Database
WordPress Vulnerability Database (page 1321)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.5 | Authenticated Directory Traversal to Arbitrary File Access WordPress≤4.6Update to 3.7.16 or 3.8.16 or 3.9.14 or 4.0.13 or 4.1.13 or 4.2.10 or 4.3.6 or 4.4.5 or 4.5.4 or 4.6.1 | CVE-2016-7169 | — | |
| Medium4.8 | Authenticated Stored Cross-Site Scripting WordPress≤4.6Update to 3.7.16 or 3.8.16 or 3.9.14 or 4.0.13 or 4.1.13 or 4.2.10 or 4.3.6 or 4.4.5 or 4.5.4 or 4.6.1 | CVE-2016-7168 | — | |
| High8.8 | Cross-Site Request Forgery CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation<1.7.9Update to 1.7.9 | CVE-2016-10915 | 9K+ | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-1000139 | — | |
| Critical9.8 | Arbitrary File Upload/Read | CVE-2016-10955 | — | |
| Critical9.8 | Local File Inclusion | CVE-2016-10956 | — | |
| Medium6.5 | Denial of Service | CVE-2016-6896 | — | |
| Medium6.1 | Multipurpose WordPress Theme (All Versions) - Reflected Cross-Site Scripting | CVE-2016-10957 | — | |
| Medium5.5 | Cross-Site Scripting | CVE-2016-10763 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-6897 | — | |
| Medium4.3 | Authorization Bypass | CVE-2016-10148 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10918 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10925 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10914 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10874 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10910 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10890 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10891 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10873 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting | CVE-2021-24153 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10900 | — | |
| High8.8 | Remote Code Execution | CVE-2016-10960 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10875 | — | |
| High8.8 | Cross-Site Request Forgery to Arbitrary File Upload | CVE-2016-10959 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2016-10958 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2016-10879 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10936 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10878 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10898 | — | |
| Medium5.3 | Unauthenticated Settings Change | CVE-2016-10899 | — |
- Medium6.5Authenticated Directory Traversal to Arbitrary File Access
WordPress
≤4.6Update to 3.7.16 or 3.8.16 or 3.9.14 or 4.0.13 or 4.1.13 or 4.2.10 or 4.3.6 or 4.4.5 or 4.5.4 or 4.6.1
- Medium4.8Authenticated Stored Cross-Site Scripting
WordPress
≤4.6Update to 3.7.16 or 3.8.16 or 3.9.14 or 4.0.13 or 4.1.13 or 4.2.10 or 4.3.6 or 4.4.5 or 4.5.4 or 4.6.1
- High8.8Cross-Site Request Forgery
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
<1.7.9Update to 1.7.9
- Medium6.1Reflected Cross-Site Scripting
Infusionsoft Gravity Forms Add-on
<1.5.12Update to 1.5.12
- Critical9.8Arbitrary File Upload/Read
CYSTEME Finder, the admin files explorer
<1.4Update to 1.4
- Critical9.8Local File Inclusion
Mail Masta
≤1.0No patch available
- Medium6.5Denial of Service
WordPress
<4.6Update to 4.6
- Medium6.1Multipurpose WordPress Theme (All Versions) - Reflected Cross-Site Scripting
Akal - Multipurpose WordPress Theme
all versionsNo patch available
- Medium5.5Cross-Site Scripting
CampTix Event Ticketing
<1.5Update to 1.5
- High8.8Cross-Site Request Forgery
WordPress
<4.6Update to 4.6
- Medium4.3Authorization Bypass
WordPress
<4.6Update to 4.6
- High8.8Cross-Site Request Forgery
Photo Gallery by Supsystic – Image Gallery, Masonry, Albums & Lightbox
<1.8.6Update to 1.8.6
- Medium6.1Cross-Site Scripting
LoginWP (Formerly Peter's Login Redirect)
<2.9.1Update to 2.9.1
- High8.8Cross-Site Request Forgery
Add From Server
<3.3.2Update to 3.3.2
- High8.8Cross-Site Request Forgery
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
<4.3.3Update to 4.3.3
- Medium6.1Reflected Cross-Site Scripting
FormBuilder
≤1.05Update to 1.06
- Medium6.1Reflected Cross-Site Scripting
Activity Log – Monitor User and Agent Changes
<2.3.2Update to 2.3.3
- Medium6.1Cross-Site Scripting
Activity Log – Monitor User and Agent Changes
<2.3.3Update to 2.3.3
- Medium6.1Cross-Site Scripting
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
<4.3.3Update to 4.3.3
- Medium5.4Authenticated Stored Cross-Site Scripting
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
<3.4.1Update to 3.4.1
- Medium6.1Cross-Site Scripting
Uji Countdown
≤2.0.6Update to 2.0.7
- High8.8Remote Code Execution
wsecure lite
<2.4Update to 2.4
- Medium6.1Cross-Site Scripting
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
<4.3.1Update to 4.3.1
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Estatik Real Estate Plugin
≤2.3.0Update to 2.3.1
- Critical9.8Unauthenticated Arbitrary File Upload
Estatik Real Estate Plugin
≤2.3.0Update to 2.3.1
- Medium6.1Unauthenticated Stored Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤6.2.03Update to 6.2.04
- Medium6.1Cross-Site Scripting
WP-Polls
≤2.73Update to 2.73.1
- Medium6.1Cross-Site Scripting
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<3.1.2Update to 3.1.2
- Medium6.1Cross-Site Scripting
Total Security
<3.4.1Update to 3.4.1
- Medium5.3Unauthenticated Settings Change
Total Security
≤3.4.0Update to 3.4.1