CWE-98Vulnerability type
WordPress Local File Inclusion vulnerabilities (page 1358)
Template or module loaders that include attacker-chosen files, often leading to code execution.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2013-6280 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2013-3258 | — | |
| High8.8 | Remote Code Execution | CVE-2013-2109 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2107 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-10021 | — | |
| Critical9.8 | SQL Injection | CVE-2013-3478 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2013-3257 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3252 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3477 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3479 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3254 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2013-2707 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2013-2702 | — | |
| High7.6 | Cross-Site Request Forgery | CVE-2013-2703 | — | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2013-2709 | — | |
| High7.1 | Cross-Site Request Forgery | CVE-2013-2696 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-10028 | — | |
| Critical9.8 | SQL Injection | CVE-2013-3532 | — | |
| Critical9.8 | SQL Injection | CVE-2013-3530 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3526 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-2697 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-1949 | — | |
| High7.1 | Cross-Site Request Forgery | CVE-2013-2693 | — | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2013-3720 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-7476 | — | |
| High7.2 | Cross-Site Scripting | CVE-2013-3529 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2700 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-2741 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2013-2744 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-2743 | — |
- Medium6.1Cross-Site Scripting
Social Sharing Toolkit
<2.1.2Update to 2.1.2
- Medium6.3Cross-Site Request Forgery
digg-digg
<5.3.5Update to 5.3.5
- High8.8Remote Code Execution
WP CleanFix
<5.0.0Update to 5.0.0
- High8.8Cross-Site Request Forgery
Mail On Update
<5.3.0Update to 5.3.0
- Medium6.1Reflected Cross-Site Scripting
Debug Bar
≤0.8Update to 0.8.1
- Critical9.8SQL Injection
WORDPRESS VIDEO GALLERY
<2.1Update to 2.1
- Medium4.3Cross-Site Request Forgery
Related Posts
<2.7.2Update to 2.7.2
- High8.8Cross-Site Request Forgery
WP-PostViews
<1.63Update to 1.63
- High8.8Cross-Site Request Forgery
Related Posts by Zemanta
≤1.3.1Update to 1.3.2
- High8.8Cross-Site Request Forgery
share-this
≤7.0.5Update to 7.0.6
- Medium6.1Cross-Site Scripting
WP Photo Album Plus
<5.0.3Update to 5.0.3
- Medium6.3Cross-Site Request Forgery
AJAX Auth – Fast Logins, 2FA, Redirects
<3.1Update to 3.1
- Medium6.3Cross-Site Request Forgery
Easy Plugin for AdSense
<6.10Update to 6.10
- High7.6Cross-Site Request Forgery
Facebook Members
<5.0.5Update to 5.0.5
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
FourSquare Checkins
<1.3Update to 1.3
- High7.1Cross-Site Request Forgery
WP Webmaster
<8.2.4Update to 8.2.4
- Medium6.1Reflected Cross-Site Scripting
EELV Newsletter
≤3.3.0Update to 3.3.1
- Critical9.8SQL Injection
SpiderVPlayer
≤2.1No patch available
- Critical9.8SQL Injection
Spiffy XSPF Player
≤0.1No patch available
- Medium6.1Cross-Site Scripting
Traffic Analyzer
≤3.4.1Update to 3.4.2
- Medium6.1Cross-Site Scripting
wp-download-manager
<1.61Update to 1.61
- Critical9.8Arbitrary File Upload
Social Media Widget
≤4.0Update to 4.0.1
- High7.1Cross-Site Request Forgery
WP-Print
<2.52Update to 2.52
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Feedweb
<1.9Update to 1.9
- High8.8Cross-Site Request Forgery
Simple Fields
<1.2Update to 1.2
- High7.2Cross-Site Scripting
WP FuneralPress
≤1.1.6Update to 1.1.7
- High8.8Cross-Site Request Forgery
WP125
≤1.4.9Update to 1.5.0
- Critical9.8Authentication Bypass
BackupBuddy
<3.0Update to 3.0
- Medium5.3Sensitive Information Disclosure
BackupBuddy
<3.0Update to 3.0
- Critical9.8Authentication Bypass
BackupBuddy
<3.0Update to 3.0