Database

WordPress Vulnerability Database (page 1327)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1327)
Severity	Vulnerability	CVE	Installs	Published
Medium4.3	Missing Authorization Checks Admin Management Xtended≤2.4.0Update to 2.4.0.1	CVE-2015-9390	—	Dec 14, 2015
Critical9.8	SQL Injection Smart External Link Click Monitor [Link Log]<2.1Update to 2.1	CVE-2015-9344	—	Dec 11, 2015
Medium6.1	Cross-Site Scripting YAWPP (Yet Another WordPress Petition Plugin)≤1.2.2No patch available	CVE-2015-9391	—	Dec 9, 2015
Medium6.4	Cross-Site Scripting Content text slider on post<6.9Update to 6.9	CVE-2015-20019	—	Dec 7, 2015
Medium5.4	Cross-Site Scripting via p_name parameter Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin<1.5.63Update to 1.5.63	CVE-2015-9392	—	Dec 2, 2015
High8.8	Cross-Site Request Forgery Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin<1.5.63Update to 1.5.63	CVE-2015-9394	—	Dec 2, 2015
Medium6.1	Reflected Cross-Site Scripting Role Scoper (Obsolete – Please install PublishPress Permissions)<1.3.67Update to 1.3.67	CVE-2015-8353	—	Dec 2, 2015
Medium6.1	Reflected Cross-Site Scripting Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin<1.3.29Update to 1.3.29	CVE-2015-8354	—	Dec 2, 2015
High8.8	Authenticated Command Injection Cool Video Gallery<2.0Update to 2.0	CVE-2015-7527	—	Dec 2, 2015
Medium6.1	Cross-Site Scripting Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin<1.5.63Update to 1.5.63	CVE-2015-9393	—	Dec 2, 2015
High8.8	Authenticated Blind SQL Injection Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin<1.5.64Update to 1.5.64	CVE-2015-9395	—	Dec 1, 2015
Critical9.8	SQL Injection Google Doc Embedder<2.5.17Update to 2.5.17	CVE-2014-9173	—	Nov 28, 2015
Medium6.1	Reflected Cross-Site Scripting Auto Thickbox Plus≤1.9No patch available	CVE-2015-9396	—	Nov 26, 2015
Medium6.1	Reflected Cross-Site Scripting Websimon Tables≤1.3.4No patch available	CVE-2015-9401	—	Nov 24, 2015
High7.2	Authenticated SQL Injection WP-Stats-Dashboard≤2.9.4No patch available	CVE-2015-9399	—	Nov 24, 2015
Critical9.8	SQL Injection Double Opt-In for Download<2.0.9Update to 2.0.9	CVE-2015-7517	—	Nov 24, 2015
High7.2	Authenticated (Admin+) SQL Injection Watu Quiz≤2.6.7Update to 2.6.8	CVE-2015-10111	—	Nov 20, 2015
High8.8	Arbitrary File Upload Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin<1.5.59Update to 1.5.59	CVE-2015-9402	—	Nov 17, 2015
Medium6.1	Reflected Cross-Site Scripting User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor<2.2.5Update to 2.2.5	CVE-2015-9328	—	Nov 11, 2015
Critical9.8	SQL Injection WP Fastest Cache – WordPress Cache Plugin<0.8.4.9Update to 0.8.4.9	CVE-2015-9316	—	Nov 11, 2015
High8.8	Cross-Site Request Forgery Tag Miner (Automatic Tag Extraction)<1.1.5Update to 1.1.5	CVE-2016-10978	—	Nov 10, 2015
Medium6.1	Cross-Site Scripting Tag Miner (Automatic Tag Extraction)<1.1.5Update to 1.1.5	CVE-2016-10979	—	Nov 10, 2015
Medium6.1	Reflected Cross-Site Scripting neuvoo-jobroll≤2.0No patch available	CVE-2015-9404	—	Nov 5, 2015
Medium6.1	Reflected Cross-Site Scripting neuvoo-jobroll≤2.0No patch available	CVE-2015-9403	—	Nov 5, 2015
Medium6.1	Cross-Site Scripting WordPress Calls to Action<2.5.1Update to 2.5.1	CVE-2015-8350	—	Nov 4, 2015
Critical9.0	Remote File Inclusion Gwolle Guestbook<1.5.4Update to 1.5.4	CVE-2015-8351	—	Nov 4, 2015
Critical9.8	Arbitrary File Upload Iptanus File Upload<3.4.1Update to 3.4.1	CVE-2015-9341	—	Oct 29, 2015
High8.8	Cross-Site Request Forgery to Stored Cross-Site Scripting Crony Cronjob Manager<0.4.7Update to 0.4.7	CVE-2017-14530	—	Oct 27, 2015
