CWE-98Vulnerability type

WordPress Local File Inclusion vulnerabilities (page 1348)

Template or module loaders that include attacker-chosen files, often leading to code execution.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Local File Inclusion vulnerabilities (page 1348)
Severity	Vulnerability	CVE	Installs	Published
High8.8	Cross-Site Request Forgery sexybookmarks≤6.1.4.0Update to 6.1.5.0	CVE-2013-3256	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Stream Video Player≤1.4.1No patch available	CVE-2013-2706	—	Aug 1, 2014
Medium5.3	Information Disclosure Portable phpMyAdmin≤1.4.1No patch available	CVE-2013-4454	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting Redirection<2.2.9Update to 2.2.9	CVE-2011-5329	—	Aug 1, 2014
High7.1	Cross-Site Scripting Polylang<1.5.2Update to 1.5.2	CVE-2014-4855	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting custom-tables≤3.4.4No patch available	CVE-2012-20003	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Disable Comments<1.0.4Update to 1.0.4	CVE-2014-2550	—	Aug 1, 2014
Medium5.3	Full Path Disclosure WP PHP widget≤1.0.2No patch available	CVE-2013-0721	—	Aug 1, 2014
Medium6.1	Cross-Site scripting Hot Files: File Sharing and Download Manager Plugin≤1.0.0No patch available	CVE-2014-4588	—	Aug 1, 2014
Medium6.4	Stored Cross-Site Scripting BuddyPress≤1.9.1Update to 1.9.2	CVE-2014-1888	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery Xhanch – My Twitter≤2.7.6Update to 2.7.7	CVE-2013-3253	—	Aug 1, 2014
Medium6.3	Cross-Site Request Forgery WordPress Content Slide≤1.4.2No patch available	CVE-2013-2708	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting bib2html≤0.9.3No patch available	CVE-2014-3870	—	Aug 1, 2014
Critical9.8	Remote Code Execution WP Super Cache<1.3.2Update to 1.3.2	CVE-2013-2011	—	Aug 1, 2014
Medium6.1	Open Redirection WP Symposium≤13.04Update to 13.05	CVE-2013-2694	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Count per Day≤3.1.1Update to 3.2	CVE-2012-3434	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting WP App Maker≤1.0.16.4No patch available	CVE-2014-4578	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Tweet Blender≤4.0.1Update to 4.0.2	CVE-2013-6342	—	Aug 1, 2014
Critical9.8	Arbitrary File Upload MailPoet Newsletters (Previous)≤2.6.6Update to 2.6.7	CVE-2014-4725	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting BulletProof Security≤.48.9Update to .49	CVE-2013-3487	—	Aug 1, 2014
High7.2	Stored Cross-Site Scripting PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links<1.6.3Update to 1.6.3	CVE-2013-1636	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting Crowdsignal Dashboard – Polls, Surveys & more≤2.0.24Update to 2.0.25	CVE-2014-4856	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting DZS Video Gallery<7.95Update to 7.95	CVE-2014-3923	—	Aug 1, 2014
High7.5	Local File Inclusion WP AmASIN – The Amazon Affiliate Shop≤0.9.6Update to 0.9.7	CVE-2014-4577	—	Aug 1, 2014
Medium6.1	Multiple Cross-Site Scripting Uploader≤1.0.4No patch available	CVE-2013-2287	—	Aug 1, 2014
Medium6.1	Multiple Cross-Site Scripting Events Manager – Calendar, Bookings, Tickets, Appointments and more!≤5.5.1Update to 5.5.2	CVE-2013-7477	—	Aug 1, 2014
Medium6.1	Cross-Site Scripting WP-Table Reloaded≤1.9.3Update to 1.9.4	CVE-2013-1463	—	Aug 1, 2014
Medium6.1	Reflected Cross-Site Scripting WPCB≤2.4.8No patch available	CVE-2014-4581	—	Aug 1, 2014
Medium5.3	Cross-Site Scripting Adminimize<1.7.22Update to 1.7.22	CVE-2011-5128	—	Aug 1, 2014
High8.8	Cross-Site Request Forgery underConstruction<1.09Update to 1.09	CVE-2013-2699	—	Aug 1, 2014

