Database
Critical WordPress vulnerabilities (page 1326)
Vulnerabilities rated Critical (CVSS 9.0 or higher by the CNA). Most need no account and lead to full site takeover.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.4 | Cross-Site Scripting via MediaElement.js WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2 | CVE-2016-4567 | — | |
| Medium6.1 | Cross-Site Scripting via plupload.flash.swf WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2 | CVE-2016-4566 | — | |
| High7.2 | Cross-Site Scripting | CVE-2016-10976 | — | |
| Critical9.8 | 2.9.42 - Unauthenticated Arbitrary File Upload Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder2.9.36 – 2.9.42Update to 2.9.42.1 | — | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10994 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2016-15041 | — | |
| High7.5 | Missing Authorization Checks | CVE-2016-10983 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10920 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2016-10897 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2016-10995 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10986 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10984 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10987 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10985 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10870 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2016-10988 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10982 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2016-10981 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10989 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10980 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000141 | — | |
| Critical9.8 | Remote Code Execution | — | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000137 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000148 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000129 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000142 | — | |
| Medium6.4 | Cross-Site Scripting via Network Settings Page | CVE-2016-6634 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000155 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10876 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10872 | — |
- Medium6.4Cross-Site Scripting via MediaElement.js
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
- Medium6.1Cross-Site Scripting via plupload.flash.swf
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
- High7.2Cross-Site Scripting
Safe Editor
<1.2Update to 1.2
- Critical9.82.9.42 - Unauthenticated Arbitrary File Upload
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
2.9.36 – 2.9.42Update to 2.9.42.1
- Medium6.1Reflected Cross-Site Scripting
Truemag
all versionsNo patch available
- High7.2Stored Cross-Site Scripting
MainWP Dashboard: Self-hosted WordPress Management for Agencies
<3.1.3Update to 3.1.3
- High7.5Missing Authorization Checks
Ghost
≤0.5.5Update to 0.5.6
- Medium6.1Cross-Site Scripting
GNUCommerce
<0.5.7-betaUpdate to 0.5.7-beta
- Medium6.1Multiple Cross-Site Scripting
Sermon Browser
≤0.45.15Update to 0.45.16
- Critical9.8Arbitrary File Upload
Tevolution
<2.3.0Update to 2.3.0
- Medium6.1Reflected Cross-Site Scripting
Tweet Wheel
<1.0.3.3Update to 1.0.3.3
- Medium6.1Reflected Cross-Site Scripting
Echo Sign
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
افزونه پیامک ووکامرس | Persian WooCommerce SMS
≤3.3.2Update to 3.3.3
- Medium6.1Reflected Cross-Site Scripting
Echo Sign
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
Translate WordPress – Google Language Translator
<5.0.06Update to 5.0.06
- Medium5.4Stored Cross-Site Scripting
leenk.me
<2.6.0Update to 2.6.0
- High8.8Cross-Site Request Forgery
Kento Post View Counter
≤2.8No patch available
- Medium6.1Stored Cross-Site Scripting
Kento Post View Counter
≤2.8No patch available
- High8.8Cross-Site Request Forgery
leenk.me
≤2.5.0Update to 2.6.0
- Medium6.1Reflected Cross-Site Scripting
Kento Post View Counter
≤2.8No patch available
- Medium6.1Reflected Cross-Site Scripting
MiniMax – Page Layout Builder
≤1.9.3No patch available
- Critical9.8Remote Code Execution
Robo Gallery – Photo & Image Slider
<2.0.15Update to 2.0.15
- Medium6.1Reflected Cross-Site Scripting
Hero Maps Pro
≤2.1.0Update to 2.2.0
- Medium6.1Reflected Cross-Site Scripting
S3 Video Plugin
≤0.983No patch available
- Medium6.1Reflected Cross-Site Scripting
Defa Online Image Protector Free Edition
≤3.4No patch available
- Medium6.1Reflected Cross-Site Scripting
MW Font Changer
<4.3Update to 4.3
- Medium6.4Cross-Site Scripting via Network Settings Page
WordPress
<4.5Update to 4.5
- Medium6.1Reflected Cross-Site Scripting
WPSOLR – Elasticsearch and Solr search
≤8.6Update to 8.7
- High8.8Cross-Site Request Forgery
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤4.3Update to 4.3.1
- Medium6.1Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<1.3.40Update to 1.3.40