CWE-22Vulnerability type

WordPress Path Traversal vulnerabilities (page 1357)

File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Path Traversal vulnerabilities (page 1357)
Severity	Vulnerability	CVE	Installs	Published
Critical9.8	SQL Injection Testimonial<2.3Update to 2.3	CVE-2013-5673	—	Sep 1, 2013
High8.8	Cross-Site Request Forgery Testimonial<2.3Update to 2.3	CVE-2013-5672	—	Sep 1, 2013
Medium6.1	Cross-Site Scripting Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress≤3.34Update to 3.35	CVE-2013-7481	—	Aug 26, 2013
Medium6.1	Reflected Cross-Site Scripting Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP≤4.25.3Update to 4.27	CVE-2013-5714	—	Aug 23, 2013
Medium6.1	Cross-Site Scripting BackWPup – WordPress Backup & Restore Plugin<3.0.13Update to 3.0.13	CVE-2013-4626	—	Aug 21, 2013
Medium6.1	Reflected Cross-Site Scripting A Forms≤1.4.2Update to 1.4.3	CVE-2013-10020	—	Aug 19, 2013
Medium6.1	Cross-Site Scripting Events Manager – Calendar, Bookings, Tickets, Appointments and more!<5.5Update to 5.5	CVE-2013-7478	—	Aug 14, 2013
Medium6.1	Cross-Site Scripting Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress≤3.51Update to 3.52	CVE-2013-7475	—	Aug 13, 2013
High7.1	Cross-Site Request Forgery HMS Testimonials<2.0.11Update to 2.0.11	CVE-2013-4240	—	Aug 8, 2013
Medium6.1	Cross-Site Scripting HMS Testimonials<2.0.11Update to 2.0.11	CVE-2013-4241	—	Aug 8, 2013
High7.2	Cross-Site Scripting via sort Parameter Download Monitor<3.3.6.2Update to 3.3.6.2	CVE-2013-5098	—	Jul 23, 2013
Medium6.1	Cross-Site Scripting via p Parameter Download Monitor<3.3.6.2Update to 3.3.6.2	CVE-2013-3262	—	Jul 22, 2013
Medium6.1	Reflected Cross-Site Scripting Category Grid View Gallery≤2.3.1Update to 2.3.2	CVE-2013-4117	—	Jul 12, 2013
Medium6.1	Cross-Site Scripting BuddyPress Extended Friendship Request<1.0.2Update to 1.0.2	CVE-2013-4944	—	Jul 3, 2013
Medium6.1	DOM Cross-Site Scripting Xorbin Digital Flash Clock≤1.0No patch available	CVE-2013-4693	—	Jun 30, 2013
High8.8	Cross-Site Request Forgery qTranslate≤2.5.39No patch available	CVE-2013-3251	—	Jun 23, 2013
Medium5.4	XXE Injection WordPress≤3.5.1Update to 3.5.2	CVE-2013-2202	—	Jun 21, 2013
Medium4.6	Content-Spoofing Attacks WordPress≤3.5.1Update to 3.5.2	CVE-2013-2204	—	Jun 21, 2013
Medium6.4	Cross-Site Scripting via Multiple Vectors WordPress≤3.5.1Update to 3.5.2	CVE-2013-2201	—	Jun 21, 2013
Medium5.4	Server Side Request Forgery WordPress≤3.5.1Update to 3.5.2	CVE-2013-2199	—	Jun 21, 2013
Medium5.3	Denial of Service via wp-postpass cookie WordPress<3.5.2Update to 3.5.2	CVE-2013-2173	—	Jun 21, 2013
Medium6.4	Cross-Site Scripting WordPress≤3.5.1Update to 3.5.2	CVE-2013-2205	—	Jun 21, 2013
Medium4.3	Sensitive Information Disclosure WordPress≤3.5.1Update to 3.5.2	CVE-2013-2203	—	Jun 21, 2013
Medium6.3	Missing Authorization Checks WordPress≤3.5.1Update to 3.5.2	CVE-2013-2200	—	Jun 21, 2013
Critical9.8	Arbitrary File Upload Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery≤1.9.12Update to 1.9.13	CVE-2013-3684	—	Jun 13, 2013
Medium5.4	Missing Authorization Checks & Cross-Site Request Forgery LightStart – Maintenance Mode, Coming Soon and Landing Page Builder<1.8.8Update to 1.8.8	CVE-2013-3250	—	Jun 5, 2013
Medium5.3	Full Path Dislcosure WordPress Exit Box Lite1.06 – 1.06Update to 1.10	CVE-2013-10030	—	May 28, 2013
Medium4.3	Cross-Site Request Forgery WordPress Exit Strategy≤1.55Update to 1.59	CVE-2013-10025	—	May 28, 2013
Medium4.3	Cross-Site Request Forgery WordPress Exit Box Lite≤1.06Update to 1.10	CVE-2013-10029	—	May 28, 2013
Medium5.3	Information Exposure WordPress Exit Strategy≤1.55Update to 1.59	CVE-2013-10024	—	May 28, 2013

