Database
WordPress vulnerabilities listed in CISA KEV (page 1331)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | Directory Traversal | CVE-2015-5471 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-5528 | — | |
| High7.5 | Arbitrary File Download | CVE-2015-9463 | — | |
| High7.2 | Blind SQL Injection | CVE-2015-9462 | — | |
| High7.2 | Blind SQL Injection | CVE-2015-9461 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2015-3299 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-9460 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9312 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9313 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-9465 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2015-9479 | — | |
| High7.5 | Directory Traversal | CVE-2015-5468 | — | |
| High7.5 | Directory Traversal to Arbitrary File Access | CVE-2015-9464 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9466 | — | |
| Medium6.1 | Open Redirect | CVE-2015-5461 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9467 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9468 | — | |
| High7.5 | Directory Traversal | CVE-2015-5469 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-9340 | — | |
| Critical9.1 | Path Traversal | CVE-2015-5609 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-5681 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-5682 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2015-9314 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-5057 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2015-9343 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9342 | — | |
| Critical9.8 | SQL Injection | CVE-2015-5599 | — | |
| High8.8 | Arbitrary Options Update | CVE-2015-9475 | — | |
| High7.5 | Directory Traversal | CVE-2015-4704 | — | |
| High8.8 | Fullscreen Photography Theme | Portfolio <= 1.8.5 - Arbitrary Options Update | CVE-2015-9476 | — |
- Medium5.3Directory Traversal
Swim Team
≤1.44.1077Update to 1.45.1085
- Medium6.1Cross-Site Scripting
Floating Social Bar
<1.1.7Update to 1.1.7
- High7.5Arbitrary File Download
S3Bubble Cloud Video with Adverts and Analytics
<4.8Update to 4.8
- High7.2Blind SQL Injection
Awesome Filterable Portfolio
<1.9Update to 1.9
- High7.2Blind SQL Injection
Awesome Filterable Portfolio
<1.9Update to 1.9
- Medium6.1Unauthenticated Cross-Site Scripting
Floating Social Bar
≤1.1.6Update to 1.1.7
- High8.8Authenticated SQL Injection
Pinpoint Booking System – Legacy version
<2.1Update to 2.1
- Medium6.1Reflected Cross-Site Scripting
NewStatPress
<1.0.6Update to 1.0.6
- Critical9.8SQL Injection
NewStatPress
<1.0.6Update to 1.0.6
- High8.8Authenticated SQL Injection
YASR – Yet Another Star Rating Plugin for WordPress
<0.9.1Update to 0.9.1
- Critical9.8Unauthenticated Arbitrary File Upload
acf-frontend-display
≤2.0.6No patch available
- High7.5Directory Traversal
WP eCommerce Shop Styling
<2.6Update to 2.6
- High7.5Directory Traversal to Arbitrary File Access
S3 Bubble Amazon S3 HTML5 Video with Adverts
≤0.7Update to 0.8
- Critical9.8SQL Injection
WTI Like Post
<1.4.3Update to 1.4.3
- Medium6.1Open Redirect
StageShow
<5.0.9Update to 5.0.9
- Critical9.8SQL Injection
Broken Link Manager
<0.5.0Update to 0.5.0
- Medium6.1Cross-Site Scripting
Broken Link Manager
≤0.4.5Update to 0.5.0
- High7.5Directory Traversal
MDC YouTube Downloader
<2.1.1Update to 2.1.1
- Critical9.8Arbitrary File Upload
Iptanus File Upload
<3.0.0Update to 3.0.0
- Critical9.1Path Traversal
Image Export
≤1.1Update to 1.1.1
- Critical9.8Arbitrary File Upload
Powerplay Gallery
≤3.3No patch available
- Critical9.8Arbitrary File Upload
Powerplay Gallery
≤3.3No patch available
- High7.2Stored Cross-Site Scripting
NewStatPress
≤1.0.3Update to 1.0.4
- Medium6.1Cross-Site Scripting
Broken Link Checker
<1.10.9Update to 1.10.9
- High8.8Cross-Site Request Forgery
WP Rollback – Rollback Plugins and Themes
<1.2.3Update to 1.2.3
- Medium6.1Cross-Site Scripting
WP Rollback – Rollback Plugins and Themes
<1.2.3Update to 1.2.3
- Critical9.8SQL Injection
Powerplay Gallery
≤3.3No patch available
- High8.8Arbitrary Options Update
Pont - Multipurpose Wordpress Theme | Business
≤1.5No patch available
- High7.5Directory Traversal
download-zip-attachments
≤1.0No patch available
- High8.8Fullscreen Photography Theme | Portfolio <= 1.8.5 - Arbitrary Options Update
Teardrop - Fullscreen Photography Theme | Portfolio
≤1.8.5Update to 1.8.6