Critical9.8	SQL Injection Visitors Online by BestWebSoft≤0.3Update to 0.4	CVE-2015-9325	—	Oct 26, 2015
High8.8	SQL Injection wp-championship<5.9Update to 5.9	CVE-2015-5308	—	Oct 23, 2015

Medium4.3
Missing Authorization Checks
Admin Management Xtended
≤2.4.0Update to 2.4.0.1
CVE-2015-9390Dec 14, 2015
Critical9.8
SQL Injection
Smart External Link Click Monitor [Link Log]
<2.1Update to 2.1
CVE-2015-9344Dec 11, 2015
Medium6.1
Cross-Site Scripting
YAWPP (Yet Another WordPress Petition Plugin)
≤1.2.2No patch available
CVE-2015-9391Dec 9, 2015
Medium6.4
Cross-Site Scripting
Content text slider on post
<6.9Update to 6.9
CVE-2015-20019Dec 7, 2015
Medium5.4
Cross-Site Scripting via p_name parameter
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.63Update to 1.5.63
CVE-2015-9392Dec 2, 2015
High8.8
Cross-Site Request Forgery
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.63Update to 1.5.63
CVE-2015-9394Dec 2, 2015
Medium6.1
Reflected Cross-Site Scripting
Role Scoper (Obsolete – Please install PublishPress Permissions)
<1.3.67Update to 1.3.67
CVE-2015-8353Dec 2, 2015
Medium6.1
Reflected Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<1.3.29Update to 1.3.29
CVE-2015-8354Dec 2, 2015
High8.8
Authenticated Command Injection
Cool Video Gallery
<2.0Update to 2.0
CVE-2015-7527Dec 2, 2015
Medium6.1
Cross-Site Scripting
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.63Update to 1.5.63
CVE-2015-9393Dec 2, 2015
High8.8
Authenticated Blind SQL Injection
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.64Update to 1.5.64
CVE-2015-9395Dec 1, 2015
Critical9.8
SQL Injection
Google Doc Embedder
<2.5.17Update to 2.5.17
CVE-2014-9173Nov 28, 2015
Medium6.1
Reflected Cross-Site Scripting
Auto Thickbox Plus
≤1.9No patch available
CVE-2015-9396Nov 26, 2015
Medium6.1
Reflected Cross-Site Scripting
Websimon Tables
≤1.3.4No patch available
CVE-2015-9401Nov 24, 2015
High7.2
Authenticated SQL Injection
WP-Stats-Dashboard
≤2.9.4No patch available
CVE-2015-9399Nov 24, 2015
Critical9.8
SQL Injection
Double Opt-In for Download
<2.0.9Update to 2.0.9
CVE-2015-7517Nov 24, 2015
High7.2
Authenticated (Admin+) SQL Injection
Watu Quiz
≤2.6.7Update to 2.6.8
CVE-2015-10111Nov 20, 2015
High8.8
Arbitrary File Upload
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.59Update to 1.5.59
CVE-2015-9402Nov 17, 2015
Medium6.1
Reflected Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<2.2.5Update to 2.2.5
CVE-2015-9328Nov 11, 2015
Critical9.8
SQL Injection
WP Fastest Cache – WordPress Cache Plugin
<0.8.4.9Update to 0.8.4.9
CVE-2015-9316Nov 11, 2015
High8.8
Cross-Site Request Forgery
Tag Miner (Automatic Tag Extraction)
<1.1.5Update to 1.1.5
CVE-2016-10978Nov 10, 2015
Medium6.1
Cross-Site Scripting
Tag Miner (Automatic Tag Extraction)
<1.1.5Update to 1.1.5
CVE-2016-10979Nov 10, 2015
Medium6.1
Reflected Cross-Site Scripting
neuvoo-jobroll
≤2.0No patch available
CVE-2015-9404Nov 5, 2015
Medium6.1
Reflected Cross-Site Scripting
neuvoo-jobroll
≤2.0No patch available
CVE-2015-9403Nov 5, 2015
Medium6.1
Cross-Site Scripting
WordPress Calls to Action
<2.5.1Update to 2.5.1
CVE-2015-8350Nov 4, 2015
Critical9.0
Remote File Inclusion
Gwolle Guestbook
<1.5.4Update to 1.5.4
CVE-2015-8351Nov 4, 2015
Critical9.8
Arbitrary File Upload
Iptanus File Upload
<3.4.1Update to 3.4.1
CVE-2015-9341Oct 29, 2015
High8.8
Cross-Site Request Forgery to Stored Cross-Site Scripting
Crony Cronjob Manager
<0.4.7Update to 0.4.7
CVE-2017-14530Oct 27, 2015
Critical9.8
SQL Injection
Visitors Online by BestWebSoft
≤0.3Update to 0.4
CVE-2015-9325Oct 26, 2015
High8.8
SQL Injection
wp-championship
<5.9Update to 5.9
CVE-2015-5308Oct 23, 2015