CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1346)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | SQL Injection | CVE-2014-5201 | — | |
| Medium5.3 | Improper Input Validation | CVE-2014-6230 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-6312 | — | |
| Medium6.1 | 1.6.1 - Cross-Site Scripting | CVE-2014-3903 | — | |
| Medium6.3 | Multiple Cross-Site Request Forgery | CVE-2014-5346 | — | |
| High7.3 | Cross-Site Scripting via range Parameter | CVE-2014-6313 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2014-10388 | — | |
| Critical9.8 | SQL Injection | CVE-2014-10387 | — | |
| High7.5 | Arbitrary File Download | CVE-2014-10397 | — | |
| Critical9.8 | Arbitrary File Download | CVE-2014-10396 | — | |
| High8.8 | Responsive Photo Gallery <= 1.0.7 - SQL Injection | CVE-2014-7153 | — | |
| High8.8 | Arbitrary File Upload | CVE-2014-5460 | — | |
| Medium5.3 | Security Bypass Jetpack – AI Agents & MCP, Security, Backup & Analytics≤2.9.2Update to 1.9.4 or 2.0.9 or 2.1.4 or 2.2.7 or 2.3.7 or 2.4.4 or 2.5.2 or 2.6.3 or 2.7.2 or 2.8.2 or 2.9.3 | CVE-2014-0173 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-10385 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-125110 | — | |
| High7.2 | Arbitrary File Overwrite | CVE-2014-6059 | — | |
| High7.5 | Directory Traversal | CVE-2014-5368 | — | |
| Medium6.1 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2014-5196 | — | |
| Medium5.4 | Cross-Site Request Forgery | CVE-2014-5347 | — | |
| High8.3 | SQL Injection | CVE-2014-8375 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-5344 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2014-5199 | — | |
| Medium6.5 | Unauthenticated Stored Cross-Site Scripting | CVE-2014-125100 | — | |
| High7.1 | Reflected Cross-Site Scripting | CVE-2014-5190 | — | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting | CVE-2014-125095 | — | |
| Medium6.1 | Open Redirect | CVE-2018-17074 | — | |
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2014-125103 | — | |
| Medium6.5 | Brute Force of Cross-Site Request Forgery Tokens | CVE-2014-5205 | — | |
| High7.2 | Deserialization via Widgets | CVE-2014-5203 | — | |
| Critical9.8 | SQL Injection | CVE-2014-8363 | — |
- Critical9.8SQL Injection
gallery-objects
≤0.4No patch available
- Medium5.3Improper Input Validation
WP-Ban
<1.64Update to 1.64
- High7.1Cross-Site Scripting
Login Widget With Shortcode
<3.2.1Update to 3.2.1
- Medium6.11.6.1 - Cross-Site Scripting
Cakifo
1.0 – 1.6.1Update to 1.6.2
- Medium6.3Multiple Cross-Site Request Forgery
Disqus Comment System
<2.79Update to 2.79
- High7.3Cross-Site Scripting via range Parameter
WooCommerce
<2.2.3Update to 2.2.3
- Medium5.3Full Path Disclosure
WP Support Plus Responsive Ticket System
<4.2Update to 4.2
- Critical9.8SQL Injection
WP Support Plus Responsive Ticket System
<4.2Update to 4.2
- High7.5Arbitrary File Download
Antioch
≤1.3No patch available
- Critical9.8Arbitrary File Download
Epic Church by Organized Themes
≤3.6No patch available
- High8.8Responsive Photo Gallery <= 1.0.7 - SQL Injection
Image Gallery - Responsive Photo Gallery
≤1.0.7Update to 1.0.8
- High8.8Arbitrary File Upload
Slideshow Gallery LITE
<1.4.7Update to 1.4.7
- Medium5.3Security Bypass
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤2.9.2Update to 1.9.4 or 2.0.9 or 2.1.4 or 2.2.7 or 2.3.7 or 2.4.4 or 2.5.2 or 2.6.3 or 2.7.2 or 2.8.2 or 2.9.3
- Medium6.1Cross-Site Scripting
Memphis Documents Library
<3.0Update to 3.0
- Medium6.1Reflected Cross-Site Scripting
Iptanus File Upload
≤2.4.3Update to 2.4.4
- High7.2Arbitrary File Overwrite
Access Governance for WordPress (aka AAM)
<2.8.3Update to 2.8.3
- High7.5Directory Traversal
WP Source Control
<3.1.1Update to 3.1.1
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Improved user search in backend
≤1.2.5Update to 1.2.6
- Medium5.4Cross-Site Request Forgery
Disqus Comment System
<2.76Update to 2.76
- High8.3SQL Injection
GB Gallery Slideshow
<1.6Update to 1.6
- Medium6.1Cross-Site Scripting
MobiLoud – WordPress Mobile Apps – Convert your WordPress Website to Native Mobile Apps
<2.3.8Update to 2.3.8
- Medium6.3Cross-Site Request Forgery
Iptanus File Upload
<2.4.2Update to 2.4.2
- Medium6.5Unauthenticated Stored Cross-Site Scripting
Job Board by BestWebSoft
≤1.0.0Update to 1.0.1
- High7.1Reflected Cross-Site Scripting
SI Captcha Anti-spam
<2.7.6Update to 2.7.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
≤3.81Update to 3.82
- Medium6.1Open Redirect
Feed Statistics
<4.0Update to 4.0
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
BestWebSoft's Twitter
≤1.3.2Update to 1.3.7
- Medium6.5Brute Force of Cross-Site Request Forgery Tokens
WordPress
≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
- High7.2Deserialization via Widgets
WordPress
≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
- Critical9.8SQL Injection
WordPress Spreadsheet
≤0.62No patch available