VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 1347)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 1347)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Cross-Site Scripting
WordPress Spreadsheet≤0.62No patch available
CVE-2014-8364—
Medium6.5Brute Force of Cross-Site Request Forgery Tokens
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5205—
Critical9.8SQL Injection
WordPress Spreadsheet≤0.62No patch available
CVE-2014-8363—
High8.8Cross-Site Request Forgery to Authentication Takeover
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-9033—
High7.2Deserialization via Widgets
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5203—
Low3.8Authenticated Cross-Site Scripting via Avatar URL
WordPress≤3.9.1Update to 3.7.4 or 3.8.4 or 3.9.2
CVE-2014-5240—
Medium5.3XML External Entity (XXE) Weakness
WordPress<3.9.2Update to 3.9.2
CVE-2014-2053—
Medium6.3Cross-Site Request Forgery
Cart66 Lite :: WordPress Ecommerce<1.5.1.15Update to 1.5.1.15
CVE-2013-5977—
Medium6.1Cross-Site Scripting
Adminimize≤1.7.21Update to 1.7.22
CVE-2011-4926—
Medium6.1Cross-Site Scripting
Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider≤2.5Update to 2.6
CVE-2014-4846—
Critical9.8Unrestricted File Upload
gravity-file-ajax-upload-free≤1.1No patch available
CVE-2014-4972—
High7.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Quick Page/Post Redirect Plugin<5.0.5Update to 5.0.5
CVE-2014-2598—
Medium6.1DOM Cross-Site Scripting
Image Slider<1.1.7Update to 1.1.7
CVE-2013-6837—
Critical9.9Authenticated SQL Injection
BSK PDF Manager<1.5Update to 1.5
CVE-2014-4944—
High7.1Cross-Site Scripting
WP Symposium<13.04Update to 13.04
CVE-2013-2695—
Medium6.1Multiple Cross-Site Scripting
WP Super Cache≤1.3Update to 1.3.1
CVE-2013-2008—
Medium6.1Cross-Site Scripting
wp-media-player≤0.8No patch available
CVE-2014-4589—
Medium6.1Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More≤0.4.4Update to 0.4.5
CVE-2013-46251M+
Medium6.1Cross-Site Scripting
XEN Carousel≤0.12.2No patch available
CVE-2014-4602—
High8.8Cross-Site Request Forgery
WP Activity Log<1.2.5Update to 1.2.5
CVE-2014-5072—
Medium6.1Unauthenticated Multiple Cross-Site Scripting
Media Library Categories≤1.1.1No patch available
CVE-2012-6630—
Critical9.8SQL Injection
Yoast Duplicate Post≤2.5Update to 2.6
CVE-2014-10379—
Medium6.1Cross-Site Scripting
WP Symposium≤11.11.26Update to 11.12.08
CVE-2011-3841—
Medium6.1Cross-Site Scripting
Events Manager Pro<2.2.9Update to 2.2.9
CVE-2013-1407—
High7.3Unspecified Vulnerability
Image News Slider≤3.2Update to 3.3
CVE-2012-4327—
Critical9.8Arbitrary File Upload
WordPress Font Uploader≤1.3Update to 1.3.1
CVE-2012-3814—
Critical9.8Remote File Inclusion
WP-Table≤1.43Update to 1.44
CVE-2007-2484—
High8.8Cross-Site Request Forgery
underConstruction<1.09Update to 1.09
CVE-2013-2699—
Medium6.1Reflected Cross-Site Scripting
WP App Maker≤1.0.16.4No patch available
CVE-2014-4578—
Medium6.1Cross-Site Scripting
bib2html≤0.9.3No patch available
CVE-2014-3870—

Search VulnCrest Radar

Jump to

Are you sure?