VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 1343)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 1343)
SeverityVulnerabilityCVEInstallsPublished
Critical9.9Authenticated SQL Injection
WP Symposium<14.11Update to 14.11
CVE-2014-8810—
Medium6.1Cross-Site Scripting
WP Symposium≤14.10Update to 14.11
CVE-2014-8809—
Medium6.5Open Redirection
wordpress-admanager≤1.1.2No patch available
CVE-2014-8754—
Low3.5Cross-Site Scripting
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)≤5.1.2Update to 5.1.3
CVE-2014-9174—
Critical9.8Missing Authorization to Arbitrary File Upload
Showbiz Pro Responsive Teaser WordPress Plugin<1.7.1Update to 1.7.1
CVE-2014-9735—
Critical9.8Arbitrary File Upload
Showbiz Pro Responsive Teaser WordPress Plugin≤1.7.1No patch available
CVE-2015-9499—
High8.1Authenticated Arbitrary Options Update
Download Manager<2.7.3Update to 2.7.3
CVE-2014-9260—
Critical9.8SQL Injection
wpDataTables (Premium)≤1.5.3Update to 1.5.4
CVE-2014-9175—
High8.8Authenticated SQL Injection
Polls CP≤1.0.1Update to 1.0.2
CVE-2014-125091—
High8.1Hash Collision
WordPress≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
CVE-2014-9037—
Medium6.4Cross-Site Scripting via CSS
WordPress≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
CVE-2014-9036—
High8.8WordPress Core < 4.0.1 Cross-Site Request Forgery to Password Reset
WordPress≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
CVE-2014-9039—
Medium6.4Cross-Site Scripting
WordPress≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
CVE-2014-9035—
Medium6.4Cross-Site Scripting via Shortcode Brackets
WordPress≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
CVE-2014-9031—
Medium6.1Cross-Site Scripting
Polls CP<1.0.1Update to 1.0.1
CVE-2014-10395—
Medium5.3Denial of Service via Long Password
WordPress≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
CVE-2014-9034—
High7.7Server-Side Request Forgery
WordPress≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
CVE-2014-9038—
Critical9.8Multiple SQL Injection
SP Project & Document Manager<2.4.4Update to 2.4.4
CVE-2014-9178—
Medium6.1Cross-Site Scripting
Gallery Manager≤1.5.12Update to 1.5.13
CVE-2014-125096—
High7.2Cross-Site Scripting via media-playlists
WordPress≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
CVE-2014-9032—
High7.2Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder<2.8.9Update to 2.8.9
CVE-2015-2220—
High7.5Directory Traversal
WP Support Plus Responsive Ticket System<4.2Update to 4.2
CVE-2014-10390—
Critical9.8Improper Authentication
WP Support Plus Responsive Ticket System≤4.1Update to 4.2
CVE-2014-10389—
High7.5Directory Traversal
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions<1.7.15Update to 1.7.15
CVE-2014-8801—
High7.5Directory Traversal
DukaPress<2.5.4Update to 2.5.4
CVE-2014-8799—
Medium6.4Cross-Site Scripting
supportezzy≤1.2.5Update to 1.2.6
CVE-2014-9179—
Medium6.1Cross-Site Scripting
SpiderVPlayer≤1.5.1Update to 1.5.2
CVE-2014-8584—
Medium6.3SQL Injection
AWP Classifieds<3.0Update to 3.0
CVE-2014-10013—
Critical9.8Code Injection
CM Download Manager – Organize, Protect & Share Files in WordPress≤2.0.3Update to 2.0.4
CVE-2014-8877—
Medium6.1Cross-Site Scripting
AWP Classifieds<3.0Update to 3.0
CVE-2014-10012—

Search VulnCrest Radar

Jump to

Are you sure?