CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1333)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | Arbitrary File Upload | CVE-2015-9471 | — | |
| Medium6.1 | Open Redirect | CVE-2015-4070 | — | |
| Medium6.1 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2015-4140 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-4139 | — | |
| Critical9.8 | SQL Injection | CVE-2015-2090 | — | |
| High8.8 | SQL Injection | CVE-2014-5183 | — | |
| Medium5.8 | Open Proxy | CVE-2015-4339 | — | |
| High8.8 | SQL Injection | CVE-2015-4066 | — | |
| High8.8 | Multiple Cross-Site Request Forgery | CVE-2015-4089 | — | |
| Medium6.5 | Cross-Site Scripting | CVE-2015-4065 | — | |
| Medium5.4 | Authenticated Cross-Site Scripting | CVE-2015-4063 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-4064 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-4062 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2015-4084 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-10131 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9300 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2015-4127 | — | |
| High8.8 | Privilege Escalation | CVE-2015-4038 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2015-4039 | — | |
| Medium6.1 | Reflecte Cross-Site Scripting | CVE-2015-10095 | — | |
| High7.2 | Authenticated (Admin+) Remote Code Execution | CVE-2015-3173 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9346 | — | |
| High7.1 | Cross-Site Scripting | CVE-2015-3647 | — | |
| Critical9.8 | SQL Injection | CVE-2015-4018 | — | |
| High7.5 | Arbitrary File Download via Path Traversal | CVE-2015-10134 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-5034 | — | |
| High7.5 | Sensitive Information Disclosure | CVE-2015-9489 | — | |
| High7.5 | Sensitive Information Disclosure | CVE-2015-9485 | — | |
| High7.5 | Sensitive Information Disclosure | CVE-2015-9487 | — | |
| High7.5 | Sensitive Information Disclosure | CVE-2015-9488 | — |
- Critical9.8Arbitrary File Upload
ZoomSounds - WordPress Wave Audio Player with Playlist
<3.0Update to 3.0
- Medium6.1Open Redirect
Wow Moodboard Lite
≤1.1.1.1No patch available
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
wp-smiley
≤1.4.1No patch available
- Medium6.1Cross-Site Scripting
wp-smiley
≤1.4.1No patch available
- Critical9.8SQL Injection
WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress
<1.2Update to 1.2
- High8.8SQL Injection
Simple Retail Menus
≤4.0.1Update to 4.1
- Medium5.8Open Proxy
Gmedia Photo Gallery
<1.6.5Update to 1.6.5
- High8.8SQL Injection
GigPress
<2.3.9Update to 2.3.9
- High8.8Multiple Cross-Site Request Forgery
WP Fastest Cache – WordPress Cache Plugin
<0.8.3.5Update to 0.8.3.5
- Medium6.5Cross-Site Scripting
WordPress Landing Pages
<1.8.5Update to 1.8.5
- Medium5.4Authenticated Cross-Site Scripting
NewStatPress
≤0.9.8Update to 0.9.9
- High8.8Authenticated SQL Injection
WordPress Landing Pages
<1.8.5Update to 1.8.5
- High8.8Authenticated SQL Injection
NewStatPress
≤0.9.8Update to 0.9.9
- High7.2Stored Cross-Site Scripting
Free counter
≤1.1Update to 1.2
- Medium6.1Reflected Cross-Site Scripting
TFO Graphviz
≤1.9Update to 1.10
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.5.7Update to 5.5.7
- Medium6.1Stored Cross-Site Scripting
Church Admin
<0.810Update to 0.810
- High8.8Privilege Escalation
WP Membership
≤1.2.3No patch available
- Medium5.4Cross-Site Scripting
WP Membership
≤1.2.3No patch available
- Medium6.1Reflecte Cross-Site Scripting
woo-popup
≤1.2.2Update to 1.3.0
- High7.2Authenticated (Admin+) Remote Code Execution
Custom Content Type Manager
≤0.9.8.5Update to 0.9.8.6
- Medium6.1Cross-Site Scripting
Polls CP
<1.0.5Update to 1.0.5
- High7.1Cross-Site Scripting
WP Photo Album Plus
<6.1.3Update to 6.1.3
- Critical9.8SQL Injection
FeedWordPress
<2015.0514Update to 2015.0514
- High7.5Arbitrary File Download via Path Traversal
Simple Backup
<2.7.11Update to 2.7.11
- High8.8Cross-Site Request Forgery
Brute Force Login Protection
≤1.5.1No patch available
- High7.5Sensitive Information Disclosure
Goodnex Responsive HTML5/CSS3 Site Template
<1.1.3Update to 1.1.3
- High7.5Sensitive Information Disclosure
Accio | Responsive Onepage Parallax Site Template
<1.1.1Update to 1.1.1
- High7.5Sensitive Information Disclosure
Almera Responsive Portfolio Site Template
<1.1.8Update to 1.1.8
- High7.5Sensitive Information Disclosure
Almera Responsive Portfolio Site Template
<1.1.8Update to 1.1.8