Database

WordPress Vulnerability Database (page 1454)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1454)
Severity	Vulnerability	CVE	Installs	Published
High8.8	Arbitrary File Upload SB Uploader≤4.8No patch available	—	—	Dec 30, 2012
Critical9.8	Arbitrary File Upload sintic_galleryall versionsNo patch available	—	—	Dec 30, 2012
Medium5.4	Missing Session Cookie Expiration WordPress<4.0Update to 4.0	CVE-2012-5868	—	Dec 27, 2012
Critical9.8	SQL Injection Oberliga Themeall versionsNo patch available	—	—	Dec 26, 2012
High7.2	SQL Injection Album and Image Gallery with Lightbox – Flagallery Photo Portfolio<2.10Update to 2.10	—	—	Dec 24, 2012
High8.8	SQL Injection Album and Image Gallery with Lightbox – Flagallery Photo Portfolio≤2.00Update to 2.10	—	—	Dec 24, 2012
Medium4.9	Arbitrary File Modification Album and Image Gallery with Lightbox – Flagallery Photo Portfolio≤2.00Update to 2.10	—	—	Dec 24, 2012
High7.2	Arbitrary File Deletion Album and Image Gallery with Lightbox – Flagallery Photo Portfolio<3.1.0Update to 3.1.0	—	—	Dec 24, 2012
High7.5	Full Path Disclosure Grou Random Image Widgetall versionsNo patch available	—	—	Dec 24, 2012
High7.2	SQL Injection Album and Image Gallery with Lightbox – Flagallery Photo Portfolio<2.53Update to 2.53	—	—	Dec 24, 2012
Medium4.9	Sensitive Information Disclosure Album and Image Gallery with Lightbox – Flagallery Photo Portfolio<2.53Update to 2.53	—	—	Dec 24, 2012
Medium5.3	Full Path Disclosure appius<1.1Update to 1.1	—	—	Dec 24, 2012
Critical9.8	Arbitrary File Upload Clockstone≤1.2No patch available	—	—	Dec 19, 2012
Medium5.3	Abuse of Functionality WordPress RokBox≤2.13No patch available	—	—	Dec 17, 2012
High7.5	Full Path Disclosure WordPress RokBox≤2.13No patch available	—	—	Dec 17, 2012
Critical9.8	Arbitrary File Upload WordPress RokBox≤2.13No patch available	—	—	Dec 17, 2012
Critical9.1	Content Spoofing WordPress RokBox≤2.13No patch available	—	—	Dec 17, 2012
Medium6.1	Cross-Site Scripting WordPress RokBox≤2.13No patch available	—	—	Dec 17, 2012
High7.5	Denial of Service WordPress RokBox≤2.13No patch available	—	—	Dec 17, 2012
Medium5.3	Sensitive Data Disclosure WordPress RokBox≤2.13No patch available	—	—	Dec 17, 2012
Medium6.1	Cross-Site Scripting Welcart e-Commerce<1.2.2Update to 1.2.2	CVE-2012-5177	—	Dec 14, 2012
High8.8	Cross-Site Request Forgery Welcart e-Commerce<1.2.2Update to 1.2.2	CVE-2012-5178	—	Dec 14, 2012
High8.8	Cross-Site Request Forgery Knews Multilingual Newsletters<1.2.6Update to 1.2.6	—	—	Dec 12, 2012
Medium5.3	Full Path Disclosure onepagewebsiteall versionsNo patch available	—	—	Dec 4, 2012
Medium6.1	Reflected Cross-Site Scripting BuddyStream≤3.6.2Update to 3.6.3	CVE-2012-10007	—	Dec 4, 2012
Medium5.3	Full Path Disclosure Vithyall versionsNo patch available	—	—	Dec 4, 2012
Critical9.8	Remote File Inclusion via fsml-admin.js.php wpp parameter Floating Social Media Links<1.4.3Update to 1.4.3	—	—	Dec 2, 2012
Critical9.8	Remote File Inclusion via fsml-hideshow.js.php wpp parameter Floating Social Media Links<1.4.3Update to 1.4.3	—	—	Dec 2, 2012
Critical9.8	Premium WordPress Theme \| Portfolio (Unspecified Version) - Arbitrary File Upload Yvora - Premium WordPress Theme \| Portfolioall versionsNo patch available	—	—	Nov 30, 2012
Critical9.8	Arbitrary File Upload dagda≤5.0No patch available	—	—	Nov 30, 2012

High8.8
Arbitrary File Upload
SB Uploader
≤4.8No patch available
4c9aabb6-d17c-4845-ae1b-6ee3d8b9bfb1Dec 30, 2012
Critical9.8
Arbitrary File Upload
sintic_gallery
all versionsNo patch available
3d438d11-df72-431e-8956-6a7b316a6dc3Dec 30, 2012
Medium5.4
Missing Session Cookie Expiration
WordPress
