CWE-22Vulnerability type
WordPress Path Traversal vulnerabilities (page 1343)
File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.9Authenticated SQL Injection
WP Symposium
<14.11Update to 14.11
- Medium6.5Open Redirection
wordpress-admanager
≤1.1.2No patch available
- Medium6.1Cross-Site Scripting
WP Symposium
≤14.10Update to 14.11
- Medium6.1Cross-Site Scripting
InstaSqueeze Sexy Squeeze Pages
all versionsNo patch available
- Critical9.8Arbitrary File Upload
Showbiz Pro Responsive Teaser WordPress Plugin
≤1.7.1No patch available
- Critical9.8Missing Authorization to Arbitrary File Upload
Showbiz Pro Responsive Teaser WordPress Plugin
<1.7.1Update to 1.7.1
- High8.1Authenticated Arbitrary Options Update
Download Manager
<2.7.3Update to 2.7.3
- Critical9.8SQL Injection
wpDataTables (Premium)
≤1.5.3Update to 1.5.4
- High8.8Authenticated SQL Injection
Polls CP
≤1.0.1Update to 1.0.2
- Medium6.4Cross-Site Scripting via CSS
WordPress
≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
- High8.1Hash Collision
WordPress
≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
- Medium6.1Cross-Site Scripting
Gallery Manager
≤1.5.12Update to 1.5.13
- High7.7Server-Side Request Forgery
WordPress
≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
- Critical9.8Multiple SQL Injection
SP Project & Document Manager
<2.4.4Update to 2.4.4
- Medium5.3Denial of Service via Long Password
WordPress
≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
- Medium6.1Cross-Site Scripting
Polls CP
<1.0.1Update to 1.0.1
- Medium6.4Cross-Site Scripting via Shortcode Brackets
WordPress
≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
- High8.8WordPress Core < 4.0.1 Cross-Site Request Forgery to Password Reset
WordPress
≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
- Medium6.4Cross-Site Scripting
WordPress
≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
- High7.2Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<2.8.9Update to 2.8.9
- High7.2Cross-Site Scripting via media-playlists
WordPress
≤4.0Update to 3.7.5 or 3.8.5 or 3.9.3 or 4.0.1
- Critical9.8Improper Authentication
WP Support Plus Responsive Ticket System
≤4.1Update to 4.2
- High7.5Directory Traversal
WP Support Plus Responsive Ticket System
<4.2Update to 4.2
- High7.5Directory Traversal
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
<1.7.15Update to 1.7.15
- High7.5Directory Traversal
DukaPress
<2.5.4Update to 2.5.4
- Medium6.4Cross-Site Scripting
supportezzy
≤1.2.5Update to 1.2.6
- Medium6.1Cross-Site Scripting
SpiderVPlayer
≤1.5.1Update to 1.5.2
- Medium6.3SQL Injection
AWP Classifieds
<3.0Update to 3.0
- Critical9.8Code Injection
CM Download Manager – Organize, Protect & Share Files in WordPress
≤2.0.3Update to 2.0.4
- Medium6.1Cross-Site Scripting
AWP Classifieds
<3.0Update to 3.0