High8.8
Cross-Site Request Forgery
sexybookmarks
≤6.1.4.0Update to 6.1.5.0
CVE-2013-3256Aug 1, 2014
High8.8
Cross-Site Request Forgery
Stream Video Player
≤1.4.1No patch available
CVE-2013-2706Aug 1, 2014
Medium5.3
Information Disclosure
Portable phpMyAdmin
≤1.4.1No patch available
CVE-2013-4454Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
Redirection
<2.2.9Update to 2.2.9
CVE-2011-5329Aug 1, 2014
High7.1
Cross-Site Scripting
Polylang
<1.5.2Update to 1.5.2
CVE-2014-4855Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
custom-tables
≤3.4.4No patch available
CVE-2012-20003Aug 1, 2014
High8.8
Cross-Site Request Forgery
Disable Comments
<1.0.4Update to 1.0.4
CVE-2014-2550Aug 1, 2014
Medium5.3
Full Path Disclosure
WP PHP widget
≤1.0.2No patch available
CVE-2013-0721Aug 1, 2014
Medium6.1
Cross-Site scripting
Hot Files: File Sharing and Download Manager Plugin
≤1.0.0No patch available
CVE-2014-4588Aug 1, 2014
Medium6.4
Stored Cross-Site Scripting
BuddyPress
≤1.9.1Update to 1.9.2
CVE-2014-1888Aug 1, 2014
High8.8
Cross-Site Request Forgery
Xhanch – My Twitter
≤2.7.6Update to 2.7.7
CVE-2013-3253Aug 1, 2014
Medium6.3
Cross-Site Request Forgery
WordPress Content Slide
≤1.4.2No patch available
CVE-2013-2708Aug 1, 2014
Medium6.1
Cross-Site Scripting
bib2html
≤0.9.3No patch available
CVE-2014-3870Aug 1, 2014
Critical9.8
Remote Code Execution
WP Super Cache
<1.3.2Update to 1.3.2
CVE-2013-2011Aug 1, 2014
Medium6.1
Open Redirection
WP Symposium
≤13.04Update to 13.05
CVE-2013-2694Aug 1, 2014
Medium6.1
Cross-Site Scripting
Count per Day
≤3.1.1Update to 3.2
CVE-2012-3434Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
WP App Maker
≤1.0.16.4No patch available
CVE-2014-4578Aug 1, 2014
Medium6.1
Cross-Site Scripting
Tweet Blender
≤4.0.1Update to 4.0.2
CVE-2013-6342Aug 1, 2014
Critical9.8
Arbitrary File Upload
MailPoet Newsletters (Previous)
≤2.6.6Update to 2.6.7
CVE-2014-4725Aug 1, 2014
Medium6.1
Cross-Site Scripting
BulletProof Security
≤.48.9Update to .49
CVE-2013-3487Aug 1, 2014
High7.2
Stored Cross-Site Scripting
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<1.6.3Update to 1.6.3
CVE-2013-1636Aug 1, 2014
Medium6.1
Cross-Site Scripting
Crowdsignal Dashboard – Polls, Surveys & more
≤2.0.24Update to 2.0.25
CVE-2014-4856Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
DZS Video Gallery
<7.95Update to 7.95
CVE-2014-3923Aug 1, 2014
High7.5
Local File Inclusion
WP AmASIN – The Amazon Affiliate Shop
≤0.9.6Update to 0.9.7
CVE-2014-4577Aug 1, 2014
Medium6.1
Multiple Cross-Site Scripting
Uploader
≤1.0.4No patch available
CVE-2013-2287Aug 1, 2014
Medium6.1
Multiple Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.5.1Update to 5.5.2
CVE-2013-7477Aug 1, 2014
Medium6.1
Cross-Site Scripting
WP-Table Reloaded
≤1.9.3Update to 1.9.4
CVE-2013-1463Aug 1, 2014
Medium6.1
Reflected Cross-Site Scripting
WPCB
≤2.4.8No patch available
CVE-2014-4581Aug 1, 2014
Medium5.3
Cross-Site Scripting
Adminimize
<1.7.22Update to 1.7.22
CVE-2011-5128Aug 1, 2014
High8.8
Cross-Site Request Forgery
underConstruction
<1.09Update to 1.09
CVE-2013-2699Aug 1, 2014