CWE-22Vulnerability type

WordPress Path Traversal vulnerabilities (page 1351)

File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Path Traversal vulnerabilities (page 1351)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Cross-Site Scripting Webcam/Screen/Mic Recorder for Video Comments and Forms≤1.55Update to 1.55.3	CVE-2014-4567	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting Ruven Toolkit≤2.0No patch available	CVE-2014-4548	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting WordPress Responsive Preview<1.2Update to 1.2	CVE-2014-4594	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting wp-football≤1.1No patch available	CVE-2014-4586	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting Appointments Scheduler≤1.5No patch available	CVE-2014-4579	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting Webcam Microphone Screen Recorder – Media Capture≤1.55.4Update to 1.55.5	CVE-2014-4568	—	Jun 12, 2014
Medium6.1	Cross-Site Scripting WikiPop≤2.0No patch available	CVE-2014-4575	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting WP-Picasa-Image≤1.0No patch available	CVE-2014-4591	—	Jun 12, 2014
Medium6.1	Reflected Cross-Site Scripting WP Consultant≤1.0No patch available	CVE-2014-4582	—	Jun 12, 2014
High8.8	Cross-Site Request Forgery Featured Comments<1.2.5Update to 1.2.5	CVE-2014-4163	—	Jun 10, 2014
Medium6.1	Cross-Site Scripting Member Approval≤131109No patch available	CVE-2014-3850	—	Jun 10, 2014
Medium4.3	Cross-Site Request Forgery leading to player deletion JW Player for Flash & HTML5 Video<2.1.4Update to 2.1.4	CVE-2014-4030	—	Jun 10, 2014
Medium6.1	Reflected Cross-Site Scripting Disqus Comment System<2.76Update to 2.76	CVE-2014-5345	—	Jun 9, 2014
Critical9.8	SQL Injection Participants Database<1.5.4.9Update to 1.5.4.9	CVE-2014-3961	—	Jun 2, 2014
High7.2	Cross-Site Scripting simple-popup-images≤1.0Update to 1.1	CVE-2014-3921	—	May 30, 2014
High7.5	Path Traversal Cross-RSS≤1.7No patch available	CVE-2014-4941	—	May 29, 2014
Medium5.3	Sensitive Information Disclosure WP EasyCart: Shopping Cart and eCommerce Store≤2.0.5Update to 2.0.6	CVE-2014-4942	—	May 28, 2014
Medium6.1	Cross-Site Scripting Jigoshop Swipe plugin≤3.1.0No patch available	CVE-2014-4557	—	May 28, 2014
Medium6.1	Cross-Site Scripting Validated≤1.0.2Update to 2.0.0	CVE-2014-4564	—	May 28, 2014
Medium6.1	Cross-Site Scripting OMFG Mobile Pro≤1.1.26No patch available	CVE-2014-4541	—	May 28, 2014
Medium6.1	Cross-Site Scripting Rezgo Online Booking<1.4.3Update to 1.4.3	CVE-2014-4546	—	May 28, 2014
Medium6.1	Cross-Site Scripting Podcast Channels<0.21Update to 0.21	CVE-2014-4544	—	May 28, 2014
Medium6.1	Cross-Site Scripting ZdStatistics≤2.0.1No patch available	CVE-2014-4605	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting ActiveHelper LiveHelp Live Chat<3.1.5Update to 3.1.5	CVE-2014-4513	—	May 28, 2014
Medium6.1	Unauthenticated Cross-Site Scripting Easy Career Openings≤0.4No patch available	CVE-2014-4523	—	May 28, 2014
Medium6.1	Cross-Site Scripting wppm≤1.6.4.bNo patch available	CVE-2014-4593	—	May 28, 2014
High7.5	Directory Traversal Tera Charts≤0.1Update to 1.0	CVE-2014-4940	—	May 28, 2014
Critical9.8	SQL Injection WP Rss Poster≤1.0.0No patch available	CVE-2014-4938	—	May 28, 2014
High8.8	Authenticated SQL Injection YAWPP (Yet Another WordPress Petition Plugin)≤1.2.1Update to 1.2.2	CVE-2014-5182	—	May 28, 2014
Medium6.1	Reflected Cross-Site Scripting swipehq-payment-gateway-woocommerce≤2.7.1No patch available	CVE-2014-4558	—	May 28, 2014

