Database

Critical WordPress vulnerabilities (page 1383)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

Critical WordPress vulnerabilities (page 1383)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Authenticated (Admin+) Stored Cross-Site Scripting WP-ContactForm≤1.5No patch available	CVE-2008-0197	—	Jan 13, 2008
Critical9.8	Arbitrary File Upload wp-FileManager≤1.2Update to 1.3	CVE-2008-0222	—	Jan 6, 2008
Medium6.1	Reflected Cross-Site Scripting Math Comment Spam Protection≤2.1Update to 2.2	CVE-2008-0204	—	Jan 3, 2008
High8.8	Cross-Site Request Forgery WP-ContactForm≤1.5.1No patch available	CVE-2008-0198	—	Jan 3, 2008
Critical9.8	2.3.1 - Authorization Bypass WordPress1.5 – 2.3.1Update to 2.3.2	CVE-2007-6013	—	Dec 29, 2007
Medium5.3	Full Path Disclosure WordPress≤2.4Update to 2.5	CVE-2008-0191	—	Dec 16, 2007
High7.5	Directory Traversal PictPress≤0.91Update to 0.99	CVE-2007-6369	—	Dec 5, 2007
High7.2	Cross-Site Scripting Cryptographp≤1.2No patch available	CVE-2008-0203	—	Nov 28, 2007
High7.1	Cross-Site Scripting Captcha!≤2.5dUpdate to 2.6	CVE-2008-0206	—	Nov 26, 2007
High8.8	Cross-Site Request Forgery Math Comment Spam Protection≤2.1Update to 2.2	CVE-2008-0205	—	Nov 23, 2007
Medium6.1	Cross-Site Scripting Peter's Random Anti-Spam Image≤1.0.6No patch available	CVE-2007-6677	—	Nov 12, 2007
Critical9.8	Remote File Inclusion BackUpWordPress<0.4.3Update to 0.4.3	CVE-2007-5800	—	Nov 1, 2007
Medium6.4	Cross-Site Scripting WordPress≤2.3Update to 2.3.1	CVE-2007-5710	—	Oct 26, 2007
High8.8	Cross-Site Request Forgery feedburner-feedsmith≤2.2Update to 2.3	CVE-2007-5229	—	Oct 4, 2007
Medium6.4	Cross-Site Scripting WordPress≤2.0.3Update to 2.0.4	CVE-2007-5106	—	Sep 21, 2007
Critical9.8	SQL Injection WordPress≤2.3.1Update to 2.3.2	CVE-2007-6318	—	Sep 8, 2007
Critical9.8	SQL Injection WordPress<2.2.3Update to 2.2.3	CVE-2007-4894	—	Sep 8, 2007
Medium5.3	Restriction Bypass WordPress≤2.2.2Update to 2.2.3	CVE-2008-2146	—	Sep 8, 2007
High8.8	Remote Code Execution WordPress≤2.3.2Update to 2.3.3	CVE-2008-5695	—	Sep 8, 2007
Medium6.5	Improper Authorization Checks WordPress≤2.3.2Update to 2.3.3	CVE-2008-0664	—	Sep 8, 2007
Medium6.1	Cross-Site Scripting WordPress MU≤1.0Update to 1.1.1	CVE-2007-4544	—	Aug 22, 2007
Medium6.1	Cross-Site Scripting Sirius≤1.0No patch available	CVE-2007-4480	—	Aug 17, 2007
Medium6.1	Cross-Site Scripting Blix≤0.9.1No patch available	CVE-2007-4481	—	Aug 17, 2007
Medium6.1	Reflected Cross-Site Scripting Pool≤1.0.7Update to 1.1	CVE-2007-4482	—	Aug 13, 2007
Medium6.1	Cross-Site Scripting Classic≤1.5Update to 1.6	CVE-2007-4483	—	Aug 12, 2007
Medium6.1	Open Redirect WordPress≤2.2.1Update to 2.2.2	CVE-2007-3639	—	Aug 8, 2007
Medium6.1	Cross-Site Scripting Blue Memories≤1.5Update to 1.5.0.1	CVE-2007-4165	—	Aug 6, 2007
Medium6.4	Cross-Site Scripting WordPress≤2.2.2Update to 2.2.3	CVE-2007-4893	—	Aug 5, 2007
High8.8	Arbitrary File Upload WordPress≤2.2.1Update to 2.2.2	CVE-2007-3544	—	Aug 5, 2007
High8.8	SQL Injection WordPress≤2.2.1Update to 2.0.11 or 2.2.2	CVE-2007-4154	—	Aug 5, 2007

