WordPress CVEs

CVE-2012-6707 October 19, 2017

WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may… Full details

HIGH 7.5

CVE-2015-5227 October 18, 2017

The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter. Full details

HIGH 8.8

CVE-2014-8491 October 18, 2017

The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a request to (1) flagallery-skins/banner_widget_default/gallery.php or (2) flash-album-gallery/skins/banner_widget_default/gallery.php. Full details

MEDIUM 5.3

CVE-2015-7806 October 17, 2017

Eval injection vulnerability in the fm_saveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers to execute arbitrary code via unspecified vectors. Full details

CRITICAL 9.8

CVE-2014-8621 October 16, 2017

SQL injection vulnerability in the Store Locator plugin 2.3 through 3.11 for WordPress allows remote attackers to execute arbitrary SQL commands via the sl_custom_field parameter to sl-xml.php. Full details

CRITICAL 9.8

CVE-2014-8087 October 16, 2017

Cross-site scripting (XSS) vulnerability in the post highlights plugin before 2.6.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the txt parameter in a headline action to ajax/ph_save.php. Full details

MEDIUM 6.1

CVE-2017-15375 October 16, 2017

Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress. The vulnerabilities are located in the `query` and `id` parameters of the `wpjb-email`, `wpjb-job`, `wpjb-application`, and `wpjb-membership` modules.… Full details

MEDIUM 6.1

CVE-2016-9263 October 12, 2017

WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file. Full details

MEDIUM 4.7

CVE-2015-2673 October 6, 2017

The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for WordPress allow remote attackers to gain administrator privileges and execute arbitrary code via the option_name and option_value parameters. Full details

HIGH 8.8

CVE-2017-15079 October 6, 2017

The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal. Full details

HIGH 7.5

CVE-2014-8758 October 6, 2017

Cross-site scripting (XSS) vulnerability in Best Gallery Albums Plugin before 3.0.70for WordPress allows remote attackers to inject arbitrary web script or HTML via the order_id parameter in the gallery_album_sorting page to wp-admin/admin.php. Full details

MEDIUM 6.1

CVE-2014-8492 October 6, 2017

Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) site_name, (2) message, or (3)… Full details

MEDIUM 6.1

CVE-2014-7240 October 6, 2017

Cross-site scripting (XSS) vulnerability in the Easy Contact Form Solution plugin before 1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value parameter in a master_response action to… Full details

MEDIUM 6.1

CVE-2017-14990 October 3, 2017

WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as… Full details

MEDIUM 6.5

CVE-2017-14848 October 3, 2017

WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter. Full details

HIGH 8.8

CVE-2015-7357 October 3, 2017

Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #. Full details

MEDIUM 6.1

CVE-2015-9234 September 30, 2017

The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactformpp_id parameter to cp_contactformpp.php. Full details

HIGH 7.2

CVE-2015-9233 September 30, 2017

The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php. Full details

HIGH 8.8

CVE-2017-14507 September 29, 2017

Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) timeline parameter in content_timeline_class.php; or the id parameter to (2) pages/content_timeline_edit.php… Full details

CRITICAL 9.8

CVE-2017-2551 September 28, 2017

Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download. Full details

HIGH 7.5

CVE-2017-14847 September 28, 2017

Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter. Full details

HIGH 8.8

CVE-2017-14846 September 28, 2017

Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter. Full details

HIGH 8.8

CVE-2017-14845 September 28, 2017

Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter. Full details

HIGH 8.8

CVE-2017-14844 September 28, 2017

Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter. Full details

HIGH 8.8

CVE-2017-14843 September 28, 2017

Mojoomla School Management System for WordPress allows SQL Injection via the id parameter. Full details

HIGH 8.8

CVE-2017-14842 September 28, 2017

Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter. Full details

HIGH 8.8

CVE-2017-14622 September 28, 2017

Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter or (2) kbAction… Full details

MEDIUM 6.1

CVE-2017-14766 September 27, 2017

The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fn_ssr_add_st_submit() function and fn_ssr_del_st_submit() function in functions.php only require knowing the student id number. Full details

HIGH 7.5

CVE-2017-14760 September 27, 2017

SQL Injection exists in /includes/event-management/index.php in the event-espresso-free (aka Event Espresso Lite) plugin v3.1.37.12.L for WordPress via the recurrence_id parameter to /wp-admin/admin.php. Full details

CRITICAL 9.8

CVE-2017-14751 September 26, 2017

The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field. Full details

MEDIUM 6.1

CVE-2015-7670 September 26, 2017

Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System plugin before 1.2.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) id parameter. Full details

CRITICAL 9.8

CVE-2017-14125 September 25, 2017

SQL injection vulnerability in the Responsive Image Gallery plugin before 1.2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "id" parameter in an add_edit_theme task in the wpdevart_gallery_themes page to… Full details

CRITICAL 9.8

CVE-2017-14726 September 23, 2017

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor. Full details

MEDIUM 6.1

CVE-2017-14725 September 23, 2017

Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php. Full details

MEDIUM 5.4

CVE-2017-14724 September 23, 2017

Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery. Full details

MEDIUM 6.1

CVE-2017-14723 September 23, 2017

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks. Full details

CRITICAL 9.8

CVE-2017-14722 September 23, 2017

Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename. Full details

HIGH 7.5

CVE-2017-14721 September 23, 2017

Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name. Full details

MEDIUM 6.1

CVE-2017-14720 September 23, 2017

Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. Full details

MEDIUM 6.1

CVE-2017-14719 September 23, 2017

Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components. Full details

HIGH 7.5

CVE-2017-14718 September 23, 2017

Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. Full details

MEDIUM 6.1

CVE-2015-2826 September 20, 2017

WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information. Full details

MEDIUM 5.3

CVE-2015-4089 September 19, 2017

Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that… Full details

HIGH 8.8

CVE-2015-3299 September 19, 2017

Cross-site scripting (XSS) vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to original service order. Full details

MEDIUM 6.1

CVE-2017-14530 September 18, 2017

WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstrated by inserting XSS sequences. Full details

HIGH 8

CVE-2017-1002028 September 14, 2017

Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query. Full details

CRITICAL 9.8

CVE-2017-1002027 September 14, 2017

Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query in file ./rk-responsive-contact-form/include/rk_user_list.php. Full details

CRITICAL 9.8

CVE-2017-1002026 September 14, 2017

Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement. Full details

HIGH 8.8

CVE-2017-1002025 September 14, 2017

Vulnerability in wordpress plugin add-edit-delete-listing-for-member-module v1.0, The plugin author does not sanitize user supplied input via $act before passing it into an SQL statement. Full details

HIGH 7.2

CVE-2017-1002023 September 14, 2017

Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easy_team_manager_desc_edit.php Full details

CRITICAL 9.8