Database
WordPress vulnerabilities listed in CISA KEV (page 1320)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium4.3 | Authenticated Information Disclosure | CVE-2018-20154 | — | |
| Medium5.4 | Missing Authorization | CVE-2018-20155 | — | |
| Critical9.1 | Directory Traversal | CVE-2016-10965 | — | |
| High7.5 | File Upload to User Controlled Location | CVE-2016-10966 | — | |
| High7.5 | Arbitrary File Upload | CVE-2016-10929 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10967 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10961 | — | |
| Medium6.1 | Cross-Site Scripting via a ticket excerpt. | CVE-2016-10970 | — | |
| Critical9.8 | Authentication Bypass | CVE-2016-10971 | — | |
| Critical9.8 | Authentication Bypass | CVE-2016-4828 | — | |
| High8.1 | Object Injection | CVE-2016-4825 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-4827 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-4826 | — | |
| Critical9.8 | Remote File Upload | CVE-2016-1000112 | — | |
| High8.8 | Privilege Escalation | CVE-2016-10968 | — | |
| High7.2 | Stored Cross-Site Scripting via discussion ticket title | CVE-2016-10969 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10705 | — | |
| Medium6.4 | Cross-Site Scripting via Attachment Name WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5834 | — | |
| High7.3 | Bypass sanitize_file_name Protection WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5839 | — | |
| Medium5.5 | Cross-Site Scripting via Customizer WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5832 | — | |
| Medium4.3 | Revision History Disclosure WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5835 | — | |
| Medium6.4 | Cross-Site Scripting via Attachment Name #2 WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5833 | — | |
| Medium5.3 | Denial of Service via oEmbed Protocol WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5836 | — | |
| Medium5.4 | Authorization Bypass to Remove Category Attribute WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5837 | — | |
| Medium5.3 | Password Change via Stolen Cookie WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5838 | — | |
| Critical9.8 | SQL Injection | CVE-2016-10917 | — | |
| Critical9.6 | Remote Code Execution | CVE-2016-20010 | — | |
| Medium6.5 | News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting | CVE-2017-18634 | — | |
| Critical9.8 | News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update | CVE-2016-10972 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2016-15043 | — |
- Medium4.3Authenticated Information Disclosure
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Medium5.4Missing Authorization
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Critical9.1Directory Traversal
Real3D Flipbook
≤1.0.0No patch available
- High7.5File Upload to User Controlled Location
Real3D Flipbook
≤1.0.0No patch available
- High7.5Arbitrary File Upload
Advanced AJAX Page Loader
<2.7.7Update to 2.7.7
- Medium6.1Reflected Cross-Site Scripting
Real3D Flipbook
≤1.0.0No patch available
- Medium6.1Cross-Site Scripting
ColorWay
≤3.4.1Update to 3.4.2
- Medium6.1Cross-Site Scripting via a ticket excerpt.
SupportFlow
<0.7Update to 0.7
- Critical9.8Authentication Bypass
MemberSonic Lite Membership Site Plugin
≤1.2Update to 1.302
- Critical9.8Authentication Bypass
Welcart e-Commerce
≤1.8.2Update to 1.8.3
- High8.1Object Injection
Welcart e-Commerce
<1.8.3Update to 1.8.3
- Medium6.1Cross-Site Scripting
Welcart e-Commerce
≤1.8.2Update to 1.8.3
- Medium6.1Reflected Cross-Site Scripting
Welcart e-Commerce
<1.8.3Update to 1.8.3
- Critical9.8Remote File Upload
contus-video-comments
≤1.0No patch available
- High8.8Privilege Escalation
Community by PeepSo – Download from PeepSo.com
≤1.6.0Update to 1.6.1
- High7.2Stored Cross-Site Scripting via discussion ticket title
SupportFlow
≤0.6Update to 0.7
- Medium6.1Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<4.0.4Update to 4.0.4
- Medium6.4Cross-Site Scripting via Attachment Name
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- High7.3Bypass sanitize_file_name Protection
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.5Cross-Site Scripting via Customizer
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium4.3Revision History Disclosure
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium6.4Cross-Site Scripting via Attachment Name #2
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.3Denial of Service via oEmbed Protocol
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.4Authorization Bypass to Remove Category Attribute
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.3Password Change via Stolen Cookie
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Critical9.8SQL Injection
Search Everything
<8.1.6Update to 8.1.6
- Critical9.6Remote Code Execution
EWWW Image Optimizer
≤2.8.4Update to 2.8.5
- Medium6.5News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting
Newspaper - News & WooCommerce WordPress Theme
<6.7.2Update to 6.7.2
- Critical9.8News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update
Newspaper - News & WooCommerce WordPress Theme
≤6.7.1Update to 6.7.2
- Critical9.8Arbitrary File Upload
WP Mobile Detector
≤3.5Update to 3.6