CWE-22Vulnerability type

WordPress Path Traversal vulnerabilities (page 1336)

File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Path Traversal vulnerabilities (page 1336)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting Easy Digital Downloads – eCommerce Payments and Subscriptions made easy<2.3.7Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7	CVE-2015-9505	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting iThemes Builder Style Manager<0.7.7Update to 0.7.7	CVE-2015-9379	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy US Sales Taxes Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9369	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads – Content Restriction≤2.0.7Update to 2.0.8	CVE-2015-9509	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Related Posts≤1.8.1Update to 1.8.2	CVE-2015-9361	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting 2Checkout Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9364	—	Apr 20, 2015
Medium6.1	Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting Easy Digital Downloads - Cross-Sell and Upsell≤1.1.2Update to 1.1.3	CVE-2015-9510	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – Per Product Emails<1.0.9Update to 1.0.9	CVE-2015-9520	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Twenty Twelve EDD≤1.1Update to 1.1.1	CVE-2015-9536	—	Apr 20, 2015
Critical9.8	SQL Injection Community Events≤1.3Update to 1.4	CVE-2015-3313	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – Recount Earnings<2.3.7Update to 2.3.7	CVE-2015-9524	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting WP-ViperGB<1.3.16Update to 1.3.16	CVE-2015-9356	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – Conditional Success Redirects<1.1.1Update to 1.1.1	CVE-2015-9511	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy EU Value Added (VAT) Taxes Add-on<1.2.0Update to 1.2.0	CVE-2015-9368	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Post Connector<1.0.4Update to 1.0.4	CVE-2015-9362	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting PayPal Pro Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9373	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – PDF stamper≤1.0No patch available	CVE-2015-9519	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting All-In-One Security (AIOS) – Security and Firewall<3.9.5Update to 3.9.5	CVE-2015-9294	—	Apr 20, 2015
Critical9.8	SQL Injection Tune Library<1.5.5Update to 1.5.5	CVE-2015-3314	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads (EDD) Stripe≤2.1.2Update to 2.1.3	CVE-2015-9529	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Authorize.net Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9365	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – eCommerce Payments and Subscriptions made easy≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7	CVE-2015-9512	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting EDD Favorites≤1.0.6Update to 1.0.7	CVE-2015-9513	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads (EDD) Digital Store<1.3.3Update to 1.3.3	CVE-2015-9532	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Mobile<1.2.8Update to 1.2.8	CVE-2015-9376	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads – Attach Accounts to Orders≤2.0.1Update to 2.0.2	CVE-2015-9507	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Download Monitor<1.7.1Update to 1.7.1	CVE-2015-9296	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Taxonomy Switcher≤1.0.3Update to 1.0.4	CVE-2015-10013	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Jetpack – AI Agents & MCP, Security, Backup & Analytics<3.4.3Update to 3.4.3	CVE-2015-9359	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Exchange Addon Invoices<1.4.0Update to 1.4.0	CVE-2015-9370	—	Apr 20, 2015

Medium6.1
Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<2.3.7Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
CVE-2015-9505Apr 20, 2015
Medium6.1
Cross-Site Scripting
iThemes Builder Style Manager
<0.7.7Update to 0.7.7
CVE-2015-9379Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy US Sales Taxes Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9369Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads – Content Restriction
≤2.0.7Update to 2.0.8
CVE-2015-9509Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Related Posts
≤1.8.1Update to 1.8.2
CVE-2015-9361Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
2Checkout Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9364Apr 20, 2015
Medium6.1
Cross-Sell and Upsell <= 1.1.2 - Reflected Cross-Site Scripting
Easy Digital Downloads - Cross-Sell and Upsell
≤1.1.2Update to 1.1.3
CVE-2015-9510Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – Per Product Emails
<1.0.9Update to 1.0.9
CVE-2015-9520Apr 20, 2015
Medium6.1
Cross-Site Scripting
Twenty Twelve EDD
≤1.1Update to 1.1.1
CVE-2015-9536Apr 20, 2015
Critical9.8
SQL Injection
Community Events
≤1.3Update to 1.4
CVE-2015-3313Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – Recount Earnings
<2.3.7Update to 2.3.7
CVE-2015-9524Apr 20, 2015
Medium6.1
Cross-Site Scripting
WP-ViperGB
<1.3.16Update to 1.3.16
CVE-2015-9356Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – Conditional Success Redirects
<1.1.1Update to 1.1.1
CVE-2015-9511Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy EU Value Added (VAT) Taxes Add-on
<1.2.0Update to 1.2.0
CVE-2015-9368Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Post Connector
<1.0.4Update to 1.0.4
CVE-2015-9362Apr 20, 2015
Medium6.1
Cross-Site Scripting
PayPal Pro Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9373Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – PDF stamper
≤1.0No patch available
CVE-2015-9519Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<3.9.5Update to 3.9.5
CVE-2015-9294Apr 20, 2015
Critical9.8
SQL Injection
Tune Library
<1.5.5Update to 1.5.5
CVE-2015-3314Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads (EDD) Stripe
≤2.1.2Update to 2.1.3
CVE-2015-9529Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Authorize.net Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9365Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.3.6Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
CVE-2015-9512Apr 20, 2015
Medium6.1
Cross-Site Scripting
EDD Favorites
≤1.0.6Update to 1.0.7
CVE-2015-9513Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads (EDD) Digital Store
<1.3.3Update to 1.3.3
CVE-2015-9532Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Mobile
<1.2.8Update to 1.2.8
CVE-2015-9376Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads – Attach Accounts to Orders
≤2.0.1Update to 2.0.2
CVE-2015-9507Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Download Monitor
<1.7.1Update to 1.7.1
CVE-2015-9296Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Taxonomy Switcher
≤1.0.3Update to 1.0.4
CVE-2015-10013Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<3.4.3Update to 3.4.3
CVE-2015-9359Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Exchange Addon Invoices
<1.4.0Update to 1.4.0
CVE-2015-9370Apr 20, 2015