Database
WordPress vulnerabilities listed in CISA KEV (page 1333)
Plugin and theme vulnerabilities that CISA lists in its Known Exploited Vulnerabilities catalog. If you run any of these versions, patch first and check for signs of compromise.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | Arbitrary File Upload | CVE-2015-9471 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-4139 | — | |
| Medium6.1 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2015-4140 | — | |
| Medium6.1 | Open Redirect | CVE-2015-4070 | — | |
| High8.8 | SQL Injection | CVE-2014-5183 | — | |
| Critical9.8 | SQL Injection | CVE-2015-2090 | — | |
| Medium5.8 | Open Proxy | CVE-2015-4339 | — | |
| High8.8 | Multiple Cross-Site Request Forgery | CVE-2015-4089 | — | |
| High8.8 | SQL Injection | CVE-2015-4066 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-4064 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-10131 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2015-4084 | — | |
| Medium6.5 | Cross-Site Scripting | CVE-2015-4065 | — | |
| Medium5.4 | Authenticated Cross-Site Scripting | CVE-2015-4063 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-4062 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9300 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2015-4127 | — | |
| Medium6.1 | Reflecte Cross-Site Scripting | CVE-2015-10095 | — | |
| High8.8 | Privilege Escalation | CVE-2015-4038 | — | |
| High7.2 | Authenticated (Admin+) Remote Code Execution | CVE-2015-3173 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2015-4039 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9346 | — | |
| High7.1 | Cross-Site Scripting | CVE-2015-3647 | — | |
| Critical9.8 | SQL Injection | CVE-2015-4018 | — | |
| High7.5 | Arbitrary File Download via Path Traversal | CVE-2015-10134 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-5034 | — | |
| High7.5 | Sensitive Information Disclosure | CVE-2015-9491 | — | |
| Medium6.5 | Arbitrary Shortcode Execution | CVE-2015-9318 | — | |
| High7.5 | Information Disclosure | CVE-2015-9486 | — | |
| High7.5 | Sensitive Information Disclosure | CVE-2015-9484 | — |
- Critical9.8Arbitrary File Upload
ZoomSounds - WordPress Wave Audio Player with Playlist
<3.0Update to 3.0
- Medium6.1Cross-Site Scripting
wp-smiley
≤1.4.1No patch available
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
wp-smiley
≤1.4.1No patch available
- Medium6.1Open Redirect
Wow Moodboard Lite
≤1.1.1.1No patch available
- High8.8SQL Injection
Simple Retail Menus
≤4.0.1Update to 4.1
- Critical9.8SQL Injection
WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress
<1.2Update to 1.2
- Medium5.8Open Proxy
Gmedia Photo Gallery
<1.6.5Update to 1.6.5
- High8.8Multiple Cross-Site Request Forgery
WP Fastest Cache – WordPress Cache Plugin
<0.8.3.5Update to 0.8.3.5
- High8.8SQL Injection
GigPress
<2.3.9Update to 2.3.9
- High8.8Authenticated SQL Injection
WordPress Landing Pages
<1.8.5Update to 1.8.5
- Medium6.1Reflected Cross-Site Scripting
TFO Graphviz
≤1.9Update to 1.10
- High7.2Stored Cross-Site Scripting
Free counter
≤1.1Update to 1.2
- Medium6.5Cross-Site Scripting
WordPress Landing Pages
<1.8.5Update to 1.8.5
- Medium5.4Authenticated Cross-Site Scripting
NewStatPress
≤0.9.8Update to 0.9.9
- High8.8Authenticated SQL Injection
NewStatPress
≤0.9.8Update to 0.9.9
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.5.7Update to 5.5.7
- Medium6.1Stored Cross-Site Scripting
Church Admin
<0.810Update to 0.810
- Medium6.1Reflecte Cross-Site Scripting
woo-popup
≤1.2.2Update to 1.3.0
- High8.8Privilege Escalation
WP Membership
≤1.2.3No patch available
- High7.2Authenticated (Admin+) Remote Code Execution
Custom Content Type Manager
≤0.9.8.5Update to 0.9.8.6
- Medium5.4Cross-Site Scripting
WP Membership
≤1.2.3No patch available
- Medium6.1Cross-Site Scripting
Polls CP
<1.0.5Update to 1.0.5
- High7.1Cross-Site Scripting
WP Photo Album Plus
<6.1.3Update to 6.1.3
- Critical9.8SQL Injection
FeedWordPress
<2015.0514Update to 2015.0514
- High7.5Arbitrary File Download via Path Traversal
Simple Backup
<2.7.11Update to 2.7.11
- High8.8Cross-Site Request Forgery
Brute Force Login Protection
≤1.5.1No patch available
- High7.5Sensitive Information Disclosure
Blessing Premium Responsive WordPress Theme
<1.3.2.1Update to 1.3.2.1
- Medium6.5Arbitrary Shortcode Execution
Awesome Support – WordPress HelpDesk & Support Plugin
<3.1.7Update to 3.1.7
- High7.5Information Disclosure
Axioma Premium Responsive
<1.1.2Update to 1.1.2
- High7.5Sensitive Information Disclosure
Accio | Responsive Onepage Parallax Agency WordPress Theme
≤1.1.0Update to 1.1.1