Database

WordPress Vulnerability Database (page 1442)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1442)
Severity	Vulnerability	CVE	Installs	Published
Critical9.8	Arbitrary File Upload kiddoall versionsNo patch available	—	—	Feb 9, 2014
High7.1	Cross-Site Scripting Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP<4.29.5Update to 4.29.5	CVE-2014-1906	—	Feb 6, 2014
Medium6.5	Authorization Bypass BuddyPress<1.9.2Update to 1.9.2	CVE-2014-1889	—	Feb 5, 2014
High7.3	Security Bypass Stop User Enumeration≤1.2.4Update to 1.2.5	—	—	Feb 3, 2014
Critical9.8	Arbitrary File Upload Dendelion≤2.6.5Update to 2.6.6	—	—	Jan 31, 2014
Medium6.4	Stored Cross-Site Scripting Media File Renamer: Rename Images & Files for SEO (AI-Powered)<1.9.4Update to 1.9.4	CVE-2014-2040	—	Jan 31, 2014
Critical9.8	Arbitrary File Upload amerisale-reall versionsNo patch available	—	—	Jan 30, 2014
Medium6.1	Cross-Site Scripting Photocrati≤4.8.0Update to 4.8.1	CVE-2014-100016	—	Jan 29, 2014
Medium6.1	Cross-Site Scripting seolinkrotator≤1.0No patch available	—	—	Jan 26, 2014
Medium6.1	Reflected Cross-Site Scripting Media Downloader≤0.1.992Update to 0.1.993	CVE-2014-125090	—	Jan 23, 2014
Medium6.1	Open Redirect Nokia Maps & Places<1.6.7Update to 1.6.7	CVE-2014-1750	—	Jan 20, 2014
Medium6.1	Cross-Site Scripting Social Ring (Facebook Like, Google +1, ReTweet, LinkedIn and Pin It)<1.2.0Update to 1.2.0	—	—	Jan 18, 2014
High8.8	Cross-Site Request Forgery Newsletter Manager<1.4Update to 1.4	CVE-2012-6629	—	Jan 16, 2014
Medium6.1	Cross-Site Scripting Chocolate WP – Responsive Photography Theme \| Photographyall versionsNo patch available	—	—	Jan 13, 2014
High7.5	Arbitrary File Download lote27all versionsNo patch available	—	—	Jan 9, 2014
High7.1	Reflected Cross-Site Scripting WP-Members Membership Plugin<2.8.10Update to 2.8.10	—	—	Jan 7, 2014
Medium6.1	Reflected Cross-Site Scripting April's Super Functions Pack≤1.4.7Update to 1.4.8	CVE-2014-100026	—	Jan 6, 2014
Medium6.1	Cross-Site Scripting URL Cloak & Encrypt<3.8.0Update to 3.8.0	CVE-2014-4563	—	Jan 5, 2014
Medium6.1	Cross-Site Scripting Foliopress WYSIWYG<2.6.8.5Update to 2.6.8.5	CVE-2014-1232	—	Jan 3, 2014
Medium6.1	Cross-Site Scripting intouch≤2.0No patch available	—	—	Jan 1, 2014
High7.5	Directory Traversal Advanced Dewplayer≤1.2Update to 1.3	CVE-2013-7240	—	Dec 30, 2013
Medium4.7	Content Spoofing flash-player-widgetall versionsNo patch available	—	—	Dec 30, 2013
Medium6.1	Cross-Site Scripting WP-Cron Dashboard<1.1.6Update to 1.1.6	CVE-2013-6991	—	Dec 26, 2013
High8.8	Cross-Site Request Forgery AskApache Firefox Adsense≤3.0No patch available	CVE-2013-6992	—	Dec 26, 2013
Medium6.1	Cross-Site Scripting Recommend to a friend≤2.2.2No patch available	CVE-2013-7276	—	Dec 24, 2013
High8.6	Content Spoofing/Injection Advanced Dewplayer<1.5Update to 1.5	—	—	Dec 23, 2013
Medium6.1	Cross-Site Scripting repagentall versionsNo patch available	—	—	Dec 19, 2013
High7.5	Arbitrary File Deletion Echelon≤2.4Update to 2.5	—	—	Dec 17, 2013
High8.8	Cross-Site Request Forgery to Denial of Service WordPress≤2.0.11Update to 2.1	CVE-2013-7233	—	Dec 17, 2013
High7.5	Arbitrary File Download Awake≤3.3Update to 3.4	—	—	Dec 17, 2013

Critical9.8
Arbitrary File Upload
kiddo
all versionsNo patch available
d9450e6b-df5e-4265-a3df-08cb10eb8dc0Feb 9, 2014
High7.1
Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
CVE-2014-1906Feb 6, 2014
Medium6.5
Authorization Bypass
BuddyPress
<1.9.2Update to 1.9.2
CVE-2014-1889Feb 5, 2014
High7.3
Security Bypass
Stop User Enumeration
≤1.2.4Update to 1.2.5
f8a653ab-7703-4e73-8089-a15ba6cf9718Feb 3, 2014
Critical9.8
Arbitrary File Upload
Dendelion
≤2.6.5Update to 2.6.6
d0fb6bf0-48b8-48cc-8080-8fe19c36ce7cJan 31, 2014
Medium6.4
Stored Cross-Site Scripting
Media File Renamer: Rename Images & Files for SEO (AI-Powered)
<1.9.4Update to 1.9.4
CVE-2014-2040Jan 31, 2014
Critical9.8
Arbitrary File Upload
amerisale-re
all versionsNo patch available
339ab2b6-ca5e-41a8-ad32-9d2a271fb320Jan 30, 2014
Medium6.1
Cross-Site Scripting
Photocrati
≤4.8.0Update to 4.8.1
CVE-2014-100016Jan 29, 2014
Medium6.1
Cross-Site Scripting
seolinkrotator
≤1.0No patch available
0f6fa9c6-8a2b-49ca-ad7f-3aa51d671422Jan 26, 2014
Medium6.1
Reflected Cross-Site Scripting
Media Downloader
≤0.1.992Update to 0.1.993
CVE-2014-125090Jan 23, 2014
Medium6.1
Open Redirect
Nokia Maps & Places
<1.6.7Update to 1.6.7
CVE-2014-1750Jan 20, 2014
Medium6.1
Cross-Site Scripting
Social Ring (Facebook Like, Google +1, ReTweet, LinkedIn and Pin It)
<1.2.0Update to 1.2.0
0db32d66-4def-4356-96d8-74ba49e7604aJan 18, 2014
High8.8
Cross-Site Request Forgery
Newsletter Manager
<1.4Update to 1.4
CVE-2012-6629Jan 16, 2014
Medium6.1
Cross-Site Scripting
Chocolate WP – Responsive Photography Theme | Photography
all versionsNo patch available
fe799030-ec9c-45fd-a5a9-6589364b6056Jan 13, 2014
High7.5
Arbitrary File Download
lote27
all versionsNo patch available
eae1ee2c-1be5-4be5-8873-f99c8fdd41baJan 9, 2014
High7.1
Reflected Cross-Site Scripting
WP-Members Membership Plugin
<2.8.10Update to 2.8.10
379408c3-399d-4aff-9a6b-43913aaa52b7Jan 7, 2014
Medium6.1
Reflected Cross-Site Scripting
April's Super Functions Pack
≤1.4.7Update to 1.4.8
CVE-2014-100026Jan 6, 2014
Medium6.1
Cross-Site Scripting
URL Cloak & Encrypt
<3.8.0Update to 3.8.0
CVE-2014-4563Jan 5, 2014
Medium6.1
Cross-Site Scripting
Foliopress WYSIWYG
<2.6.8.5Update to 2.6.8.5
CVE-2014-1232Jan 3, 2014
Medium6.1
Cross-Site Scripting
intouch
≤2.0No patch available
13a1e293-f539-4d19-8fe8-392c126fd1c4Jan 1, 2014
High7.5
Directory Traversal
Advanced Dewplayer
≤1.2Update to 1.3
CVE-2013-7240Dec 30, 2013
Medium4.7
Content Spoofing
flash-player-widget
all versionsNo patch available
938e8f54-56f0-4066-bc78-ebfc2abe0743Dec 30, 2013
Medium6.1
Cross-Site Scripting
WP-Cron Dashboard
<1.1.6Update to 1.1.6
CVE-2013-6991Dec 26, 2013
High8.8
Cross-Site Request Forgery
AskApache Firefox Adsense
≤3.0No patch available
CVE-2013-6992Dec 26, 2013
Medium6.1
Cross-Site Scripting
Recommend to a friend
≤2.2.2No patch available
CVE-2013-7276Dec 24, 2013
High8.6
Content Spoofing/Injection
Advanced Dewplayer
<1.5Update to 1.5
62687f24-4be2-49de-9a7d-265325b0f72bDec 23, 2013
Medium6.1
Cross-Site Scripting
repagent
all versionsNo patch available
d557ccb4-99c3-4286-91cd-87576a95f179Dec 19, 2013
High7.5
Arbitrary File Deletion
Echelon
≤2.4Update to 2.5
f1060875-21dc-41fb-866a-940e6aeb3c22Dec 17, 2013
High8.8
Cross-Site Request Forgery to Denial of Service
WordPress
≤2.0.11Update to 2.1
CVE-2013-7233Dec 17, 2013
High7.5
Arbitrary File Download
Awake
≤3.3Update to 3.4
e2510cee-d9d7-4b30-bf94-254a1dec9bd8Dec 17, 2013