CWE-98Vulnerability type

WordPress Local File Inclusion vulnerabilities (page 1336)

Template or module loaders that include attacker-chosen files, often leading to code execution.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Local File Inclusion vulnerabilities (page 1336)
Severity	Vulnerability	CVE	Installs	Published
Critical9.8	SQL Injection Community Events≤1.3Update to 1.4	CVE-2015-3313	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Post Connector<1.0.4Update to 1.0.4	CVE-2015-9362	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – PDF stamper≤1.0No patch available	CVE-2015-9519	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads (EDD) Digital Store<1.3.3Update to 1.3.3	CVE-2015-9532	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – Conditional Success Redirects<1.1.1Update to 1.1.1	CVE-2015-9511	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – eCommerce Payments and Subscriptions made easy≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7	CVE-2015-9512	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads (EDD) Stripe≤2.1.2Update to 2.1.3	CVE-2015-9529	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy EU Value Added (VAT) Taxes Add-on<1.2.0Update to 1.2.0	CVE-2015-9368	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting PayPal Pro Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9373	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – Recount Earnings<2.3.7Update to 2.3.7	CVE-2015-9524	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Authorize.net Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9365	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Twenty Twelve EDD≤1.1Update to 1.1.1	CVE-2015-9536	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Manual Purchases Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9371	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads - Amazon S3≤2.1.3Update to 2.1.4	CVE-2015-9506	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads - Wish Lists≤1.1Update to 1.1.1	CVE-2015-9531	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Shoppette<1.0.5Update to 1.0.5	CVE-2015-9535	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads - QR Codes≤1.1.0Update to 1.1.1	CVE-2015-9522	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Two Factor Authentication<1.1.10Update to 1.1.10	CVE-2015-9355	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads - Free Downloads≤2.3.6Update to 2.3.7	CVE-2015-9514	—	Apr 20, 2015
Medium6.1	Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting Easy Digital Downloads - Cross-Sell and Upsell≤1.1.2Update to 1.1.3	CVE-2015-9510	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Recommended Products - EDD≤1.2.3.2Update to 1.2.3.3	CVE-2015-9523	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads - Recurring Payments≤2.3Update to 2.3.1	CVE-2015-9525	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting BuilderChild-Depot<5.0.30Update to 5.0.30	CVE-2015-9377	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Exchange Addon Custom URL Tracking<1.1.0Update to 1.1.0	CVE-2015-9366	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – Simple Shipping≤2.1.3Update to 2.1.4	CVE-2015-9527	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Exchange Addon Membership<1.3.0Update to 1.3.0	CVE-2015-9372	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Market<5.1.27Update to 5.1.27	CVE-2015-9378	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Taxonomy Switcher≤1.0.3Update to 1.0.4	CVE-2015-10013	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Lattice<1.1.5Update to 1.1.5	CVE-2015-9533	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting ithemes-exchange<1.12.0Update to 1.12.0	CVE-2015-9363	—	Apr 20, 2015

Critical9.8
SQL Injection
Community Events
≤1.3Update to 1.4
CVE-2015-3313Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Post Connector
<1.0.4Update to 1.0.4
CVE-2015-9362Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – PDF stamper
≤1.0No patch available
CVE-2015-9519Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads (EDD) Digital Store
<1.3.3Update to 1.3.3
CVE-2015-9532Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – Conditional Success Redirects
<1.1.1Update to 1.1.1
CVE-2015-9511Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
CVE-2015-9512Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads (EDD) Stripe
≤2.1.2Update to 2.1.3
CVE-2015-9529Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy EU Value Added (VAT) Taxes Add-on
<1.2.0Update to 1.2.0
CVE-2015-9368Apr 20, 2015
Medium6.1
Cross-Site Scripting
PayPal Pro Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9373Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – Recount Earnings
<2.3.7Update to 2.3.7
CVE-2015-9524Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Authorize.net Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9365Apr 20, 2015
Medium6.1
Cross-Site Scripting
Twenty Twelve EDD
≤1.1Update to 1.1.1
CVE-2015-9536Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Manual Purchases Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9371Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads - Amazon S3
≤2.1.3Update to 2.1.4
CVE-2015-9506Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads - Wish Lists
≤1.1Update to 1.1.1
CVE-2015-9531Apr 20, 2015
Medium6.1
Cross-Site Scripting
Shoppette
<1.0.5Update to 1.0.5
CVE-2015-9535Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads - QR Codes
≤1.1.0Update to 1.1.1
CVE-2015-9522Apr 20, 2015
Medium6.1
Cross-Site Scripting
Two Factor Authentication
<1.1.10Update to 1.1.10
CVE-2015-9355Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads - Free Downloads
≤2.3.6Update to 2.3.7
CVE-2015-9514Apr 20, 2015
Medium6.1
Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting
Easy Digital Downloads - Cross-Sell and Upsell
≤1.1.2Update to 1.1.3
CVE-2015-9510Apr 20, 2015
Medium6.1
Cross-Site Scripting
Recommended Products - EDD
≤1.2.3.2Update to 1.2.3.3
CVE-2015-9523Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads - Recurring Payments
≤2.3Update to 2.3.1
CVE-2015-9525Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
BuilderChild-Depot
<5.0.30Update to 5.0.30
CVE-2015-9377Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Exchange Addon Custom URL Tracking
<1.1.0Update to 1.1.0
CVE-2015-9366Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – Simple Shipping
≤2.1.3Update to 2.1.4
CVE-2015-9527Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Exchange Addon Membership
<1.3.0Update to 1.3.0
CVE-2015-9372Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Market
<5.1.27Update to 5.1.27
CVE-2015-9378Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Taxonomy Switcher
≤1.0.3Update to 1.0.4
CVE-2015-10013Apr 20, 2015
Medium6.1
Cross-Site Scripting
Lattice
<1.1.5Update to 1.1.5
CVE-2015-9533Apr 20, 2015
Medium6.1
Cross-Site Scripting
ithemes-exchange
<1.12.0Update to 1.12.0
CVE-2015-9363Apr 20, 2015