CWE-98Vulnerability type
WordPress Local File Inclusion vulnerabilities (page 1355)
Template or module loaders that include attacker-chosen files, often leading to code execution.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | SQL Injection | CVE-2014-3937 | — | |
| Critical9.8 | SQL Injection | CVE-2014-10017 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-10016 | — | |
| Critical9.8 | Arbitrary File Read/Deletion | CVE-2014-1907 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2014-1908 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2014-1905 | — | |
| Medium5.3 | CAPTCHA Bypass | CVE-2014-2265 | — | |
| Critical9.8 | SQL Injection | CVE-2014-100022 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100023 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-2297 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-2315 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-10381 | — | |
| Critical9.8 | 3.9.4 - SQL Injection | CVE-2014-1854 | — | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2014-2274 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-8800 | — | |
| Critical9.1 | SQL Injection | CVE-2014-2316 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-1906 | — | |
| Medium6.5 | Authorization Bypass | CVE-2014-1889 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2014-2040 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100016 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-125090 | — | |
| Medium6.1 | Open Redirect | CVE-2014-1750 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2012-6629 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-100026 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4563 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-1232 | — | |
| High7.5 | Directory Traversal | CVE-2013-7240 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6991 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-6992 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7276 | — |
- Critical9.8SQL Injection
Contextual Related Posts
<1.8.10.2Update to 1.8.10.2
- Critical9.8SQL Injection
Welcart e-Commerce
≤2.9.1Update to 2.9.2
- Medium6.1Cross-Site Scripting
Welcart e-Commerce
≤2.11.1Update to 2.11.2
- Critical9.8Arbitrary File Read/Deletion
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
- Medium5.3Full Path Disclosure
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
- Critical9.8Arbitrary File Upload
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤4.27.4Update to 4.29.5
- Medium5.3CAPTCHA Bypass
Contact Form 7
<3.7.2Update to 3.7.2
- Critical9.8SQL Injection
mTouch Quiz
<3.0.7Update to 3.0.7
- Medium6.1Cross-Site Scripting
mTouch Quiz
<3.0.7Update to 3.0.7
- Medium6.1Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤4.29.6Update to 4.29.9
- Medium6.1Cross-Site Scripting
Thank You Counter Button
≤1.9.3No patch available
- High8.8Cross-Site Request Forgery
User Domain Whitelist
<1.5Update to 1.5
- Critical9.83.9.4 - SQL Injection
AdRotate Banner Manager
3.9 – 3.9.4Update to 3.9.5
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Subscribe To Comments Reloaded
≤140129Update to 140219
- High7.1Cross-Site Scripting
Nextend Social Login and Register
<1.5.1Update to 1.5.1
- Critical9.1SQL Injection
Search Everything
<7.0.3Update to 7.0.3
- High7.1Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
- Medium6.5Authorization Bypass
BuddyPress
<1.9.2Update to 1.9.2
- Medium6.4Stored Cross-Site Scripting
Media File Renamer: Rename Images & Files for SEO (AI-Powered)
<1.9.4Update to 1.9.4
- Medium6.1Cross-Site Scripting
Photocrati
≤4.8.0Update to 4.8.1
- Medium6.1Reflected Cross-Site Scripting
Media Downloader
≤0.1.992Update to 0.1.993
- Medium6.1Open Redirect
Nokia Maps & Places
<1.6.7Update to 1.6.7
- High8.8Cross-Site Request Forgery
Newsletter Manager
<1.4Update to 1.4
- Medium6.1Reflected Cross-Site Scripting
April's Super Functions Pack
≤1.4.7Update to 1.4.8
- Medium6.1Cross-Site Scripting
URL Cloak & Encrypt
<3.8.0Update to 3.8.0
- Medium6.1Cross-Site Scripting
Foliopress WYSIWYG
<2.6.8.5Update to 2.6.8.5
- High7.5Directory Traversal
Advanced Dewplayer
≤1.2Update to 1.3
- Medium6.1Cross-Site Scripting
WP-Cron Dashboard
<1.1.6Update to 1.1.6
- High8.8Cross-Site Request Forgery
AskApache Firefox Adsense
≤3.0No patch available
- Medium6.1Cross-Site Scripting
Recommend to a friend
≤2.2.2No patch available