Database
WordPress Vulnerability Database (page 1333)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | Cross-Site Request Forgery | CVE-2015-9233 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-1000000 | — | |
| High7.2 | SQL Injection | CVE-2015-9234 | — | |
| Medium6.5 | Arbitrary File Write | CVE-2015-9456 | — | |
| High7.5 | Directory Traversal | CVE-2015-5472 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-5481 | — | |
| Medium5.3 | Directory Traversal | CVE-2015-5471 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9459 | — | |
| High7.2 | SQL Injection | CVE-2015-9457 | — | |
| High7.2 | SQL Injection | CVE-2015-9458 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9313 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2015-9312 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-9460 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2015-3299 | — | |
| High7.2 | Blind SQL Injection | CVE-2015-9462 | — | |
| High7.5 | Arbitrary File Download | CVE-2015-9463 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-5528 | — | |
| High7.2 | Blind SQL Injection | CVE-2015-9461 | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2015-9479 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2015-9465 | — | |
| High7.5 | Directory Traversal | CVE-2015-5468 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9466 | — | |
| High7.5 | Directory Traversal to Arbitrary File Access | CVE-2015-9464 | — | |
| Medium6.1 | Open Redirect | CVE-2015-5461 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2015-9468 | — | |
| Critical9.8 | SQL Injection | CVE-2015-9467 | — | |
| High7.5 | Directory Traversal | CVE-2015-5469 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-9340 | — | |
| Critical9.1 | Path Traversal | CVE-2015-5609 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2015-5681 | — |
- High8.8Cross-Site Request Forgery
CP Contact Form with PayPal
<1.1.6Update to 1.1.6
- Critical9.8Arbitrary File Upload
MailCWP
≤1.100Update to 1.110
- High7.2SQL Injection
CP Contact Form with PayPal
<1.1.6Update to 1.1.6
- Medium6.5Arbitrary File Write
Child Theme Creator by Orbisius
<1.2.8Update to 1.2.8
- High7.5Directory Traversal
IBS Mappro
≤0.6Update to 1.0
- Medium6.1Reflected Cross-Site Scripting
forumAttachments for bbPress
<2.3Update to 2.3
- Medium5.3Directory Traversal
Swim Team
≤1.44.1077Update to 1.45.1085
- Medium6.1Reflected Cross-Site Scripting
SEO SearchTerms Tagging 2
≤1.535No patch available
- High7.2SQL Injection
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<1.6.8Update to 1.6.8
- High7.2SQL Injection
SEO SearchTerms Tagging 2
≤1.535No patch available
- Critical9.8SQL Injection
NewStatPress
<1.0.6Update to 1.0.6
- Medium6.1Reflected Cross-Site Scripting
NewStatPress
<1.0.6Update to 1.0.6
- High8.8Authenticated SQL Injection
Pinpoint Booking System – Legacy version
<2.1Update to 2.1
- Medium6.1Unauthenticated Cross-Site Scripting
Floating Social Bar
≤1.1.6Update to 1.1.7
- High7.2Blind SQL Injection
Awesome Filterable Portfolio
<1.9Update to 1.9
- High7.5Arbitrary File Download
S3Bubble Cloud Video with Adverts and Analytics
<4.8Update to 4.8
- Medium6.1Cross-Site Scripting
Floating Social Bar
<1.1.7Update to 1.1.7
- High7.2Blind SQL Injection
Awesome Filterable Portfolio
<1.9Update to 1.9
- Critical9.8Unauthenticated Arbitrary File Upload
acf-frontend-display
≤2.0.6No patch available
- High8.8Authenticated SQL Injection
YASR – Yet Another Star Rating Plugin for WordPress
<0.9.1Update to 0.9.1
- High7.5Directory Traversal
WP eCommerce Shop Styling
<2.6Update to 2.6
- Critical9.8SQL Injection
WTI Like Post
<1.4.3Update to 1.4.3
- High7.5Directory Traversal to Arbitrary File Access
S3 Bubble Amazon S3 HTML5 Video with Adverts
≤0.7Update to 0.8
- Medium6.1Open Redirect
StageShow
<5.0.9Update to 5.0.9
- Medium6.1Cross-Site Scripting
Broken Link Manager
≤0.4.5Update to 0.5.0
- Critical9.8SQL Injection
Broken Link Manager
<0.5.0Update to 0.5.0
- High7.5Directory Traversal
MDC YouTube Downloader
<2.1.1Update to 2.1.1
- Critical9.8Arbitrary File Upload
Iptanus File Upload
<3.0.0Update to 3.0.0
- Critical9.1Path Traversal
Image Export
≤1.1Update to 1.1.1
- Critical9.8Arbitrary File Upload
Powerplay Gallery
≤3.3No patch available