CWE-79Vulnerability type
WordPress Cross-Site Scripting vulnerabilities (page 1351)
Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4548 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4579 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4570 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4567 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4594 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4586 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4598 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4590 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4580 | — | |
| Medium4.3 | Cross-Site Request Forgery leading to player deletion | CVE-2014-4030 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3850 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-4163 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-5345 | — | |
| Critical9.8 | SQL Injection | CVE-2014-3961 | — | |
| High7.2 | Cross-Site Scripting | CVE-2014-3921 | — | |
| High7.5 | Path Traversal | CVE-2014-4941 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4544 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2014-4523 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4513 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4605 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2014-4942 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4557 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4528 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4541 | — | |
| Critical9.8 | SQL Injection | CVE-2014-4938 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4604 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4564 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4516 | — | |
| High8.8 | SQL Injection | CVE-2014-5185 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4519 | — |
- Medium6.1Reflected Cross-Site Scripting
Ruven Toolkit
≤2.0No patch available
- Medium6.1Cross-Site Scripting
Appointments Scheduler
≤1.5No patch available
- Medium6.1Reflected Cross-Site Scripting
VideoWhisper Video Presentation
≤3.25Update to 3.31
- Medium6.1Cross-Site Scripting
Webcam/Screen/Mic Recorder for Video Comments and Forms
≤1.55Update to 1.55.3
- Medium6.1Reflected Cross-Site Scripting
WordPress Responsive Preview
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
wp-football
≤1.1No patch available
- High7.1Cross-Site Scripting
wp-tmkm-amazon
<1.5.3Update to 1.5.3
- High7.1Cross-Site Scripting
WP Microblogs
≤0.4.0No patch available
- Medium6.1Cross-Site Scripting
WP BlipBot
≤3.0.9No patch available
- Medium4.3Cross-Site Request Forgery leading to player deletion
JW Player for Flash & HTML5 Video
<2.1.4Update to 2.1.4
- Medium6.1Cross-Site Scripting
Member Approval
≤131109No patch available
- High8.8Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
- Medium6.1Reflected Cross-Site Scripting
Disqus Comment System
<2.76Update to 2.76
- Critical9.8SQL Injection
Participants Database
<1.5.4.9Update to 1.5.4.9
- High7.2Cross-Site Scripting
simple-popup-images
≤1.0Update to 1.1
- High7.5Path Traversal
Cross-RSS
≤1.7No patch available
- Medium6.1Cross-Site Scripting
Podcast Channels
<0.21Update to 0.21
- Medium6.1Unauthenticated Cross-Site Scripting
Easy Career Openings
≤0.4No patch available
- Medium6.1Reflected Cross-Site Scripting
ActiveHelper LiveHelp Live Chat
<3.1.5Update to 3.1.5
- Medium6.1Cross-Site Scripting
ZdStatistics
≤2.0.1No patch available
- Medium5.3Sensitive Information Disclosure
WP EasyCart: Shopping Cart and eCommerce Store
≤2.0.5Update to 2.0.6
- Medium6.1Cross-Site Scripting
Jigoshop Swipe plugin
≤3.1.0No patch available
- Medium6.1Cross-Site Scripting
Bugs Go Viral : Facebook Promotion Generator
≤1.3.4No patch available
- Medium6.1Cross-Site Scripting
OMFG Mobile Pro
≤1.1.26No patch available
- Critical9.8SQL Injection
WP Rss Poster
≤1.0.0No patch available
- Medium6.1Cross-Site Scripting
your-text-manager
≤0.3.0No patch available
- Medium6.1Cross-Site Scripting
Validated
≤1.0.2Update to 2.0.0
- Medium6.1Cross-Site Scripting
BIC Media Widget
≤1.0No patch available
- High8.8SQL Injection
quartz
≤1.01.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Conversador
≤2.61No patch available