Database
WordPress Vulnerability Database (page 1323)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.4 | Cross-Site Scripting via Attachment Name WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5834 | — | |
| Medium5.4 | Authorization Bypass to Remove Category Attribute WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5837 | — | |
| Medium5.3 | Password Change via Stolen Cookie WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5838 | — | |
| Medium6.4 | Cross-Site Scripting via Attachment Name #2 WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5833 | — | |
| Critical9.8 | SQL Injection | CVE-2016-10917 | — | |
| Critical9.6 | Remote Code Execution | CVE-2016-20010 | — | |
| Medium6.5 | News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting | CVE-2017-18634 | — | |
| Critical9.8 | News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update | CVE-2016-10972 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2016-15043 | — | |
| Critical9.8 | SQL Injection | CVE-2016-15040 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2016-4812 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2017-9337 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10973 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10974 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10975 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2016-10885 | — | |
| High8.1 | 2.9.42 - PHP Object Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder2.9.36 – 2.9.42Update to 2.9.42.1 | CVE-2016-1209 | — | |
| Critical9.8 | SQL Injection | CVE-2016-11018 | — | |
| Medium6.5 | Directory Traversal | CVE-2016-10977 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10893 | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2015-10128 | — | |
| Medium6.4 | Cross-Site Scripting via MediaElement.js WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2 | CVE-2016-4567 | — | |
| Medium6.1 | Cross-Site Scripting via plupload.flash.swf WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2 | CVE-2016-4566 | — | |
| High7.2 | Cross-Site Scripting | CVE-2016-10976 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2016-10994 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2016-15041 | — | |
| High7.5 | Missing Authorization Checks | CVE-2016-10983 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2016-10897 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2016-10920 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2016-10995 | — |
- Medium6.4Cross-Site Scripting via Attachment Name
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.4Authorization Bypass to Remove Category Attribute
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.3Password Change via Stolen Cookie
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium6.4Cross-Site Scripting via Attachment Name #2
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Critical9.8SQL Injection
Search Everything
<8.1.6Update to 8.1.6
- Critical9.6Remote Code Execution
EWWW Image Optimizer
≤2.8.4Update to 2.8.5
- Medium6.5News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting
Newspaper - News & WooCommerce WordPress Theme
<6.7.2Update to 6.7.2
- Critical9.8News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update
Newspaper - News & WooCommerce WordPress Theme
≤6.7.1Update to 6.7.2
- Critical9.8Arbitrary File Upload
WP Mobile Detector
≤3.5Update to 3.6
- Critical9.8SQL Injection
Kento Post View Counter
≤2.8No patch available
- Medium6.1Stored Cross-Site Scripting
Markdown on Save Improved
≤2.5Update to 2.5.1
- Medium6.1Stored Cross-Site Scripting
Markdown on Save Improved
≤2.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Brafton
<3.4.8Update to 3.4.8
- High8.8Cross-Site Request Forgery
Fluid Responsive Slideshow
<2.2.7Update to 2.2.7
- Medium6.1Reflected Cross-Site Scripting
Fluid Responsive Slideshow
<2.2.7Update to 2.2.7
- High8.8Cross-Site Request Forgery
WP Editor
<1.2.6Update to 1.2.6
- High8.12.9.42 - PHP Object Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
2.9.36 – 2.9.42Update to 2.9.42.1
- Critical9.8SQL Injection
Image Gallery - Responsive Photo Gallery
≤1.8.9Update to 1.9.0
- Medium6.5Directory Traversal
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
≤4.4.4Update to 4.5.0
- Medium6.1Cross-Site Scripting
Crayon Syntax Highlighter
<2.8.4Update to 2.8.4
- Medium6.4Authenticated Stored Cross-Site Scripting
Royal PrettyPhoto
≤1.2Update to 1.3
- Medium6.4Cross-Site Scripting via MediaElement.js
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
- Medium6.1Cross-Site Scripting via plupload.flash.swf
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
- High7.2Cross-Site Scripting
Safe Editor
<1.2Update to 1.2
- Medium6.1Reflected Cross-Site Scripting
Truemag
all versionsNo patch available
- High7.2Stored Cross-Site Scripting
MainWP Dashboard: Self-hosted WordPress Management for Agencies
<3.1.3Update to 3.1.3
- High7.5Missing Authorization Checks
Ghost
≤0.5.5Update to 0.5.6
- Medium6.1Multiple Cross-Site Scripting
Sermon Browser
≤0.45.15Update to 0.45.16
- Medium6.1Cross-Site Scripting
GNUCommerce
<0.5.7-betaUpdate to 0.5.7-beta
- Critical9.8Arbitrary File Upload
Tevolution
<2.3.0Update to 2.3.0