Database
WordPress Vulnerability Database (page 1387)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | Password Change via Stolen Cookie WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5838 | — | |
| Medium5.4 | Authorization Bypass to Remove Category Attribute WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5837 | — | |
| Medium6.4 | Cross-Site Scripting via Attachment Name #2 WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5833 | — | |
| Medium5.3 | Denial of Service via oEmbed Protocol WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5836 | — | |
| Medium4.3 | Revision History Disclosure WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5835 | — | |
| Medium5.5 | Cross-Site Scripting via Customizer WordPress≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3 | CVE-2016-5832 | — | |
| Medium4.3 | Missing Authorization to Plugin Settings Update | — | — | |
| Medium5.3 | Authorization Bypass | — | — | |
| Medium4.7 | Cross-Site Scripting | — | — | |
| Critical9.8 | Authentication Bypass | — | — | |
| High8.8 | Cross-Site Request Forgery to Arbitrary File Upload | — | — | |
| Critical9.8 | SQL Injection | CVE-2016-10917 | — | |
| High8.8 | Cross-Site Request Forgery to Stored Cross-Site Scripting | — | — | |
| Critical9.6 | Remote Code Execution | CVE-2016-20010 | — | |
| Critical9.8 | Arbitrary File upload | — | — | |
| Medium6.4 | Cross-Site Scripting | — | — | |
| Critical9.8 | Authentication Bypass | — | — | |
| Critical9.8 | News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update | CVE-2016-10972 | — | |
| High8.8 | SQL Injection | — | — | |
| Medium6.5 | News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting | CVE-2017-18634 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2016-15043 | — | |
| High8.5 | PHP Object Injection | — | — | |
| High7.5 | Sensitive Data Exposure | — | — | |
| Medium6.1 | wpDiscuz <= 3.1.4 - Reflected Cross-Site Scripting | — | — | |
| Medium6.4 | Video Gallery and YouTube Gallery <= 1.7.01 - Stored Cross-Site Scripting | — | — | |
| Medium6.4 | Stored Cross-Site scripting | — | — | |
| Critical9.8 | SQL Injection | CVE-2016-15040 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2017-9337 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2016-4812 | — | |
| High8.8 | Local File Inclusion | — | — |
- Medium5.3Password Change via Stolen Cookie
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.4Authorization Bypass to Remove Category Attribute
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium6.4Cross-Site Scripting via Attachment Name #2
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.3Denial of Service via oEmbed Protocol
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium4.3Revision History Disclosure
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium5.5Cross-Site Scripting via Customizer
WordPress
≤4.5.2Update to 3.7.15 or 3.8.15 or 3.9.13 or 4.0.12 or 4.1.12 or 4.2.9 or 4.3.5 or 4.4.4 or 4.5.3
- Medium4.3Missing Authorization to Plugin Settings Update
Ultimate Product Catalog
<3.8.2Update to 3.8.2
- Medium5.3Authorization Bypass
contus-video-comments
≤1.0No patch available
- Medium4.7Cross-Site Scripting
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤3.2.5Update to 3.3.0
- Critical9.8Authentication Bypass
WP Support Plus Responsive Ticket System
<8.0.0Update to 8.0.0
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
WP Remote Upload
≤1.2.1Update to 1.2.2
- Critical9.8SQL Injection
Search Everything
<8.1.6Update to 8.1.6
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
CM Ad Changer – A simple tool to control and optimize your site’s banners
≤1.7.7Update to 1.7.8
- Critical9.6Remote Code Execution
EWWW Image Optimizer
≤2.8.4Update to 2.8.5
- Critical9.8Arbitrary File upload
Blaze Slideshow
≤2.7No patch available
- Medium6.4Cross-Site Scripting
Levo Slideshow
≤2.3No patch available
- Critical9.8Authentication Bypass
OneLogin SAML SSO
<2.1.6Update to 2.1.6
- Critical9.8News & WooCommerce WordPress Theme <= 6.7 - Arbitrary Options Update
Newspaper - News & WooCommerce WordPress Theme
≤6.7.1Update to 6.7.2
- High8.8SQL Injection
Double Opt-In for Download
<2.1.0Update to 2.1.0
- Medium6.5News & WooCommerce WordPress Theme < 6.7.2 - Cross-Site Scripting
Newspaper - News & WooCommerce WordPress Theme
<6.7.2Update to 6.7.2
- Critical9.8Arbitrary File Upload
WP Mobile Detector
≤3.5Update to 3.6
- High8.5PHP Object Injection
CMS Commander – Manage Multiple Sites
<2.22Update to 2.22
- High7.5Sensitive Data Exposure
Stream – Activity Log & Audit Trail
≤3.0.5Update to 3.0.6
- Medium6.1wpDiscuz <= 3.1.4 - Reflected Cross-Site Scripting
Comments – wpDiscuz
≤3.1.4Update to 3.2.0
- Medium6.4Video Gallery and YouTube Gallery <= 1.7.01 - Stored Cross-Site Scripting
Gallery - Video Gallery and YouTube Gallery
<1.7.01Update to 1.7.02
- Medium6.4Stored Cross-Site scripting
Crowdsignal Dashboard – Polls, Surveys & more
≤2.0.31Update to 2.0.32
- Critical9.8SQL Injection
Kento Post View Counter
≤2.8No patch available
- Medium6.1Stored Cross-Site Scripting
Markdown on Save Improved
≤2.5No patch available
- Medium6.1Stored Cross-Site Scripting
Markdown on Save Improved
≤2.5Update to 2.5.1
- High8.8Local File Inclusion
WP Fastest Cache – WordPress Cache Plugin
≤0.8.5.7Update to 0.8.5.8