Database
Critical WordPress vulnerabilities (page 1376)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | 1.5-1.5.4 - SQL Injection | CVE-2012-2109 | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-1834 | — | |
| High8.3 | Server Side Request Forgery to Cross-Site Scirpting | CVE-2012-10018 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2012-5318 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-3576 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2012-1786 | — | |
| High7.2 | Remote Code Execution | CVE-2012-1785 | — | |
| High7.2 | Cross-Site Scripting | CVE-2011-5082 | — | |
| High8.8 | SQL Injection | CVE-2012-10009 | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| High7.1 | Cross-Site Scripting | CVE-2012-5229 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-1125 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2012-0934 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-1011 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2012-1010 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-6527 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2012-5325 | — | |
| Medium5.3 | Directory Traversal | CVE-2012-0898 | — | |
| High7.5 | Arbitrary File Download | CVE-2012-0896 | — | |
| Medium6.1 | Open Redirect | CVE-2012-6499 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-0901 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2012-5350 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5192 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-5349 | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2012-0287 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-5346 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5207 | — | |
| Medium6.1 | Authorization Bypass | CVE-2011-5254 | — |
- Critical9.81.5-1.5.4 - SQL Injection
BuddyPress
1.5 – 1.5.4Update to 1.5.5
- Critical9.8Arbitrary File Upload
MoneyMasters
all versionsNo patch available
- Medium6.1Cross-Site Scripting
CMS Tree Page View – Reorder Pages with a Drag-and-Drop Tree
<0.8.9Update to 0.8.9
- High8.3Server Side Request Forgery to Cross-Site Scirpting
Mapplic Lite
<1.0.1Update to 1.0.1
- Critical9.8Unauthenticated Arbitrary File Upload
Kish Guest Posting
≤1.2No patch available
- Critical9.8Arbitrary File Upload
IDB Ecommerce (wpStoreCart 5)
≤2.5.29Update to 2.5.30
- Medium5.3Full Path Disclosure
Videopack
≤1.1Update to 2.0
- High7.2Remote Code Execution
Videopack
<2.0Update to 2.0
- High7.2Cross-Site Scripting
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
<111220Update to 111220
- High8.8SQL Injection
404Like
≤1.0Update to 1.0.2
- Critical9.8Arbitrary File Upload
front-end-upload
≤0.5.3Update to 0.5.4
- High7.1Cross-Site Scripting
Slideshow Gallery
≤1.1.4No patch available
- Critical9.8Arbitrary File Upload
Kish Guest Posting
<1.2Update to 1.2
- Critical9.8Remote File Inclusion
Theme Tuner
<0.8Update to 0.8
- Critical9.8Arbitrary File Upload
AllWebMenus WordPress Menu Plugin
≤1.1.8Update to 1.1.9
- Critical9.8Arbitrary File Upload
AllWebMenus WordPress Menu Plugin
<1.1.9Update to 1.1.9
- Medium6.1Cross-Site Scripting
My Calendar – Accessible Event Manager
<1.10.5Update to 1.10.5
- Medium5.4Cross-Site Scripting
Shortcode Redirect
≤1.0.01Update to 1.0.02
- Medium5.3Directory Traversal
myEASYbackup
<1.0.9Update to 1.0.9
- High7.5Arbitrary File Download
Count per Day
≤3.1Update to 3.1.1
- Medium6.1Open Redirect
Age Verification
≤0.4Update to 0.5
- Medium6.1Cross-Site Scripting
YouSayToo auto-publishing plugin
≤1.0No patch available
- High8.8Authenticated SQL Injection
Pay With Tweet
≤1.1Update to 1.2
- Medium6.1Cross-Site Scripting
Pretty Link Lite
<1.5.6Update to 1.5.6
- Medium6.1Cross-Site Scripting
Pay With Tweet
≤1.1Update to 1.2
- Critical9.8Arbitrary File Upload
Blaze Slideshow
≤2.4Update to 2.6
- Medium6.4Cross-Site Scripting
WordPress
≤3.3Update to 3.3.1
- Medium6.1Cross-Site Scripting
WP Live.php
≤1.2.1Update to 1.3
- Medium6.1Cross-Site Scripting
TheCartPress eCommerce Shopping Cart
≤1.1.5Update to 1.1.6
- Medium6.1Authorization Bypass
Connections Business Directory
≤0.7.1.5Update to 0.7.1.6