Database

WordPress Vulnerability Database (page 1388)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

WordPress Vulnerability Database (page 1388)
Severity	Vulnerability	CVE	Installs	Published
Medium6.5	Sensitive Information Disclosure Caldera Forms – More Than Contact Forms<1.4.0Update to 1.4.0	—	—	May 24, 2016
Medium4.9	Missing Authorization WP Fastest Cache – WordPress Cache Plugin≤0.8.5.7Update to 0.8.5.8	—	—	May 23, 2016
Medium6.1	Reflected Cross-Site Scripting Brafton<3.4.8Update to 3.4.8	CVE-2016-10973	—	May 20, 2016
High8.8	Responsive Photo Gallery <= 1.9.57 - Cross-Site Request Forgery Image Gallery - Responsive Photo Gallery≤1.9.57Update to 1.9.58	—	—	May 19, 2016
Medium6.1	Reflected Cross-Site Scripting Fluid Responsive Slideshow<2.2.7Update to 2.2.7	CVE-2016-10975	—	May 18, 2016
High8.8	Cross-Site Request Forgery Fluid Responsive Slideshow<2.2.7Update to 2.2.7	CVE-2016-10974	—	May 18, 2016
High8.8	Cross-Site Request Forgery Fluid Responsive Slideshow<2.2.7Update to 2.2.7	—	—	May 18, 2016
Critical9.8	SQL Injection WP-EMail<2.67.2Update to 2.67.2	—	—	May 14, 2016
High8.8	Cross-Site Request Forgery WP Editor<1.2.6Update to 1.2.6	CVE-2016-10885	—	May 13, 2016
High8.1	2.9.42 - PHP Object Injection Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder2.9.36 – 2.9.42Update to 2.9.42.1	CVE-2016-1209	—	May 13, 2016
Medium6.4	Authenticated Cross-Site Scripting BulletProof Security<.53.4Update to .53.4	—	—	May 11, 2016
High7.2	Cross-Site Scripting Anti-Malware Security and Brute-Force Firewall≤4.15.17Update to 4.16.18	—	—	May 10, 2016
Medium6.1	Cross-Site Scripting Crayon Syntax Highlighter<2.8.4Update to 2.8.4	CVE-2016-10893	—	May 10, 2016
Critical9.8	SQL Injection Image Gallery - Responsive Photo Gallery≤1.8.9Update to 1.9.0	CVE-2016-11018	—	May 10, 2016
Medium6.1	6.1.6 - Reflected Cross-Site Scripting Wordfence Security – Firewall, Malware Scan, and Login Security6.1.1 – 6.1.6Update to 6.1.7	—	—	May 10, 2016
Medium6.5	Directory Traversal Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization≤4.4.4Update to 4.5.0	CVE-2016-10977	—	May 10, 2016
High7.2	Unauthenticated Stored Cross-Site Scripting Event Registration≤6.02.02Update to 6.03.01	—	—	May 9, 2016
Critical9.8	SQL Injection Event Registration≤6.02.02Update to 6.03.01	—	—	May 9, 2016
Critical9.8	PHP Object Injection Event Registration≤6.02.02Update to 6.03.01	—	—	May 9, 2016
Medium6.4	Authenticated Stored Cross-Site Scripting Royal PrettyPhoto≤1.2Update to 1.3	CVE-2015-10128	—	May 9, 2016
Medium5.3	Sensitive Data Exposure Yoast SEO – Advanced SEO with real-time guidance and built-in AI≤3.2.4Update to 3.2.5	—	—	May 6, 2016
High7.2	Cross-Site Scripting Safe Editor<1.2Update to 1.2	CVE-2016-10976	—	May 6, 2016
Medium6.4	Cross-Site Scripting via MediaElement.js WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2	CVE-2016-4567	—	May 6, 2016
Medium6.1	Cross-Site Scripting via plupload.flash.swf WordPress≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2	CVE-2016-4566	—	May 6, 2016
Critical9.8	2.9.42 - Unauthenticated Arbitrary File Upload Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder2.9.36 – 2.9.42Update to 2.9.42.1	—	—	May 5, 2016
High7.2	Stored Cross-Site Scripting bbPress<2.5.9Update to 2.5.9	—	—	May 3, 2016
High7.2	Stored Cross-Site Scripting MainWP Dashboard: Self-hosted WordPress Management for Agencies<3.1.3Update to 3.1.3	CVE-2016-15041	—	Apr 29, 2016
Medium6.1	Reflected Cross-Site Scripting Truemagall versionsNo patch available	CVE-2016-10994	—	Apr 29, 2016
High7.2	Stored Cross-Site Scripting Simple Photo Gallery<1.8.1Update to 1.8.1	—	—	Apr 28, 2016
Medium6.5	Improper Authentication Google Authenticator≤0.47Update to 0.48	—	—	Apr 28, 2016

