Database
Critical WordPress vulnerabilities (page 1377)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | Arbitrary File Upload | CVE-2011-5051 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2011-5226 | — | |
| Critical9.8 | Authentication Bypass | — | — | |
| Critical9.8 | SQL Injection | CVE-2011-5224 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5225 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5191 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-5264 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-4595 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-4624 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-5180 | — | |
| High7.1 | Cross-Site Scripting | CVE-2011-5179 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5265 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5181 | — | |
| Medium5.3 | Stored Cross-Site Scripting | CVE-2011-5104 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5107 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5106 | — | |
| Critical9.8 | Remote Code Execution | — | — | |
| Critical9.8 | SQL Injection | CVE-2011-4671 | — | |
| High7.3 | SQL Injection | CVE-2011-4803 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3860 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2011-5328 | — | |
| Critical9.8 | SQL Injection | CVE-2011-4669 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2011-5257 | — | |
| High8.8 | SQL Injection | CVE-2011-4646 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3850 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3862 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3865 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3856 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3858 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3864 | — |
- High8.8Arbitrary File Upload
WP Symposium
<11.12.24Update to 11.12.24
- High8.8Cross-Site Request Forgery
WordPress Sentinel
≤1.0.0Update to 1.0.1
- Critical9.8Authentication Bypass
Absolute Privacy
≤2.0.5Update to 2.0.6
- Critical9.8SQL Injection
WordPress Sentinel
≤1.0.0Update to 1.0.1
- Medium6.1Cross-Site Scripting
WordPress Sentinel
≤1.0.0Update to 1.0.1
- Medium6.1Cross-Site Scripting
Pretty Link Lite
<1.5.4Update to 1.5.4
- Medium6.1Reflected Cross-Site Scripting
Lazyest Backup
<0.2.2Update to 0.2.2
- Medium6.1Reflected Cross-Site Scripting
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<1.5.6Update to 1.5.6
- Medium6.1Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
<1.57Update to 1.57
- Medium6.1Reflected Cross-Site Scripting
ZooEffect Plugin for Video player, Photo Gallery Slideshow jQuery and audio / music / podcast – HTML5
≤1.11No patch available
- High7.1Cross-Site Scripting
Skysa App Bar Integration
≤1.03Update to 1.04
- Medium6.1Cross-Site Scripting
Featurific For WordPress
≤1.6.2No patch available
- Medium6.1Cross-Site Scripting
Live Chat from ClickDesk – Live Chat – Help Desk Plugin for Websites
≤2.0Update to 3.0
- Medium5.3Stored Cross-Site Scripting
WP eCommerce
<3.8.7.2Update to 3.8.7.2
- Medium6.1Cross-Site Scripting
Alert Before Your Post
≤0.1.1No patch available
- Medium6.1Cross-Site Scripting
Flexible Custom Post Type
<0.1.7Update to 0.1.7
- Critical9.8Remote Code Execution
Zingiri Web Shop
≤2.2.3Update to 2.2.4
- Critical9.8SQL Injection
AdRotate Banner Manager
<3.6.8Update to 3.6.8
- High7.3SQL Injection
WPtouch – Make your WordPress Website Mobile-Friendly
<1.9.8.1Update to 1.9.8.1
- Medium6.1Cross-Site Scripting
Cover WP
≤1.6.5Update to 1.6.6
- High8.8Cross-Site Request Forgery
User Access Manager
<1.2Update to 1.2
- Critical9.8SQL Injection
WordPress Users
≤1.3Update to 1.4
- Medium6.4Stored Cross-Site Scripting
Classipress
≤3.1.4Update to 3.1.5
- High8.8SQL Injection
WP-PostRatings
≤1.61Update to 1.62
- Medium6.1Cross-Site Scripting
Atahualpa
<3.6.8Update to 3.6.8
- Medium6.1Cross-Site Scripting
Morning Coffee
<3.6Update to 3.6
- Medium6.1Cross-Site Scripting
Black-Letterhead
<1.6Update to 1.6
- Medium6.1Cross-Site Scripting
Elegant Grunge
≤1.0.3Update to 1.0.4
- Medium6.1Cross-Site Scripting
Pixiv Custom
<2.1.6Update to 2.1.6
- Medium6.1Cross-Site Scripting
The Erudite
≤2.7.8Update to 2.8