Critical9.8
SQL Injection
Testimonial
<2.3Update to 2.3
CVE-2013-5673Sep 1, 2013
High8.8
Cross-Site Request Forgery
Testimonial
<2.3Update to 2.3
CVE-2013-5672Sep 1, 2013
Medium6.1
Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
≤3.34Update to 3.35
CVE-2013-7481Aug 26, 2013
Medium6.1
Reflected Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤4.25.3Update to 4.27
CVE-2013-5714Aug 23, 2013
Medium6.1
Cross-Site Scripting
BackWPup – WordPress Backup & Restore Plugin
<3.0.13Update to 3.0.13
CVE-2013-4626Aug 21, 2013
Medium6.1
Reflected Cross-Site Scripting
A Forms
≤1.4.2Update to 1.4.3
CVE-2013-10020Aug 19, 2013
Medium6.1
Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.5Update to 5.5
CVE-2013-7478Aug 14, 2013
Medium6.1
Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
≤3.51Update to 3.52
CVE-2013-7475Aug 13, 2013
High7.1
Cross-Site Request Forgery
HMS Testimonials
<2.0.11Update to 2.0.11
CVE-2013-4240Aug 8, 2013
Medium6.1
Cross-Site Scripting
HMS Testimonials
<2.0.11Update to 2.0.11
CVE-2013-4241Aug 8, 2013
High7.2
Cross-Site Scripting via sort Parameter
Download Monitor
<3.3.6.2Update to 3.3.6.2
CVE-2013-5098Jul 23, 2013
Medium6.1
Cross-Site Scripting via p Parameter
Download Monitor
<3.3.6.2Update to 3.3.6.2
CVE-2013-3262Jul 22, 2013
Medium6.1
Reflected Cross-Site Scripting
Category Grid View Gallery
≤2.3.1Update to 2.3.2
CVE-2013-4117Jul 12, 2013
Medium6.1
Cross-Site Scripting
BuddyPress Extended Friendship Request
<1.0.2Update to 1.0.2
CVE-2013-4944Jul 3, 2013
Medium6.1
DOM Cross-Site Scripting
Xorbin Digital Flash Clock
≤1.0No patch available
CVE-2013-4693Jun 30, 2013
High8.8
Cross-Site Request Forgery
qTranslate
≤2.5.39No patch available
CVE-2013-3251Jun 23, 2013
Medium5.4
XXE Injection
WordPress
≤3.5.1Update to 3.5.2
CVE-2013-2202Jun 21, 2013
Medium4.6
Content-Spoofing Attacks
WordPress
≤3.5.1Update to 3.5.2
CVE-2013-2204Jun 21, 2013
Medium6.4
Cross-Site Scripting via Multiple Vectors
WordPress
≤3.5.1Update to 3.5.2
CVE-2013-2201Jun 21, 2013
Medium5.4
Server Side Request Forgery
WordPress
≤3.5.1Update to 3.5.2
CVE-2013-2199Jun 21, 2013
Medium5.3
Denial of Service via wp-postpass cookie
WordPress
<3.5.2Update to 3.5.2
CVE-2013-2173Jun 21, 2013
Medium6.4
Cross-Site Scripting
WordPress
≤3.5.1Update to 3.5.2
CVE-2013-2205Jun 21, 2013
Medium4.3
Sensitive Information Disclosure
WordPress
≤3.5.1Update to 3.5.2
CVE-2013-2203Jun 21, 2013
Medium6.3
Missing Authorization Checks
WordPress
≤3.5.1Update to 3.5.2
CVE-2013-2200Jun 21, 2013
Critical9.8
Arbitrary File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤1.9.12Update to 1.9.13
CVE-2013-3684Jun 13, 2013
Medium5.4
Missing Authorization Checks & Cross-Site Request Forgery
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<1.8.8Update to 1.8.8
CVE-2013-3250Jun 5, 2013
Medium5.3
Full Path Dislcosure
WordPress Exit Box Lite
1.06 – 1.06Update to 1.10
CVE-2013-10030May 28, 2013
Medium4.3
Cross-Site Request Forgery
WordPress Exit Strategy
≤1.55Update to 1.59
CVE-2013-10025May 28, 2013
Medium4.3
Cross-Site Request Forgery
WordPress Exit Box Lite
≤1.06Update to 1.10
CVE-2013-10029May 28, 2013
Medium5.3
Information Exposure
WordPress Exit Strategy
≤1.55Update to 1.59
CVE-2013-10024May 28, 2013