Database
Critical WordPress vulnerabilities (page 1378)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2011-3859 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3857 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3861 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3851 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3854 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-3863 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3852 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3855 | — | |
| High7.1 | Cross-Site Scripting | CVE-2011-3853 | — | |
| Critical9.8 | SQL Injection | CVE-2015-2216 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-1068 | — | |
| Critical9.8 | SQL Injection | CVE-2012-1067 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2012-1205 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2011-3981 | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| Critical9.8 | SQL Injection | CVE-2011-5216 | — | |
| Critical9.8 | SQL Injection | — | — | |
| Critical9.8 | Remote File Download | CVE-2011-4106 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-4568 | — | |
| High8.8 | SQL Injection | CVE-2011-5286 | — | |
| Critical9.8 | Code Injection | — | — | |
| High8.8 | SQL Injection | CVE-2011-3130 | — | |
| High8.8 | Arbitrary File Upload | CVE-2011-3129 | — | |
| Medium5.3 | Username Enumeration | CVE-2011-3126 | — | |
| Medium6.3 | Security Hardening | CVE-2011-3125 | — | |
| Medium4.3 | Sensitive Information Disclosure | CVE-2011-3128 | — | |
| High7.1 | Clickjacking | CVE-2011-3127 | — | |
| Medium6.3 | Media Related Security Issue | CVE-2011-3122 | — | |
| Critical9.8 | Unauthenticated Remote Code Execution | CVE-2011-10033 | — | |
| Medium6.3 | Incorrect Authorization Checks | CVE-2011-5270 | — |
- Medium6.1Cross-Site Scripting
Trending
<0.2Update to 0.2
- Medium6.1Cross-Site Scripting
Antisnews
≤1.09Update to 1.10
- Medium6.1Cross-Site Scripting
Web Minimalist 200901
≤1.1No patch available
- Medium6.1Cross-Site Scripting
News
≤0.1Update to 0.2
- Medium6.1Cross-Site Scripting
ZenLite
≤4.3Update to 4.4
- Medium6.1Reflected Cross-Site Scripting
RedLine
<1.66Update to 1.66
- Medium6.1Cross-Site Scripting
evolve
<1.2.7Update to 1.2.7
- Medium6.1Cross-Site Scripting
F8 Lite
≤4.2.1Update to 4.2.2
- High7.1Cross-Site Scripting
Hybrid
<0.10Update to 0.10
- Critical9.8SQL Injection
Photocrati
≤4.0Update to 4.1
- Medium6.1Cross-Site Scripting
WP-RecentComments
<2.0.7Update to 2.0.7
- Critical9.8SQL Injection
WP-RecentComments
≤2.0.7Update to 2.1
- Critical9.8Remote File Inclusion
Relocate Upload
<0.20Update to 0.20
- Critical9.8Remote File Inclusion
AllWebMenus WordPress Menu Plugin
≤1.1.3Update to 1.1.4
- Critical9.8Arbitrary File Upload
Global Flash Gallery
≤0.15.1Update to 0.15.2
- Critical9.8SQL Injection
SCORM Cloud For WordPress
<1.0.7Update to 1.0.7
- Critical9.8SQL Injection
SearchAutocomplete
<1.0.9Update to 1.0.9
- Critical9.8Remote File Download
TimThumb
<2.0Update to 2.0
- Medium6.1Cross-Site Scripting
FV Flowplayer Video Player
≤1.2.11Update to 1.2.12
- High8.8SQL Injection
Social Slider
<7.4.2Update to 7.4.2
- Critical9.8Code Injection
WordPress Share Buttons Plugin – AddThis
<2.2.0Update to 2.2.0
- High8.8SQL Injection
WordPress
≤3.1.2Update to 3.1.3
- High8.8Arbitrary File Upload
WordPress
≤3.1.2Update to 3.1.3
- Medium5.3Username Enumeration
WordPress
≤3.1.2Update to 3.1.3
- Medium6.3Security Hardening
WordPress
≤3.1.2Update to 3.1.3
- Medium4.3Sensitive Information Disclosure
WordPress
≤3.1.2Update to 3.1.3
- High7.1Clickjacking
WordPress
≤3.1.2Update to 3.1.3
- Medium6.3Media Related Security Issue
WordPress
≤3.1.2Update to 3.2
- Critical9.8Unauthenticated Remote Code Execution
is-human
≤1.4.2No patch available
- Medium6.3Incorrect Authorization Checks
WordPress
<3.0.6Update to 3.0.6