CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 1348)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 1348)
Severity	Vulnerability	CVE	Installs	Published
Critical9.8	Arbitrary File Upload WordPress Font Uploader≤1.3Update to 1.3.1	CVE-2012-3814	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Events Manager Pro<2.2.9Update to 2.2.9	CVE-2013-1407	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery underConstruction<1.09Update to 1.09	CVE-2013-2699	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Count per Day≤3.1.1Update to 3.2	CVE-2012-3434	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting WP Construction Mode≤1.8Update to 1.9	CVE-2014-4854	—	Aug 1, 2014
Medium6.1	Unauthenticated Stored Cross-Site Scripting Mail Subscribe List≤2.0.9Update to 2.1	CVE-2013-10026	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting Redirection<2.2.9Update to 2.2.9	CVE-2011-5329	—	Aug 1, 2014
Critical9.8	Local/Remote File Inclusion SlideDeck 2 Lite Responsive Content Slider≤2.3.3Update to 2.3.5	CVE-2013-7483	—	Aug 1, 2014
Critical9.8	Arbitrary File Upload MailPoet Newsletters (Previous)≤2.6.6Update to 2.6.7	CVE-2014-4725	—	Aug 1, 2014
Medium6.1	Cross-Site scripting Hot Files: File Sharing and Download Manager Plugin≤1.0.0No patch available	CVE-2014-4588	—	Aug 1, 2014
High7.1	Cross-Site Scripting Polylang<1.5.2Update to 1.5.2	CVE-2014-4855	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting bib2html≤0.9.3No patch available	CVE-2014-3870	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Stream Video Player≤1.4.1No patch available	CVE-2013-2706	—	Aug 1, 2014
Medium5.3	Full Path Disclosure WP PHP widget≤1.0.2No patch available	CVE-2013-0721	—	Aug 1, 2014
Medium5.3	Cross-Site Scripting Redirection<2.2.10Update to 2.2.10	CVE-2011-4562	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Disable Comments<1.0.4Update to 1.0.4	CVE-2014-2550	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Tweet Blender≤4.0.1Update to 4.0.2	CVE-2013-6342	—	Aug 1, 2014
Medium6.4	Stored Cross-Site Scripting BuddyPress≤1.9.1Update to 1.9.2	CVE-2014-1888	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting custom-tables≤3.4.4No patch available	CVE-2012-20003	—	Aug 1, 2014
Medium6.1	Multiple Cross-Site Scripting Uploader≤1.0.4No patch available	CVE-2013-2287	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting WP App Maker≤1.0.16.4No patch available	CVE-2014-4578	—	Aug 1, 2014
Critical9.8	Remote Code Execution WP Super Cache<1.3.2Update to 1.3.2	CVE-2013-2011	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery sexybookmarks≤6.1.4.0Update to 6.1.5.0	CVE-2013-3256	—	Aug 1, 2014
Medium5.3	Information Disclosure Portable phpMyAdmin≤1.4.1No patch available	CVE-2013-4454	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Album and Image Gallery with Lightbox – Flagallery Photo Portfolio≤2.71Update to 2.72	CVE-2013-3261	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting DZS Video Gallery<7.95Update to 7.95	CVE-2014-3923	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting WPCB≤2.4.8No patch available	CVE-2014-4581	—	Aug 1, 2014
Medium4.3	Cross-Site Request Forgery WordPress Related Posts<2.7.2Update to 2.7.2	CVE-2013-3476	—	Aug 1, 2014
Medium6.1	Multiple Cross-Site Scripting Pie Register – User Registration, Profiles & Content Restriction≤1.30Update to 1.31	CVE-2013-4954	—	Aug 1, 2014