Medium6.1
Cross-Site Scripting
Webcam/Screen/Mic Recorder for Video Comments and Forms
≤1.55Update to 1.55.3
CVE-2014-4567Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
Ruven Toolkit
≤2.0No patch available
CVE-2014-4548Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
WordPress Responsive Preview
<1.2Update to 1.2
CVE-2014-4594Jun 12, 2014
Medium6.1
Cross-Site Scripting
wp-football
≤1.1No patch available
CVE-2014-4586Jun 12, 2014
Medium6.1
Cross-Site Scripting
Appointments Scheduler
≤1.5No patch available
CVE-2014-4579Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
Webcam Microphone Screen Recorder – Media Capture
≤1.55.4Update to 1.55.5
CVE-2014-4568Jun 12, 2014
Medium6.1
Cross-Site Scripting
WikiPop
≤2.0No patch available
CVE-2014-4575Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
WP-Picasa-Image
≤1.0No patch available
CVE-2014-4591Jun 12, 2014
Medium6.1
Reflected Cross-Site Scripting
WP Consultant
≤1.0No patch available
CVE-2014-4582Jun 12, 2014
High8.8
Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
CVE-2014-4163Jun 10, 2014
Medium6.1
Cross-Site Scripting
Member Approval
≤131109No patch available
CVE-2014-3850Jun 10, 2014
Medium4.3
Cross-Site Request Forgery leading to player deletion
JW Player for Flash & HTML5 Video
<2.1.4Update to 2.1.4
CVE-2014-4030Jun 10, 2014
Medium6.1
Reflected Cross-Site Scripting
Disqus Comment System
<2.76Update to 2.76
CVE-2014-5345Jun 9, 2014
Critical9.8
SQL Injection
Participants Database
<1.5.4.9Update to 1.5.4.9
CVE-2014-3961Jun 2, 2014
High7.2
Cross-Site Scripting
simple-popup-images
≤1.0Update to 1.1
CVE-2014-3921May 30, 2014
High7.5
Path Traversal
Cross-RSS
≤1.7No patch available
CVE-2014-4941May 29, 2014
Medium5.3
Sensitive Information Disclosure
WP EasyCart: Shopping Cart and eCommerce Store
≤2.0.5Update to 2.0.6
CVE-2014-4942May 28, 2014
Medium6.1
Cross-Site Scripting
Jigoshop Swipe plugin
≤3.1.0No patch available
CVE-2014-4557May 28, 2014
Medium6.1
Cross-Site Scripting
Validated
≤1.0.2Update to 2.0.0
CVE-2014-4564May 28, 2014
Medium6.1
Cross-Site Scripting
OMFG Mobile Pro
≤1.1.26No patch available
CVE-2014-4541May 28, 2014
Medium6.1
Cross-Site Scripting
Rezgo Online Booking
<1.4.3Update to 1.4.3
CVE-2014-4546May 28, 2014
Medium6.1
Cross-Site Scripting
Podcast Channels
<0.21Update to 0.21
CVE-2014-4544May 28, 2014
Medium6.1
Cross-Site Scripting
ZdStatistics
≤2.0.1No patch available
CVE-2014-4605May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
ActiveHelper LiveHelp Live Chat
<3.1.5Update to 3.1.5
CVE-2014-4513May 28, 2014
Medium6.1
Unauthenticated Cross-Site Scripting
Easy Career Openings
≤0.4No patch available
CVE-2014-4523May 28, 2014
Medium6.1
Cross-Site Scripting
wppm
≤1.6.4.bNo patch available
CVE-2014-4593May 28, 2014
High7.5
Directory Traversal
Tera Charts
≤0.1Update to 1.0
CVE-2014-4940May 28, 2014
Critical9.8
SQL Injection
WP Rss Poster
≤1.0.0No patch available
CVE-2014-4938May 28, 2014
High8.8
Authenticated SQL Injection
YAWPP (Yet Another WordPress Petition Plugin)
≤1.2.1Update to 1.2.2
CVE-2014-5182May 28, 2014
Medium6.1
Reflected Cross-Site Scripting
swipehq-payment-gateway-woocommerce
≤2.7.1No patch available
CVE-2014-4558May 28, 2014