CWE-79Vulnerability type

WordPress Cross-Site Scripting vulnerabilities (page 1352)

Stored and reflected XSS in plugin output: the most common WordPress vulnerability class, and a frequent path to admin takeover.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Cross-Site Scripting vulnerabilities (page 1352)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Reflected Cross-Site Scripting swipehq-payment-gateway-woocommerce≤2.7.1No patch available	CVE-2014-4558	—	May 28, 2014
Medium6.1	Cross-Site Scripting WP Easy Post Types<1.4.4Update to 1.4.4	CVE-2014-4524	—	May 28, 2014
High7.1	Cross-Site Scripting Malware Finder≤1.1No patch available	CVE-2014-4538	—	May 28, 2014
Medium6.1	Cross-Site Scripting BIC Media Widget≤1.0No patch available	CVE-2014-4516	—	May 28, 2014
High8.8	SQL Injection quartz≤1.01.1No patch available	CVE-2014-5185	—	May 28, 2014
Medium6.1	Multiple Cross-Site Scripting efence≤1.3.2No patch available	CVE-2014-4526	—	May 28, 2014
High7.2	Authenticated (Admin+) SQL Injection ENL Newsletter≤1.0.1No patch available	CVE-2014-4939	—	May 28, 2014
High7.2	SQL Injection stripshow≤2.5.2No patch available	CVE-2014-5184	—	May 28, 2014
Medium6.1	Cross-Site Scripting WebEngage Feedback, Survey and Notification<2.0.1Update to 2.0.1	CVE-2014-4574	—	May 28, 2014
High7.5	Server-Side Request Forgery jRSS Widget≤1.2No patch available	CVE-2014-9292	—	May 28, 2014
High7.5	Path Traversal BookX≤1.7No patch available	CVE-2014-4937	—	May 28, 2014
Medium6.1	Cross-Site Scripting WordPress支付宝Alipay\|财付通Tenpay\|贝宝PayPal集成插件<3.7.0Update to 3.7.0	CVE-2014-4514	—	May 28, 2014
Medium6.1	Cross-Site Scripting SS Downloads≤1.4.4.1Update to 1.5	CVE-2014-4554	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting WordPress Social Invitations – Lite≤1.4.4.2Update to 1.4.4.3	CVE-2014-4597	—	May 28, 2014
Medium6.1	Cross-Site Scripting DMCA WaterMarker<1.1Update to 1.1	CVE-2014-4520	—	May 28, 2014
Medium6.1	Cross-Site Scripting ZdStatistics≤2.0.1No patch available	CVE-2014-4605	—	May 28, 2014
Medium6.1	Cross-Site Scripting Bugs Go Viral : Facebook Promotion Generator≤1.3.4No patch available	CVE-2014-4528	—	May 28, 2014
Medium6.1	Cross-Site Scripting Rezgo Online Booking<1.8.2Update to 1.8.2	CVE-2014-4547	—	May 28, 2014
Medium5.3	Directory Traversal lastfm-rotation≤1.0No patch available	CVE-2014-5181	—	May 28, 2014
High7.2	Authenticated SQL Injection All Video Gallery Plugin for WordPress≤1.2No patch available	CVE-2014-5186	—	May 28, 2014
Medium6.1	Cross-Site Scripting Podcast Channels<0.21Update to 0.21	CVE-2014-4544	—	May 28, 2014
Critical9.1	Authenticated (Admin+) SQL Injection HDW Player Plugin (Video Player & Video Gallery)≤2.4.2Update to 3.0	CVE-2014-5180	—	May 28, 2014
Medium6.1	Cross-Site Scripting EnvíaloSimple: Email Marketing y Newsletters≤1.97Update to 1.98	CVE-2014-4527	—	May 28, 2014
Medium6.1	Cross-Site Scripting Import Legacy Media≤0.1No patch available	CVE-2014-4535	—	May 25, 2014
Medium6.1	Cross-Site Scripting WordPress Social Login≤2.1.5Update to 2.1.6	CVE-2014-4576	—	May 25, 2014
Medium6.1	Cross-Site Scripting Style It≤1.0No patch available	CVE-2014-4555	—	May 25, 2014
Medium6.1	Cross-Site Scripting Social Connect≤0.10.1Update to 0.10.2	CVE-2014-4551	—	May 25, 2014
Medium6.1	Cross-Site Scripting WP-Contact≤1.0No patch available	CVE-2014-4583	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting HTML5 Video Player with Playlist≤2.4.0No patch available	CVE-2014-4534	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting dsSearchAgent: WordPress Edition<1.0-beta10No patch available	CVE-2014-4522	—	May 25, 2014

