CWE-98Vulnerability type

WordPress Local File Inclusion vulnerabilities (page 1352)

Template or module loaders that include attacker-chosen files, often leading to code execution.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Local File Inclusion vulnerabilities (page 1352)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Reflected Cross-Site Scripting swipehq-payment-gateway-woocommerce≤2.7.1No patch available	CVE-2014-4558	—	May 28, 2014
Medium6.1	Cross-Site Scripting BIC Media Widget≤1.0No patch available	CVE-2014-4516	—	May 28, 2014
Critical9.8	SQL Injection WP Rss Poster≤1.0.0No patch available	CVE-2014-4938	—	May 28, 2014
High7.1	Cross-Site Scripting Oleggo LiveStream≤0.2.6No patch available	CVE-2014-4540	—	May 28, 2014
Medium6.1	Cross-Site Scripting your-text-manager≤0.3.0No patch available	CVE-2014-4604	—	May 28, 2014
Medium6.1	Cross-Site Scripting wppm≤1.6.4.bNo patch available	CVE-2014-4593	—	May 28, 2014
Medium6.1	Cross-Site Scripting WP Easy Post Types<1.4.4Update to 1.4.4	CVE-2014-4524	—	May 28, 2014
Medium6.1	Cross-Site Scripting SS Downloads≤1.4.4.1Update to 1.5	CVE-2014-4554	—	May 28, 2014
Medium6.1	Cross-Site Scripting WordPress支付宝Alipay\|财付通Tenpay\|贝宝PayPal集成插件<3.7.0Update to 3.7.0	CVE-2014-4514	—	May 28, 2014
Medium6.1	Multiple Cross-Site Scripting efence≤1.3.2No patch available	CVE-2014-4526	—	May 28, 2014
High7.2	Authenticated (Admin+) SQL Injection ENL Newsletter≤1.0.1No patch available	CVE-2014-4939	—	May 28, 2014
High7.5	Path Traversal BookX≤1.7No patch available	CVE-2014-4937	—	May 28, 2014
High7.2	SQL Injection stripshow≤2.5.2No patch available	CVE-2014-5184	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting WordPress Social Invitations – Lite≤1.4.4.2Update to 1.4.4.3	CVE-2014-4597	—	May 28, 2014
Medium6.1	Cross-Site Scripting DMCA WaterMarker<1.1Update to 1.1	CVE-2014-4520	—	May 28, 2014
Critical9.1	Authenticated (Admin+) SQL Injection HDW Player Plugin (Video Player & Video Gallery)≤2.4.2Update to 3.0	CVE-2014-5180	—	May 28, 2014
Medium6.1	Cross-Site Scripting Bugs Go Viral : Facebook Promotion Generator≤1.3.4No patch available	CVE-2014-4528	—	May 28, 2014
Medium5.3	Directory Traversal lastfm-rotation≤1.0No patch available	CVE-2014-5181	—	May 28, 2014
Medium6.1	Cross-Site Scripting WebEngage Feedback, Survey and Notification<2.0.1Update to 2.0.1	CVE-2014-4574	—	May 28, 2014
High7.5	Server-Side Request Forgery jRSS Widget≤1.2No patch available	CVE-2014-9292	—	May 28, 2014
Medium6.1	Cross-Site Scripting Rezgo Online Booking<1.8.2Update to 1.8.2	CVE-2014-4547	—	May 28, 2014
High7.2	Authenticated SQL Injection All Video Gallery Plugin for WordPress≤1.2No patch available	CVE-2014-5186	—	May 28, 2014
Medium6.1	Cross-Site Scripting EnvíaloSimple: Email Marketing y Newsletters≤1.97Update to 1.98	CVE-2014-4527	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting ooorl≤1.0.0No patch available	CVE-2014-4542	—	May 25, 2014
Medium6.1	Cross-Site Scripting Social Connect≤0.10.1Update to 0.10.2	CVE-2014-4551	—	May 25, 2014
Medium6.1	CBI Referral Manager <= 1.2.1 Cross-Site Scripting CBI Referral Manager≤1.2.1No patch available	CVE-2014-4517	—	May 25, 2014
Medium6.1	Cross-Site Scripting WP-Contact≤1.0No patch available	CVE-2014-4583	—	May 25, 2014
Medium6.1	Cross-Site Scripting proquoter≤1.0No patch available	CVE-2014-4545	—	May 25, 2014
Medium6.1	Cross-Site Scripting Import Legacy Media≤0.1No patch available	CVE-2014-4535	—	May 25, 2014
Medium6.1	Reflected Cross-Site Scripting dsSearchAgent: WordPress Edition<1.0-beta10No patch available	CVE-2014-4522	—	May 25, 2014