<4.0Update to 4.0
CVE-2012-5868Dec 27, 2012
Critical9.8
SQL Injection
Oberliga Theme
all versionsNo patch available
a0695f66-5932-4ca4-86d3-ef53f1a669b5Dec 26, 2012
High7.2
SQL Injection
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
<2.10Update to 2.10
a08ea797-a836-4a21-bfca-2c05810d25cdDec 24, 2012
High8.8
SQL Injection
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤2.00Update to 2.10
a4c1f966-aa10-45cc-9fb0-2e703dd3098eDec 24, 2012
Medium4.9
Arbitrary File Modification
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤2.00Update to 2.10
9e21d279-aa83-42ff-9906-bc61dc4aba52Dec 24, 2012
High7.2
Arbitrary File Deletion
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
<3.1.0Update to 3.1.0
6d5ef392-6aea-4fab-95ce-d36d1cd17026Dec 24, 2012
High7.5
Full Path Disclosure
Grou Random Image Widget
all versionsNo patch available
272c824a-0883-4c23-a814-bf0db3fec8a6Dec 24, 2012
High7.2
SQL Injection
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
<2.53Update to 2.53
2c648ea4-7df6-4a77-9bc5-bd3c18979250Dec 24, 2012
Medium4.9
Sensitive Information Disclosure
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
<2.53Update to 2.53
1197a66e-4557-458f-b8fd-b7a8e7586817Dec 24, 2012
Medium5.3
Full Path Disclosure
appius
<1.1Update to 1.1
f06f0492-c03d-44d7-9441-4d79f89e5c1fDec 24, 2012
Critical9.8
Arbitrary File Upload
Clockstone
≤1.2No patch available
eee9d564-5d52-47fa-a6a5-b908bb64a2baDec 19, 2012
Medium5.3
Abuse of Functionality
WordPress RokBox
≤2.13No patch available
ec2181cb-dfb2-43d5-90e8-c68d0d98c98bDec 17, 2012
High7.5
Full Path Disclosure
WordPress RokBox
≤2.13No patch available
581792f3-7b57-418c-802b-2ff04f5b83bfDec 17, 2012
Critical9.8
Arbitrary File Upload
WordPress RokBox
≤2.13No patch available
3b4e92a1-cac7-445d-a47c-52058e652c09Dec 17, 2012
Critical9.1
Content Spoofing
WordPress RokBox
≤2.13No patch available
366e5302-3edc-4bc8-8d84-9e0ee7abb25aDec 17, 2012
Medium6.1
Cross-Site Scripting
WordPress RokBox
≤2.13No patch available
b2ef036e-14a5-40df-93c3-ab1a1d9accc0Dec 17, 2012
High7.5
Denial of Service
WordPress RokBox
≤2.13No patch available
ac27f20a-2048-46f3-b84f-43e2d4a345d2Dec 17, 2012
Medium5.3
Sensitive Data Disclosure
WordPress RokBox
≤2.13No patch available
a63f0b4b-ad8f-4daf-9450-133bf08c2de1Dec 17, 2012
Medium6.1
Cross-Site Scripting
Welcart e-Commerce
<1.2.2Update to 1.2.2
CVE-2012-5177Dec 14, 2012
High8.8
Cross-Site Request Forgery
Welcart e-Commerce
<1.2.2Update to 1.2.2
CVE-2012-5178Dec 14, 2012
High8.8
Cross-Site Request Forgery
Knews Multilingual Newsletters
<1.2.6Update to 1.2.6
f52d5c44-4a5e-4a45-b622-66aa4e509fd8Dec 12, 2012
Medium5.3
Full Path Disclosure
onepagewebsite
all versionsNo patch available
f72de600-b9d8-4d91-9c80-f2df2a2ef435Dec 4, 2012
Medium6.1
Reflected Cross-Site Scripting
BuddyStream
≤3.6.2Update to 3.6.3
CVE-2012-10007Dec 4, 2012
Medium5.3
Full Path Disclosure
Vithy
all versionsNo patch available
114ff636-6b51-43a2-b2c8-19e01e94176fDec 4, 2012
Critical9.8
Remote File Inclusion via fsml-admin.js.php wpp parameter
Floating Social Media Links
<1.4.3Update to 1.4.3
ecd35d5a-5270-4132-bc62-d75da5141313Dec 2, 2012
Critical9.8
Remote File Inclusion via fsml-hideshow.js.php wpp parameter
Floating Social Media Links
<1.4.3Update to 1.4.3
43d1f708-58bd-4d42-b8dd-0c1247546577Dec 2, 2012
Critical9.8
Premium WordPress Theme | Portfolio (Unspecified Version) - Arbitrary File Upload
Yvora - Premium WordPress Theme | Portfolio
all versionsNo patch available
370fbe22-df48-4f64-ba7f-5ab98b908f58Nov 30, 2012
Critical9.8
Arbitrary File Upload
dagda
≤5.0No patch available
908dbe64-e214-4880-a85d-38df4c722a43Nov 30, 2012