CWE-22Vulnerability type
WordPress Path Traversal vulnerabilities (page 1365)
File read or delete functions that accept ../ sequences, exposing wp-config.php or deleting critical files.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2011-3865 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3856 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3858 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3864 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3857 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3859 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-3863 | — | |
| High7.1 | Cross-Site Scripting | CVE-2011-3853 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3854 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3855 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3852 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3861 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-3851 | — | |
| Critical9.8 | SQL Injection | CVE-2015-2216 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-1068 | — | |
| Critical9.8 | SQL Injection | CVE-2012-1067 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2011-3981 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2012-1205 | — | |
| Critical9.8 | SQL Injection | CVE-2011-5216 | — | |
| Critical9.8 | Remote File Download | CVE-2011-4106 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-4568 | — | |
| High8.8 | SQL Injection | CVE-2011-5286 | — | |
| Medium6.3 | Security Hardening | CVE-2011-3125 | — | |
| Medium5.3 | Username Enumeration | CVE-2011-3126 | — | |
| Medium6.3 | Media Related Security Issue | CVE-2011-3122 | — | |
| High8.8 | SQL Injection | CVE-2011-3130 | — | |
| High8.8 | Arbitrary File Upload | CVE-2011-3129 | — | |
| High7.1 | Clickjacking | CVE-2011-3127 | — | |
| Medium4.3 | Sensitive Information Disclosure | CVE-2011-3128 | — | |
| Critical9.8 | Unauthenticated Remote Code Execution | CVE-2011-10033 | — |
- Medium6.1Cross-Site Scripting
Black-Letterhead
<1.6Update to 1.6
- Medium6.1Cross-Site Scripting
Elegant Grunge
≤1.0.3Update to 1.0.4
- Medium6.1Cross-Site Scripting
Pixiv Custom
<2.1.6Update to 2.1.6
- Medium6.1Cross-Site Scripting
The Erudite
≤2.7.8Update to 2.8
- Medium6.1Cross-Site Scripting
Antisnews
≤1.09Update to 1.10
- Medium6.1Cross-Site Scripting
Trending
<0.2Update to 0.2
- Medium6.1Reflected Cross-Site Scripting
RedLine
<1.66Update to 1.66
- High7.1Cross-Site Scripting
Hybrid
<0.10Update to 0.10
- Medium6.1Cross-Site Scripting
ZenLite
≤4.3Update to 4.4
- Medium6.1Cross-Site Scripting
F8 Lite
≤4.2.1Update to 4.2.2
- Medium6.1Cross-Site Scripting
evolve
<1.2.7Update to 1.2.7
- Medium6.1Cross-Site Scripting
Web Minimalist 200901
≤1.1No patch available
- Medium6.1Cross-Site Scripting
News
≤0.1Update to 0.2
- Critical9.8SQL Injection
Photocrati
≤4.0Update to 4.1
- Medium6.1Cross-Site Scripting
WP-RecentComments
<2.0.7Update to 2.0.7
- Critical9.8SQL Injection
WP-RecentComments
≤2.0.7Update to 2.1
- Critical9.8Remote File Inclusion
AllWebMenus WordPress Menu Plugin
≤1.1.3Update to 1.1.4
- Critical9.8Remote File Inclusion
Relocate Upload
<0.20Update to 0.20
- Critical9.8SQL Injection
SCORM Cloud For WordPress
<1.0.7Update to 1.0.7
- Critical9.8Remote File Download
TimThumb
<2.0Update to 2.0
- Medium6.1Cross-Site Scripting
FV Flowplayer Video Player
≤1.2.11Update to 1.2.12
- High8.8SQL Injection
Social Slider
<7.4.2Update to 7.4.2
- Medium6.3Security Hardening
WordPress
≤3.1.2Update to 3.1.3
- Medium5.3Username Enumeration
WordPress
≤3.1.2Update to 3.1.3
- Medium6.3Media Related Security Issue
WordPress
≤3.1.2Update to 3.2
- High8.8SQL Injection
WordPress
≤3.1.2Update to 3.1.3
- High8.8Arbitrary File Upload
WordPress
≤3.1.2Update to 3.1.3
- High7.1Clickjacking
WordPress
≤3.1.2Update to 3.1.3
- Medium4.3Sensitive Information Disclosure
WordPress
≤3.1.2Update to 3.1.3
- Critical9.8Unauthenticated Remote Code Execution
is-human
≤1.4.2No patch available