CWE-22Vulnerability type
WordPress Path Traversal vulnerabilities (page 1327)
File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8SQL Injection
WP Limit Login Attempts
<2.0.1Update to 2.0.1
- Critical9.8Local File Inclusion
Memphis Documents Library
≤2.6.16Update to 3.0
- Medium6.3Cross-Site Request Forgery
Contact Form Generator : Creative form builder for WordPress
≤2.1.86Update to 2.5.0
- Critical9.8Remote File Inclusion
Memphis Documents Library
<3.0Update to 3.0
- Critical9.8Remote File Inclusion via TimThumb
BJ Lazy Load
0.7.5 – 0.7.5Update to 1.0
- Medium6.1Cross-Site Scripting in Accept-Language Header
WPML Multilingual CMS
2.9.3 – 3.2.6Update to 3.2.7
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Testimonial Slider
≤1.2.5Update to 1.3.0
- Medium4.3Cross-Site Request Forgery
WatuPRO
<4.9.0.8Update to 4.9.0.8
- Medium6.4Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.9Update to 2.1.10
- Medium6.1Reflected Cross-Site Scripting
CKEditor for WordPress
≤4.5.3Update to 4.5.3.1
- Medium6.1Cross-Site Scripting
sourceAFRICA
≤0.1.3No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Responsive Thumbnail Slider
<1.0.1Update to 1.0.1
- High7.5Insecure Direct Object Reference
Job Manager
≤0.7.25No patch available
- Medium6.1Stored Cross-Site Scripting
Captain Slider
≤1.0.6No patch available
- Medium6.5Local File Inclusion
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.10Update to 2.1.15
- Medium6.1Reflected Cross-Site Scripting
Navis DocumentCloud
<0.1.1Update to 0.1.1
- Medium5.5Cross-Site Scripting
Embeds for YouTube
<3.3.3Update to 3.3.3
- High8.8Multiple Cross-Site Request Forgery
Private Only
≤3.5.1No patch available
- Medium6.1Reflected Cross-Site Scripting
SoundCloud Is Gold
<2.3.2Update to 2.3.2
- Medium6.1Reflected Cross-Site Scripting
OnePress Social Locker
<4.2.5Update to 4.2.5
- Medium5.4Authenticated Stored Cross-Site Scripting
plugnedit
<6.2.0Update to 6.2.0
- Medium6.5Cross-Site Request Forgery leading to Stored Cross-Site Scripting
plugnedit
<6.2.0Update to 6.2.0
- Medium5.4Cross-Site Scripting
GoCodes
≤1.3.5No patch available
- Medium6.3Cross-Site Request Forgery
Multicons
<3.0Update to 3.0
- Medium6.1Stored Cross-Site Scripting
SEO Redirection Plugin – 301 Redirect Manager
<4.3Update to 4.3
- Medium6.1Reflected Cross-Site Scripting
Olevmedia Shortcodes
<1.1.9Update to 1.1.9
- Medium6.1Reflected Cross-Site Scripting
Simple Fields
<1.4.11Update to 1.4.11
- High8.8SQL Injection
WordPress Meta Robots
≤2.1No patch available
- High8.8Authenticated Blind SQL Injection
GoCodes
≤1.3.5No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Cincopa video and media plug-in
<1.137Update to 1.137