Medium6.1
Reflected Cross-Site Scripting
swipehq-payment-gateway-woocommerce
≤2.7.1No patch available
CVE-2014-4558May 28, 2014
Medium6.1
Cross-Site Scripting
WP Easy Post Types
<1.4.4Update to 1.4.4
CVE-2014-4524May 28, 2014
High7.1
Cross-Site Scripting
Malware Finder
≤1.1No patch available
CVE-2014-4538May 28, 2014
Medium6.1
Cross-Site Scripting
BIC Media Widget
≤1.0No patch available
CVE-2014-4516May 28, 2014
High8.8
SQL Injection
quartz
≤1.01.1No patch available
CVE-2014-5185May 28, 2014
Medium6.1
Multiple Cross-Site Scripting
efence
≤1.3.2No patch available
CVE-2014-4526May 28, 2014
High7.2
Authenticated (Admin+) SQL Injection
ENL Newsletter
≤1.0.1No patch available
CVE-2014-4939May 28, 2014
High7.2
SQL Injection
stripshow
≤2.5.2No patch available
CVE-2014-5184May 28, 2014
Medium6.1
Cross-Site Scripting
WebEngage Feedback, Survey and Notification
<2.0.1Update to 2.0.1
CVE-2014-4574May 28, 2014
High7.5
Server-Side Request Forgery
jRSS Widget
≤1.2No patch available
CVE-2014-9292May 28, 2014
High7.5
Path Traversal
BookX
≤1.7No patch available
CVE-2014-4937May 28, 2014
Medium6.1
Cross-Site Scripting
WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
<3.7.0Update to 3.7.0
CVE-2014-4514May 28, 2014
Medium6.1
Cross-Site Scripting
SS Downloads
≤1.4.4.1Update to 1.5
CVE-2014-4554May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
WordPress Social Invitations – Lite
≤1.4.4.2Update to 1.4.4.3
CVE-2014-4597May 28, 2014
Medium6.1
Cross-Site Scripting
DMCA WaterMarker
<1.1Update to 1.1
CVE-2014-4520May 28, 2014
Medium6.1
Cross-Site Scripting
ZdStatistics
≤2.0.1No patch available
CVE-2014-4605May 28, 2014
Medium6.1
Cross-Site Scripting
Bugs Go Viral : Facebook Promotion Generator
≤1.3.4No patch available
CVE-2014-4528May 28, 2014
Medium6.1
Cross-Site Scripting
Rezgo Online Booking
<1.8.2Update to 1.8.2
CVE-2014-4547May 28, 2014
Medium5.3
Directory Traversal
lastfm-rotation
≤1.0No patch available
CVE-2014-5181May 28, 2014
High7.2
Authenticated SQL Injection
All Video Gallery Plugin for WordPress
≤1.2No patch available
CVE-2014-5186May 28, 2014
Medium6.1
Cross-Site Scripting
Podcast Channels
<0.21Update to 0.21
CVE-2014-4544May 28, 2014
Critical9.1
Authenticated (Admin+) SQL Injection
HDW Player Plugin (Video Player & Video Gallery)
≤2.4.2Update to 3.0
CVE-2014-5180May 28, 2014
Medium6.1
Cross-Site Scripting
EnvíaloSimple: Email Marketing y Newsletters
≤1.97Update to 1.98
CVE-2014-4527May 28, 2014
Medium6.1
Cross-Site Scripting
Import Legacy Media
≤0.1No patch available
CVE-2014-4535May 25, 2014
Medium6.1
Cross-Site Scripting
WordPress Social Login
≤2.1.5Update to 2.1.6
CVE-2014-4576May 25, 2014
Medium6.1
Cross-Site Scripting
Style It
≤1.0No patch available
CVE-2014-4555May 25, 2014
Medium6.1
Cross-Site Scripting
Social Connect
≤0.10.1Update to 0.10.2
CVE-2014-4551May 25, 2014
Medium6.1
Cross-Site Scripting
WP-Contact
≤1.0No patch available
CVE-2014-4583May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
HTML5 Video Player with Playlist
≤2.4.0No patch available
CVE-2014-4534May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
dsSearchAgent: WordPress Edition
<1.0-beta10No patch available
CVE-2014-4522May 25, 2014