Medium6.1
Authenticated (Admin+) Stored Cross-Site Scripting
WP-ContactForm
≤1.5No patch available
CVE-2008-0197Jan 13, 2008
Critical9.8
Arbitrary File Upload
wp-FileManager
≤1.2Update to 1.3
CVE-2008-0222Jan 6, 2008
Medium6.1
Reflected Cross-Site Scripting
Math Comment Spam Protection
≤2.1Update to 2.2
CVE-2008-0204Jan 3, 2008
High8.8
Cross-Site Request Forgery
WP-ContactForm
≤1.5.1No patch available
CVE-2008-0198Jan 3, 2008
Critical9.8
2.3.1 - Authorization Bypass
WordPress
1.5 – 2.3.1Update to 2.3.2
CVE-2007-6013Dec 29, 2007
Medium5.3
Full Path Disclosure
WordPress
≤2.4Update to 2.5
CVE-2008-0191Dec 16, 2007
High7.5
Directory Traversal
PictPress
≤0.91Update to 0.99
CVE-2007-6369Dec 5, 2007
High7.2
Cross-Site Scripting
Cryptographp
≤1.2No patch available
CVE-2008-0203Nov 28, 2007
High7.1
Cross-Site Scripting
Captcha!
≤2.5dUpdate to 2.6
CVE-2008-0206Nov 26, 2007
High8.8
Cross-Site Request Forgery
Math Comment Spam Protection
≤2.1Update to 2.2
CVE-2008-0205Nov 23, 2007
Medium6.1
Cross-Site Scripting
Peter's Random Anti-Spam Image
≤1.0.6No patch available
CVE-2007-6677Nov 12, 2007
Critical9.8
Remote File Inclusion
BackUpWordPress
<0.4.3Update to 0.4.3
CVE-2007-5800Nov 1, 2007
Medium6.4
Cross-Site Scripting
WordPress
≤2.3Update to 2.3.1
CVE-2007-5710Oct 26, 2007
High8.8
Cross-Site Request Forgery
feedburner-feedsmith
≤2.2Update to 2.3
CVE-2007-5229Oct 4, 2007
Medium6.4
Cross-Site Scripting
WordPress
≤2.0.3Update to 2.0.4
CVE-2007-5106Sep 21, 2007
Critical9.8
SQL Injection
WordPress
≤2.3.1Update to 2.3.2
CVE-2007-6318Sep 8, 2007
Critical9.8
SQL Injection
WordPress
<2.2.3Update to 2.2.3
CVE-2007-4894Sep 8, 2007
Medium5.3
Restriction Bypass
WordPress
≤2.2.2Update to 2.2.3
CVE-2008-2146Sep 8, 2007
High8.8
Remote Code Execution
WordPress
≤2.3.2Update to 2.3.3
CVE-2008-5695Sep 8, 2007
Medium6.5
Improper Authorization Checks
WordPress
≤2.3.2Update to 2.3.3
CVE-2008-0664Sep 8, 2007
Medium6.1
Cross-Site Scripting
WordPress MU
≤1.0Update to 1.1.1
CVE-2007-4544Aug 22, 2007
Medium6.1
Cross-Site Scripting
Sirius
≤1.0No patch available
CVE-2007-4480Aug 17, 2007
Medium6.1
Cross-Site Scripting
Blix
≤0.9.1No patch available
CVE-2007-4481Aug 17, 2007
Medium6.1
Reflected Cross-Site Scripting
Pool
≤1.0.7Update to 1.1
CVE-2007-4482Aug 13, 2007
Medium6.1
Cross-Site Scripting
Classic
≤1.5Update to 1.6
CVE-2007-4483Aug 12, 2007
Medium6.1
Open Redirect
WordPress
≤2.2.1Update to 2.2.2
CVE-2007-3639Aug 8, 2007
Medium6.1
Cross-Site Scripting
Blue Memories
≤1.5Update to 1.5.0.1
CVE-2007-4165Aug 6, 2007
Medium6.4
Cross-Site Scripting
WordPress
≤2.2.2Update to 2.2.3
CVE-2007-4893Aug 5, 2007
High8.8
Arbitrary File Upload
WordPress
≤2.2.1Update to 2.2.2
CVE-2007-3544Aug 5, 2007
High8.8
SQL Injection
WordPress
≤2.2.1Update to 2.0.11 or 2.2.2
CVE-2007-4154Aug 5, 2007