update to 0.34
CVE-2012-4272May 11, 2012
Medium6.1
2.2.4 - Cross-Site Scripting
Bad Behavior
<2.2.5Update to 2.0.47 or 2.2.5
CVE-2012-4271May 11, 2012
Medium6.1
Multiple Cross-Site Scripting
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
≤3.2.4Update to 3.2.5
CVE-2012-4264May 11, 2012
Medium6.1
Cross-Site Scripting
User Photo
≤0.9.5Update to 0.9.5.2
CVE-2012-2920May 9, 2012
Medium6.1
Cross-Site Scripting
AJAX Auth – Fast Logins, 2FA, Redirects
<3.0.4.1Update to 3.0.5
CVE-2012-4283May 7, 2012
Medium6.1
Reflected Cross-Site Scripting
Redirection
<2.2.12Update to 2.2.12
CVE-2012-6717May 4, 2012
Critical9.8
Remote Code Execution via Shortcodes
Wootique
≤1.3.1Update to 1.3.2
0728e7ac-2091-41de-90a0-e231c4b99ab0Apr 28, 2012
Medium6.1
Cross-Site Scripting
zingiri-web-shop
<2.4.2Update to 2.4.2
CVE-2012-6506Apr 26, 2012
Medium5.3
Sensitive Information Disclosure
ShareYourCart
<1.7.1Update to 1.7.1
CVE-2012-4332Apr 24, 2012
Medium6.1
Multiple Cross-Site Scripting
Organizer
≤1.2.1No patch available
CVE-2012-6511Apr 23, 2012
Medium5.4
Cross-Site Scripting
WordPress
≤3.3.1Update to 3.3.2
CVE-2012-2404Apr 21, 2012
High7.2
Cross-Site Scripting
WordPress
≤3.5.1Update to 3.5.2
CVE-2012-2399Apr 21, 2012
High7.2
Cross-Site Scripting
WordPress
≤3.3.1Update to 3.3.2
CVE-2012-2400Apr 20, 2012
Medium5.4
Authorization Bypass
WordPress
≤3.3.1Update to 3.3.2
CVE-2012-2402Apr 20, 2012
Medium6.5
Same Origin Policy Bypass
WordPress
<3.3.2Update to 3.3.2
CVE-2012-2401Apr 20, 2012
Medium6.4
Cross-Site Scripting
WordPress
≤3.3.1Update to 3.3.2
CVE-2012-2403Apr 20, 2012
Critical9.8
Multiple Vulnerabilities
zingiri-web-shop
<2.4.0Update to 2.4.0
CVE-2012-4033Apr 18, 2012
High7.5
Path Disclosure
Organizer
≤1.2.1No patch available
CVE-2012-6512Apr 14, 2012
High7.1
Cross-Site Scripting
Timely All-in-One Events Calendar
<1.6Update to 1.6
CVE-2012-1835Apr 11, 2012
Critical9.8
Arbitrary File Upload
WP Marketplace – Complete Shopping Cart / eCommerce Solution
<1.2.2Update to 1.2.2
d257d0e0-7e42-49d5-83c6-f5c44f2e15fcApr 8, 2012
Critical9.8
Arbitrary File Upload
Front-end Editor
<2.3Update to 2.3
CVE-2012-10019Apr 7, 2012
Critical9.8
SQL Injection
TagGator
<1.33Update to 1.33
21e4b1fe-993b-4898-a523-e0a858c30a38Apr 5, 2012
High7.2
Arbitrary File Upload
AWP Classifieds
<2.0Update to 2.0
CVE-2012-4874Apr 3, 2012
Medium6.1
Cross-Site Scripting
WordPress Integrator
≤1.32No patch available
CVE-2012-5913Mar 28, 2012
Critical9.8
Arbitrary File Upload
Dean's FCKEditor
≤1.0.0No patch available
b4080bb7-9197-4c93-bcb1-cf7b5833771aMar 28, 2012