CWE-98Vulnerability type
WordPress Local File Inclusion vulnerabilities (page 1351)
Template or module loaders that include attacker-chosen files, often leading to code execution.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4582 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4575 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4591 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4585 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2014-4595 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4573 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4601 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4580 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4590 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-4163 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3850 | — | |
| Medium4.3 | Cross-Site Request Forgery leading to player deletion | CVE-2014-4030 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-5345 | — | |
| Critical9.8 | SQL Injection | CVE-2014-3961 | — | |
| High7.2 | Cross-Site Scripting | CVE-2014-3921 | — | |
| High7.5 | Path Traversal | CVE-2014-4941 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4547 | — | |
| Critical9.1 | Authenticated (Admin+) SQL Injection | CVE-2014-5180 | — | |
| Medium5.3 | Directory Traversal | CVE-2014-5181 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4527 | — | |
| High7.2 | Authenticated SQL Injection | CVE-2014-5186 | — | |
| High7.5 | Server-Side Request Forgery | CVE-2014-9292 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4574 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4554 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4514 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2014-4526 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2014-4939 | — | |
| High7.5 | Path Traversal | CVE-2014-4937 | — | |
| High7.2 | SQL Injection | CVE-2014-5184 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4597 | — |
- Medium6.1Reflected Cross-Site Scripting
WP Consultant
≤1.0No patch available
- Medium6.1Cross-Site Scripting
WikiPop
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
WP-Picasa-Image
≤1.0No patch available
- Medium6.1Cross-Site Scripting
WP-FaceThumb
≤1.0No patch available
- Medium6.1Multiple Cross-Site Scripting
wp-restful
≤0.1No patch available
- High7.1Cross-Site Scripting
Walk Score Plugin
≤0.5.5No patch available
- Medium6.1Cross-Site Scripting
Wu-Rating
≤1.0 12319No patch available
- Medium6.1Cross-Site Scripting
WP BlipBot
≤3.0.9No patch available
- High7.1Cross-Site Scripting
WP Microblogs
≤0.4.0No patch available
- High8.8Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
- Medium6.1Cross-Site Scripting
Member Approval
≤131109No patch available
- Medium4.3Cross-Site Request Forgery leading to player deletion
JW Player for Flash & HTML5 Video
<2.1.4Update to 2.1.4
- Medium6.1Reflected Cross-Site Scripting
Disqus Comment System
<2.76Update to 2.76
- Critical9.8SQL Injection
Participants Database
<1.5.4.9Update to 1.5.4.9
- High7.2Cross-Site Scripting
simple-popup-images
≤1.0Update to 1.1
- High7.5Path Traversal
Cross-RSS
≤1.7No patch available
- Medium6.1Cross-Site Scripting
Rezgo Online Booking
<1.8.2Update to 1.8.2
- Critical9.1Authenticated (Admin+) SQL Injection
HDW Player Plugin (Video Player & Video Gallery)
≤2.4.2Update to 3.0
- Medium5.3Directory Traversal
lastfm-rotation
≤1.0No patch available
- Medium6.1Cross-Site Scripting
EnvíaloSimple: Email Marketing y Newsletters
≤1.97Update to 1.98
- High7.2Authenticated SQL Injection
All Video Gallery Plugin for WordPress
≤1.2No patch available
- High7.5Server-Side Request Forgery
jRSS Widget
≤1.2No patch available
- Medium6.1Cross-Site Scripting
WebEngage Feedback, Survey and Notification
<2.0.1Update to 2.0.1
- Medium6.1Cross-Site Scripting
SS Downloads
≤1.4.4.1Update to 1.5
- Medium6.1Cross-Site Scripting
WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
<3.7.0Update to 3.7.0
- Medium6.1Multiple Cross-Site Scripting
efence
≤1.3.2No patch available
- High7.2Authenticated (Admin+) SQL Injection
ENL Newsletter
≤1.0.1No patch available
- High7.5Path Traversal
BookX
≤1.7No patch available
- High7.2SQL Injection
stripshow
≤2.5.2No patch available
- Medium6.1Reflected Cross-Site Scripting
WordPress Social Invitations – Lite
≤1.4.4.2Update to 1.4.4.3