Medium6.1	Multiple Cross-Site Scripting Events Manager – Calendar, Bookings, Tickets, Appointments and more!≤5.5.1Update to 5.5.2	CVE-2013-7477	—	Aug 1, 2014

Critical9.8
Arbitrary File Upload
WordPress Font Uploader
≤1.3Update to 1.3.1
CVE-2012-3814Aug 1, 2014
Medium6.1
Cross-Site Scripting
Events Manager Pro
<2.2.9Update to 2.2.9
CVE-2013-1407Aug 1, 2014
High8.8
Cross-Site Request Forgery
underConstruction
<1.09Update to 1.09
CVE-2013-2699Aug 1, 2014
Medium6.1
Cross-Site Scripting
Count per Day
≤3.1.1Update to 3.2
CVE-2012-3434Aug 1, 2014
Medium6.1
Cross-Site Scripting
WP Construction Mode
≤1.8Update to 1.9
CVE-2014-4854Aug 1, 2014
Medium6.1
Unauthenticated Stored Cross-Site Scripting
Mail Subscribe List
≤2.0.9Update to 2.1
CVE-2013-10026Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
Redirection
<2.2.9Update to 2.2.9
CVE-2011-5329Aug 1, 2014
Critical9.8
Local/Remote File Inclusion
SlideDeck 2 Lite Responsive Content Slider
≤2.3.3Update to 2.3.5
CVE-2013-7483Aug 1, 2014
Critical9.8
Arbitrary File Upload
MailPoet Newsletters (Previous)
≤2.6.6Update to 2.6.7
CVE-2014-4725Aug 1, 2014
Medium6.1
Cross-Site scripting
Hot Files: File Sharing and Download Manager Plugin
≤1.0.0No patch available
CVE-2014-4588Aug 1, 2014
High7.1
Cross-Site Scripting
Polylang
<1.5.2Update to 1.5.2
CVE-2014-4855Aug 1, 2014
Medium6.1
Cross-Site Scripting
bib2html
≤0.9.3No patch available
CVE-2014-3870Aug 1, 2014
High8.8
Cross-Site Request Forgery
Stream Video Player
≤1.4.1No patch available
CVE-2013-2706Aug 1, 2014
Medium5.3
Full Path Disclosure
WP PHP widget
≤1.0.2No patch available
CVE-2013-0721Aug 1, 2014
Medium5.3
Cross-Site Scripting
Redirection
<2.2.10Update to 2.2.10
CVE-2011-4562Aug 1, 2014
High8.8
Cross-Site Request Forgery
Disable Comments
<1.0.4Update to 1.0.4
CVE-2014-2550Aug 1, 2014
Medium6.1
Cross-Site Scripting
Tweet Blender
≤4.0.1Update to 4.0.2
CVE-2013-6342Aug 1, 2014
Medium6.4
Stored Cross-Site Scripting
BuddyPress
≤1.9.1Update to 1.9.2
CVE-2014-1888Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
custom-tables
≤3.4.4No patch available
CVE-2012-20003Aug 1, 2014
Medium6.1
Multiple Cross-Site Scripting
Uploader
≤1.0.4No patch available
CVE-2013-2287Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
WP App Maker
≤1.0.16.4No patch available
CVE-2014-4578Aug 1, 2014
Critical9.8
Remote Code Execution
WP Super Cache
<1.3.2Update to 1.3.2
CVE-2013-2011Aug 1, 2014
High8.8
Cross-Site Request Forgery
sexybookmarks
≤6.1.4.0Update to 6.1.5.0
CVE-2013-3256Aug 1, 2014
Medium5.3
Information Disclosure
Portable phpMyAdmin
≤1.4.1No patch available
CVE-2013-4454Aug 1, 2014
Medium6.1
Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤2.71Update to 2.72
CVE-2013-3261Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
DZS Video Gallery
<7.95Update to 7.95
CVE-2014-3923Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
WPCB
≤2.4.8No patch available
CVE-2014-4581Aug 1, 2014
Medium4.3
Cross-Site Request Forgery
WordPress Related Posts
<2.7.2Update to 2.7.2
CVE-2013-3476Aug 1, 2014
Medium6.1
Multiple Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
≤1.30Update to 1.31
CVE-2013-4954Aug 1, 2014
Medium6.1
Multiple Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.5.1Update to 5.5.2
CVE-2013-7477Aug 1, 2014