Database
WordPress Vulnerability Database (page 1319)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium4.3 | Path Disclosure WordPress≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2 | CVE-2017-6514 | — | |
| Critical9.9 | Local File Inclusion | CVE-2017-20289 | — | |
| High7.2 | Server-Side Request Forgery | CVE-2016-10927 | — | |
| Medium5.4 | Missing Authorization & Cross-Site Request Forgery | CVE-2016-10938 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2016-10943 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2016-10939 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2016-10940 | — | |
| High8.8 | Cross-Site Request Forgery to Stored Cross-Site Scripting | CVE-2016-11085 | — | |
| High8.8 | SQL Injection | CVE-2016-10942 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10871 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2016-15033 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10736 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10944 | — | |
| High8.3 | Server Side Request Forgery | CVE-2016-10926 | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting | CVE-2016-10112 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2017-2243 | — | |
| Medium5.3 | Local File Inclusion | CVE-2016-20064 | — | |
| Critical9.8 | SQL Injection | CVE-2016-20065 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-1000013 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10945 | — | |
| Critical9.8 | SQL Injection | CVE-2016-10904 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-1000033 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10946 | — | |
| High8.8 | SQL Injection | CVE-2016-10949 | — | |
| High7.2 | Authenticated (Super Admin+) SQL Injection | CVE-2016-10947 | — | |
| Critical9.8 | SQL Injection | CVE-2016-20072 | — | |
| High8.1 | PHP Object Injection | CVE-2016-10948 | — | |
| Critical9.8 | Authenticated Local File Inclusion & SQL injection | CVE-2016-10889 | 300K+ | |
| High7.5 | Remote File Inclusion | CVE-2016-6565 | 300K+ | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10934 | — |
- Medium4.3Path Disclosure
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- Critical9.9Local File Inclusion
Ad Widget for WordPress
<2.12.0Update to 2.12.0
- High7.2Server-Side Request Forgery
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
<4.5.11Update to 4.5.11
- Medium5.4Missing Authorization & Cross-Site Request Forgery
copy-me
≤1.0.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
ZX_CSV Upload
≤1No patch available
- High7.2Authenticated (Admin+) SQL Injection
Xtreme Locator
≤3.0.1No patch available
- High7.2Authenticated (Admin+) SQL Injection
ZM Gallery
≤1.0No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
<4.7.9Update to 4.7.9
- High8.8SQL Injection
Podlove Podcast Publisher
<2.3.16Update to 2.3.16
- Medium6.1Reflected Cross-Site Scripting
MC4WP: Mailchimp for WordPress
<4.0.11Update to 4.0.11
- Critical9.8Arbitrary File Upload
Delete All Comments
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Hubbub Lite – Fast, free social sharing and follow buttons
≤1.2.5Update to 1.2.6
- High8.8Cross-Site Request Forgery
Multisite Post Duplicator
≤1.7.6No patch available
- High8.3Server Side Request Forgery
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
≤4.5.8Update to 4.5.9
- Medium5.5Authenticated Stored Cross-Site Scripting
WooCommerce
<2.6.9Update to 2.6.9
- Medium6.1Cross-Site Scripting
Responsive Lightbox & Gallery
≤1.7.1Update to 1.7.2
- Medium5.3Local File Inclusion
WP Vault
≤0.8.6.6No patch available
- Critical9.8SQL Injection
product-catalog-8
≤1.2.0No patch available
- Critical9.8Arbitrary File Upload
Csv2WPeC Coupon
≤1.1No patch available
- High8.8Cross-Site Request Forgery
Platform
≤1.1.4No patch available
- Critical9.8SQL Injection
Olimometer
<2.57Update to 2.57
- Medium6.1Reflected Cross-Site Scripting
Vospari Forms
<1.4Update to 1.4
- High8.8Cross-Site Request Forgery
Wp-D3
<2.4.1Update to 2.4.1
- High8.8SQL Injection
Relevanssi Premium
<1.14.6.1Update to 1.14.6.1
- High7.2Authenticated (Super Admin+) SQL Injection
Post Indexer
<3.0.6.2Update to 3.0.6.2
- Critical9.8SQL Injection
BBS e-Franchise
<1.1.4Update to 1.1.4
- High8.1PHP Object Injection
Post Indexer
<3.0.6.2Update to 3.0.6.2
- Critical9.8Authenticated Local File Inclusion & SQL injection
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.56Update to 2.1.57
- High7.5Remote File Inclusion
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.56Update to 2.1.57
- Medium6.1Reflected Cross-Site Scripting
Check & Log Email – Easy Email Testing & Mail logging
<0.5.2Update to 0.5.2