Database
WordPress Vulnerability Database (page 1322)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2017-5942 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-4833 | — | |
| High8.8 | Cross-Site Request Forgery Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress<1.9.19Update to 1.9.19 | CVE-2016-10962 | — | |
| Medium6.1 | Cross-Site Scripting Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress<1.9.19Update to 1.9.19 | CVE-2016-10963 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10964 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2016-15042 | — | |
| Medium5.8 | CSV Injection | CVE-2016-10762 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10911 | — | |
| Critical9.8 | SQL Injection | CVE-2016-10921 | — | |
| Medium5.4 | Missing Authorization | CVE-2018-20155 | — | |
| Medium4.3 | Authenticated Information Disclosure | CVE-2018-20154 | — | |
| Critical9.1 | Directory Traversal | CVE-2016-10965 | — | |
| High7.5 | File Upload to User Controlled Location | CVE-2016-10966 | — | |
| High7.5 | Arbitrary File Upload | CVE-2016-10929 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10967 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10961 | — | |
| Critical9.8 | Authentication Bypass | CVE-2016-10971 | — | |
| Medium6.1 | Cross-Site Scripting via a ticket excerpt. | CVE-2016-10970 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-4827 | — | |
| Critical9.8 | Authentication Bypass | CVE-2016-4828 | — | |
| High8.1 | Object Injection | CVE-2016-4825 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-4826 | — | |
| Critical9.8 | Remote File Upload | CVE-2016-1000112 | — | |
| High8.8 | Privilege Escalation | CVE-2016-10968 | — | |
| High7.2 | Stored Cross-Site Scripting via discussion ticket title | CVE-2016-10969 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10705 | — | |
| Medium4.3 | Revision History Disclosure WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5835 | — | |
| Medium5.5 | Cross-Site Scripting via Customizer WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5832 | — | |
| Medium5.3 | Denial of Service via oEmbed Protocol WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5836 | — | |
| High7.3 | Bypass sanitize_file_name Protection WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5839 | — |
- Medium6.1Reflected Cross-Site Scripting
WP Mail
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
Nofollow Links
≤1.0.10Update to 1.0.11
- High8.8Cross-Site Request Forgery
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
<1.9.19Update to 1.9.19
- Medium6.1Cross-Site Scripting
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
<1.9.19Update to 1.9.19
- Medium6.1Cross-Site Scripting
dwnldr
≤1.0Update to 1.01
- Critical9.8Arbitrary File Upload
Frontend File Manager Plugin
<4.0Update to 4.0
- Medium5.8CSV Injection
CampTix Event Ticketing
<1.5Update to 1.5
- Medium6.1Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<2.4.2Update to 2.4.2
- Critical9.8SQL Injection
Photo Gallery by Ays – Responsive Image Gallery
<1.0.1Update to 1.0.1
- Medium5.4Missing Authorization
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Medium4.3Authenticated Information Disclosure
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
<2.0.7Update to 2.0.7
- Critical9.1Directory Traversal
Real3D Flipbook
≤1.0.0No patch available
- High7.5File Upload to User Controlled Location
Real3D Flipbook
≤1.0.0No patch available
- High7.5Arbitrary File Upload
Advanced AJAX Page Loader
<2.7.7Update to 2.7.7
- Medium6.1Reflected Cross-Site Scripting
Real3D Flipbook
≤1.0.0No patch available
- Medium6.1Cross-Site Scripting
ColorWay
≤3.4.1Update to 3.4.2
- Critical9.8Authentication Bypass
MemberSonic Lite Membership Site Plugin
≤1.2Update to 1.302
- Medium6.1Cross-Site Scripting via a ticket excerpt.
SupportFlow
<0.7Update to 0.7
- Medium6.1Cross-Site Scripting
Welcart e-Commerce
≤1.8.2Update to 1.8.3
- Critical9.8Authentication Bypass
Welcart e-Commerce
≤1.8.2Update to 1.8.3
- High8.1Object Injection
Welcart e-Commerce
<1.8.3Update to 1.8.3
- Medium6.1Reflected Cross-Site Scripting
Welcart e-Commerce
<1.8.3Update to 1.8.3
- Critical9.8Remote File Upload
contus-video-comments
≤1.0No patch available
- High8.8Privilege Escalation
Community by PeepSo – Download from PeepSo.com
≤1.6.0Update to 1.6.1
- High7.2Stored Cross-Site Scripting via discussion ticket title
SupportFlow
≤0.6Update to 0.7
- Medium6.1Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<4.0.4Update to 4.0.4
- Medium4.3Revision History Disclosure
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.5Cross-Site Scripting via Customizer
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.3Denial of Service via oEmbed Protocol
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- High7.3Bypass sanitize_file_name Protection
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3