VulnCrest
Search
Create account
Report an incident
Radar sectionsCritical
Check my site

Database

Critical WordPress vulnerabilities (page 1322)

Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.

Signals
Software

41,567 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

Critical WordPress vulnerabilities (page 1322)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Reflected Cross-Site Scripting
Pondol Carousel≤1.0No patch available
CVE-2016-1000145—
Medium6.1Reflected Cross-Site Scripting
CM Tooltip Glossary<3.3.5Update to 3.3.5
CVE-2016-1000132—
Medium6.1Reflected Cross-Site Scripting
Simpel Reserveren 3≤3.5.2No patch available
CVE-2016-1000149—
Medium6.1Reflected Cross-Site Scripting via channel parameter
HDW WordPress Video Gallery≤1.2No patch available
CVE-2016-1000135—
Medium6.1Reflected Cross-Site Scripting via playlist parameter
HDW WordPress Video Gallery≤1.2No patch available
CVE-2016-1000134—
Medium6.1Reflected Cross-Site Scripting
Tidio Gallery≤1.1No patch available
CVE-2016-1000153—
Medium6.1Reflected Cross-Site Scripting
E-Search≤1.0No patch available
CVE-2016-1000131—
Medium6.1Reflected Cross-Site Scripting
WHIZZ<1.0.8Update to 1.0.8
CVE-2016-1000154—
Medium6.1Reflected Cross-Site Scripting
indexisto≤1.0.5No patch available
CVE-2016-1000138—
Medium6.1Reflected Cross-Site Scripting via gid
PhotoXhibit≤2.1.8No patch available
CVE-2016-1000143—
Critical9.8SQL Injection
Zotpress<6.1.3Update to 6.1.3
CVE-2016-1000217—
Medium6.1Cross-Site Scripting
WP Editor<1.2.6.3Update to 1.2.6.3
CVE-2016-10877—
Medium5.0Server-Side Request Forgery
WordPress<4.5Update to 4.5
CVE-2016-4029—
High8.8Cross-Site Request Forgery
Google Doc Embedder≤2.6.1Update to 2.6.2
CVE-2016-10882—
Medium6.1Cross-Site Scripting
Google Doc Embedder<2.6.2Update to 2.6.2
CVE-2016-10881—
Medium6.1Cross-Site Scripting
Google Doc Embedder<2.6.1Update to 2.6.1
CVE-2016-10880—
High7.5Insecure Direct Object Reference
WP Support Plus Responsive Ticket System<7.1.0Update to 7.1.0
CVE-2016-10930—
Critical9.8Arbitrary File Upload
PPOM – Product Addons & Custom Fields for WooCommerce≤1.1Update to 2.0
——
Critical9.8Multipurpose WordPress Theme | WordPress < 1.8 - Arbitrary File Upload
Neosense - Multipurpose WordPress Theme | WordPress<1.8Update to 1.8
CVE-2016-10954—
High8.8Multiple Cross-Site Request Forgery
Simple Membership≤3.3.2Update to 3.3.3
CVE-2016-10884—
High8.8Cross-Site Request Forgery to Cross-Site Scripting
Podlove Podcast Publisher<2.3.16Update to 2.3.16
CVE-2016-10941—
Medium6.4Stored Cross-Site Scripting
WP Frontend Profile≤0.2.1Update to 0.2.2
CVE-2019-15110—
Critical9.8Privilege Escalation
WP Frontend Profile≤0.2.1Update to 0.2.2
CVE-2019-15111—
High8.8Cross-Site Request Forgery
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation<1.7.9Update to 1.7.9
CVE-2016-109159K+
Medium6.5Authenticated Directory Traversal to Arbitrary File Access
WordPress≤4.6Update to 3.7.16 or 3.8.16 or 3.9.14 or 4.0.13 or 4.1.13 or 4.2.10 or 4.3.6 or 4.4.5 or 4.5.4 or 4.6.1
CVE-2016-7169—
Medium4.8Authenticated Stored Cross-Site Scripting
WordPress≤4.6Update to 3.7.16 or 3.8.16 or 3.9.14 or 4.0.13 or 4.1.13 or 4.2.10 or 4.3.6 or 4.4.5 or 4.5.4 or 4.6.1
CVE-2016-7168—
Medium6.1Reflected Cross-Site Scripting
Infusionsoft Gravity Forms Add-on<1.5.12Update to 1.5.12
CVE-2016-1000139—
Critical9.8SQL Injection
Zero Spam for WordPress≤2.1.1Update to 2.2.0
——
Critical9.8Arbitrary File Upload/Read
CYSTEME Finder, the admin files explorer<1.4Update to 1.4
CVE-2016-10955—
Critical9.8Local File Inclusion
Mail Masta≤1.0No patch available
CVE-2016-10956—

Search VulnCrest Radar

Jump to

Are you sure?