Medium6.1
Reflected Cross-Site Scripting
swipehq-payment-gateway-woocommerce
≤2.7.1No patch available
CVE-2014-4558May 28, 2014
Medium6.1
Cross-Site Scripting
BIC Media Widget
≤1.0No patch available
CVE-2014-4516May 28, 2014
Critical9.8
SQL Injection
WP Rss Poster
≤1.0.0No patch available
CVE-2014-4938May 28, 2014
High7.1
Cross-Site Scripting
Oleggo LiveStream
≤0.2.6No patch available
CVE-2014-4540May 28, 2014
Medium6.1
Cross-Site Scripting
your-text-manager
≤0.3.0No patch available
CVE-2014-4604May 28, 2014
Medium6.1
Cross-Site Scripting
wppm
≤1.6.4.bNo patch available
CVE-2014-4593May 28, 2014
Medium6.1
Cross-Site Scripting
WP Easy Post Types
<1.4.4Update to 1.4.4
CVE-2014-4524May 28, 2014
Medium6.1
Cross-Site Scripting
SS Downloads
≤1.4.4.1Update to 1.5
CVE-2014-4554May 28, 2014
Medium6.1
Cross-Site Scripting
WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
<3.7.0Update to 3.7.0
CVE-2014-4514May 28, 2014
Medium6.1
Multiple Cross-Site Scripting
efence
≤1.3.2No patch available
CVE-2014-4526May 28, 2014
High7.2
Authenticated (Admin+) SQL Injection
ENL Newsletter
≤1.0.1No patch available
CVE-2014-4939May 28, 2014
High7.5
Path Traversal
BookX
≤1.7No patch available
CVE-2014-4937May 28, 2014
High7.2
SQL Injection
stripshow
≤2.5.2No patch available
CVE-2014-5184May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
WordPress Social Invitations – Lite
≤1.4.4.2Update to 1.4.4.3
CVE-2014-4597May 28, 2014
Medium6.1
Cross-Site Scripting
DMCA WaterMarker
<1.1Update to 1.1
CVE-2014-4520May 28, 2014
Critical9.1
Authenticated (Admin+) SQL Injection
HDW Player Plugin (Video Player & Video Gallery)
≤2.4.2Update to 3.0
CVE-2014-5180May 28, 2014
Medium6.1
Cross-Site Scripting
Bugs Go Viral : Facebook Promotion Generator
≤1.3.4No patch available
CVE-2014-4528May 28, 2014
Medium5.3
Directory Traversal
lastfm-rotation
≤1.0No patch available
CVE-2014-5181May 28, 2014
Medium6.1
Cross-Site Scripting
WebEngage Feedback, Survey and Notification
<2.0.1Update to 2.0.1
CVE-2014-4574May 28, 2014
High7.5
Server-Side Request Forgery
jRSS Widget
≤1.2No patch available
CVE-2014-9292May 28, 2014
Medium6.1
Cross-Site Scripting
Rezgo Online Booking
<1.8.2Update to 1.8.2
CVE-2014-4547May 28, 2014
High7.2
Authenticated SQL Injection
All Video Gallery Plugin for WordPress
≤1.2No patch available
CVE-2014-5186May 28, 2014
Medium6.1
Cross-Site Scripting
EnvíaloSimple: Email Marketing y Newsletters
≤1.97Update to 1.98
CVE-2014-4527May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
ooorl
≤1.0.0No patch available
CVE-2014-4542May 25, 2014
Medium6.1
Cross-Site Scripting
Social Connect
≤0.10.1Update to 0.10.2
CVE-2014-4551May 25, 2014
Medium6.1
CBI Referral Manager <= 1.2.1 Cross-Site Scripting
CBI Referral Manager
≤1.2.1No patch available
CVE-2014-4517May 25, 2014
Medium6.1
Cross-Site Scripting
WP-Contact
≤1.0No patch available
CVE-2014-4583May 25, 2014
Medium6.1
Cross-Site Scripting
proquoter
≤1.0No patch available
CVE-2014-4545May 25, 2014
Medium6.1
Cross-Site Scripting
Import Legacy Media
≤0.1No patch available
CVE-2014-4535May 25, 2014
Medium6.1
Reflected Cross-Site Scripting
dsSearchAgent: WordPress Edition
<1.0-beta10No patch available
CVE-2014-4522May 25, 2014