Medium6.5
Sensitive Information Disclosure
Caldera Forms – More Than Contact Forms
<1.4.0Update to 1.4.0
377b8532-61b8-45be-ad7c-c9ff60a7100aMay 24, 2016
Medium4.9
Missing Authorization
WP Fastest Cache – WordPress Cache Plugin
≤0.8.5.7Update to 0.8.5.8
fcbd718b-4d7d-48a4-9db2-dd938de7c7ebMay 23, 2016
Medium6.1
Reflected Cross-Site Scripting
Brafton
<3.4.8Update to 3.4.8
CVE-2016-10973May 20, 2016
High8.8
Responsive Photo Gallery <= 1.9.57 - Cross-Site Request Forgery
Image Gallery - Responsive Photo Gallery
≤1.9.57Update to 1.9.58
7456ce70-dfa1-46b4-af9e-8185c4f7e5f8May 19, 2016
Medium6.1
Reflected Cross-Site Scripting
Fluid Responsive Slideshow
<2.2.7Update to 2.2.7
CVE-2016-10975May 18, 2016
High8.8
Cross-Site Request Forgery
Fluid Responsive Slideshow
<2.2.7Update to 2.2.7
CVE-2016-10974May 18, 2016
High8.8
Cross-Site Request Forgery
Fluid Responsive Slideshow
<2.2.7Update to 2.2.7
cc910c27-d83c-4f3d-b491-f3e169d8f25fMay 18, 2016
Critical9.8
SQL Injection
WP-EMail
<2.67.2Update to 2.67.2
af90aef0-fd96-43ff-8400-09bd5cebed28May 14, 2016
High8.8
Cross-Site Request Forgery
WP Editor
<1.2.6Update to 1.2.6
CVE-2016-10885May 13, 2016
High8.1
2.9.42 - PHP Object Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
2.9.36 – 2.9.42Update to 2.9.42.1
CVE-2016-1209May 13, 2016
Medium6.4
Authenticated Cross-Site Scripting
BulletProof Security
<.53.4Update to .53.4
f232f550-f964-4a69-9a80-aa9768149094May 11, 2016
High7.2
Cross-Site Scripting
Anti-Malware Security and Brute-Force Firewall
≤4.15.17Update to 4.16.18
d76229c9-39e6-48ab-b038-be40b36aa7bdMay 10, 2016
Medium6.1
Cross-Site Scripting
Crayon Syntax Highlighter
<2.8.4Update to 2.8.4
CVE-2016-10893May 10, 2016
Critical9.8
SQL Injection
Image Gallery - Responsive Photo Gallery
≤1.8.9Update to 1.9.0
CVE-2016-11018May 10, 2016
Medium6.1
6.1.6 - Reflected Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
6.1.1 – 6.1.6Update to 6.1.7
809d0632-39a7-44a7-b368-9dc58270c666May 10, 2016
Medium6.5
Directory Traversal
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
≤4.4.4Update to 4.5.0
CVE-2016-10977May 10, 2016
High7.2
Unauthenticated Stored Cross-Site Scripting
Event Registration
≤6.02.02Update to 6.03.01
adb87ef2-8741-4144-b414-56e82dd35c89May 9, 2016
Critical9.8
SQL Injection
Event Registration
≤6.02.02Update to 6.03.01
952e299a-5cec-444b-8359-3e7d8dec3ccbMay 9, 2016
Critical9.8
PHP Object Injection
Event Registration
≤6.02.02Update to 6.03.01
2c5bb593-59b5-4760-8d54-14d7665c7e7fMay 9, 2016
Medium6.4
Authenticated Stored Cross-Site Scripting
Royal PrettyPhoto
≤1.2Update to 1.3
CVE-2015-10128May 9, 2016
Medium5.3
Sensitive Data Exposure
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤3.2.4Update to 3.2.5
a7701dd2-8452-4529-a931-db2553ca1ae5May 6, 2016
High7.2
Cross-Site Scripting
Safe Editor
<1.2Update to 1.2
CVE-2016-10976May 6, 2016
Medium6.4
Cross-Site Scripting via MediaElement.js
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
CVE-2016-4567May 6, 2016
Medium6.1
Cross-Site Scripting via plupload.flash.swf
WordPress
≤4.5.1Update to 3.7.14 or 3.8.14 or 3.9.12 or 4.0.11 or 4.1.11 or 4.2.8 or 4.3.4 or 4.4.3 or 4.5.2
CVE-2016-4566May 6, 2016
Critical9.8
2.9.42 - Unauthenticated Arbitrary File Upload
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
2.9.36 – 2.9.42Update to 2.9.42.1
0f36a924-6a68-40ff-bf1a-9ebcad1c2fc6May 5, 2016
High7.2
Stored Cross-Site Scripting
bbPress
<2.5.9Update to 2.5.9
fcb76d10-fc60-4b19-9b47-1b98f8400a96May 3, 2016
High7.2
Stored Cross-Site Scripting
MainWP Dashboard: Self-hosted WordPress Management for Agencies
<3.1.3Update to 3.1.3
CVE-2016-15041Apr 29, 2016
Medium6.1
Reflected Cross-Site Scripting
Truemag
all versionsNo patch available
CVE-2016-10994Apr 29, 2016
High7.2
Stored Cross-Site Scripting
Simple Photo Gallery
<1.8.1Update to 1.8.1
306fa8e1-b62f-4514-8463-e696d043f6f5Apr 28, 2016
Medium6.5
Improper Authentication
Google Authenticator
≤0.47Update to 0.48
f3bbc23b-94af-4f4f-8b5f-6af41108fd93Apr 28, 2016