High-Tech Bridge Security Research Lab

Title	CVE ID	CVSS	Vector	Date
WPtouch < 1.9.20 - Cross-Site Scripting	CVE-2010-4779	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 1, 2010
CDN Vote < 0.4.2 - SQL Injection	CVE-2011-5308	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	February 8, 2011
Photosmash Plugin < 1.0.5 - Cross-Site Scripting	CVE-2011-5307	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 22, 2011
GD Star Rating <= 1.9.22 - Cross-Site Scripting		6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 22, 2011
WP Forum Server <= 1.6.5 - SQL Injection	CVE-2011-1047	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	February 22, 2011
Starbox Voting <= 2.0.4 - Full Path Disclosure		5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	February 22, 2011
SodaHead Polls < 2.0.4 - Multiple Cross-Site Scripting	CVE-2011-5304	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	March 17, 2011
SocialGrid <= 2.4 - Cross-Site Scripting		6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	April 19, 2011
Social Slider < 7.4.2 - SQL Injection	CVE-2011-5286	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	July 20, 2011
CMS Tree Page View < 0.8.9 - Cross-Site Scripting	CVE-2012-1834	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	March 26, 2012
Timely All-in-One Events Calendar < 1.6 - Cross-Site Scripting	CVE-2012-1835	7.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L	April 11, 2012
MailPoet Newsletters <= 2.2 - Multiple SQL Injections	CVE-2013-1408	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	February 3, 2013
CommentLuv < 2.92.4 - Reflected Cross-Site Scripting	CVE-2013-1409	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	February 6, 2013
BackWPup < 3.0.13 - Cross-Site Scripting	CVE-2013-4626	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	August 21, 2013
Ad-minister <= 0.6 - Cross-Site Scripting	CVE-2013-6993	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 13, 2013
AskApache Firefox Adsense <= 3.0 - Cross-Site Request Forgery	CVE-2013-6992	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	December 26, 2013
WP-Cron Dashboard < 1.1.6 - Cross-Site Scripting	CVE-2013-6991	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	December 26, 2013
Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP < 4.29.5 - Cross-Site Scripting	CVE-2014-1906	7.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L	February 6, 2014
Broadcast Live Video – Live Streaming < 4.29.5 - Full Path Disclosure	CVE-2014-1908	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	February 27, 2014
Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP < 4.29.5 - Arbitrary File Read/Deletion	CVE-2014-1907	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	February 27, 2014

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation