VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1391)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,153 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1391)
SeverityVulnerabilityCVEInstallsPublished
High7.2Reflected Cross-Site Scripting
DZS Video Gallery≤8.60No patch available
——
Critical9.8Unauthenticated Arbitrary File Upload
360 Product Rotation≤1.2.0Update to 1.2.2
——
Critical9.8Arbitrary File Upload
SP Project & Document Manager≤2.6.1.3Update to 2.6.1.4
——
Medium6.1Cross-Site Scripting
SP Project & Document Manager≤2.6.0.0Update to 2.6.1.4
——
Medium6.1Cross-Site Scripting
Ocim MP3all versionsNo patch available
CVE-2016-10998—
Critical9.8SQL Injection
SP Project & Document Manager≤2.5.9.5Update to 2.6.6.0
——
Medium6.1Reflected Cross-Site Scripting
Realia<0.9.2Update to 0.9.2
——
Critical9.80.9.8.8 - Malicious Backdoor
Custom Content Type Manager0.9.8.7 – 0.9.8.8Update to 0.9.8.9
——
High7.2Cross-Site Scripting
adminer<1.4.4Update to 1.4.4
——
Medium5.4Missing Authorization
Bulk Delete<5.5.4Update to 5.5.4
——
Critical9.8PHP Object Injection
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy≤2.5.7Update to 2.5.8
——
Medium6.1Reflected Cross-Site Scripting
Shibboleth≤1.6Update to 1.7
CVE-2017-14313—
Medium4.7Cross-Site Scripting
Gravity Forms≤1.9.15.11Update to 1.9.16
——
Medium6.1Reflected Cross-Site Scripting
Forget About Shortcode Buttons≤1.1.1Update to 1.1.2
CVE-2016-1000133—
Medium6.1Reflected Cross-Site Scripting
Goodnews – Responsive WordPress News/Magazine | News / Editorial≤5.11.1No patch available
CVE-2016-10999—
Medium4.9Sensitive Information Disclosure
Jetpack – AI Agents & MCP, Security, Backup & Analytics≤3.9.1Update to 3.9.2
——
Critical9.8SQL Injection
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export≤1.1Update to 1.2
CVE-2016-11000—
Medium6.1Cross-Site Scripting via LaTeX markup within HTML elements
Jetpack – AI Agents & MCP, Security, Backup & Analytics≤3.9.1Update to 3.9.2
——
Medium6.1Reflected Cross-Site Scripting
Import WooCommerce Suite for Products, Orders, Coupons, Reviews, and Customers | WP Ultimate CSV Importer<1.1Update to 1.1
——
Medium6.1Reflected Cross-Site Scripting
Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export<1.1Update to 1.1
——
Medium6.1Reflected Cross-Site Scripting
WP Advanced Importer≤2.1.1Update to 2.2
——
Medium6.1Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall<4.0.6Update to 4.0.6
CVE-2016-10867—
Medium6.1Reflected Cross-Site Scripting
CSV Import≤1.0Update to 1.1
——
Medium6.1Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall<4.0.5Update to 4.0.5
CVE-2016-10868—
High8.8Sensitive Information Disclosure
Bloom Email Opt-In<1.1.0Update to 1.1.1
CVE-2016-11003—
High8.8Privilege Escalation
Divi Extra≤1.2.3Update to 1.2.4
CVE-2016-11002—
High8.8Privilege Escalation
Bloom Email Opt-In≤1.1.0Update to 1.1.1
CVE-2016-11004—
Critical9.1Missing Authorization Checks
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder≤2.0.21Update to 2.0.22
——
Medium5.7Cross-Site Request Forgery
ALO EasyMail Newsletter<2.7.0Update to 2.7.0
——
Critical9.8Missing Authorization Checks
Jigoshop – Store Toolkit≤1.3.8Update to 1.3.9
——
  • High7.2
    Reflected Cross-Site Scripting

    DZS Video Gallery

    ≤8.60No patch available

    101f8390-7fd1-427d-a62e-83c527adedec

  • Critical9.8
    Unauthenticated Arbitrary File Upload

    360 Product Rotation

    ≤1.2.0Update to 1.2.2

    613e1862-e0b7-4012-a77d-b5fb56cbbb9c

  • Critical9.8
    Arbitrary File Upload

    SP Project & Document Manager

    ≤2.6.1.3Update to 2.6.1.4

    48f7ad3b-608b-4802-b7ab-fad4c449cc62

  • Medium6.1
    Cross-Site Scripting

    SP Project & Document Manager

    ≤2.6.0.0Update to 2.6.1.4

    fd05991d-382b-460c-b89f-e1f7dfac9e60

  • Medium6.1
    Cross-Site Scripting

    Ocim MP3

    all versionsNo patch available

    CVE-2016-10998

  • Critical9.8
    SQL Injection

    SP Project & Document Manager

    ≤2.5.9.5Update to 2.6.6.0

    d8da513f-19b1-4ec4-b3ad-dc3a7bb6ab49

  • Medium6.1
    Reflected Cross-Site Scripting

    Realia

    <0.9.2Update to 0.9.2

    0f1cce87-3e59-48c1-9d38-adaa739f20db

  • Critical9.8
    0.9.8.8 - Malicious Backdoor

    Custom Content Type Manager

    0.9.8.7 – 0.9.8.8Update to 0.9.8.9

    f1b6fe67-cbd8-438f-8e06-d0f25eddc81a

  • High7.2
    Cross-Site Scripting

    adminer

    <1.4.4Update to 1.4.4

    8139bc38-2b78-4b02-bce8-c28dd258ee49

  • Medium5.4
    Missing Authorization

    Bulk Delete

    <5.5.4Update to 5.5.4

    c3016491-6a6a-433f-9018-5e84f9e3e37c

  • Critical9.8
    PHP Object Injection

    Easy Digital Downloads – eCommerce Payments and Subscriptions made easy

    ≤2.5.7Update to 2.5.8

    b4cd5c42-bba2-4900-b450-a575c0007402

  • Medium6.1
    Reflected Cross-Site Scripting

    Shibboleth

    ≤1.6Update to 1.7

    CVE-2017-14313

  • Medium4.7
    Cross-Site Scripting

    Gravity Forms

    ≤1.9.15.11Update to 1.9.16

    6b5d31c5-0516-4089-9867-2922670e1b04

  • Medium6.1
    Reflected Cross-Site Scripting

    Forget About Shortcode Buttons

    ≤1.1.1Update to 1.1.2

    CVE-2016-1000133

  • Medium6.1
    Reflected Cross-Site Scripting

    Goodnews – Responsive WordPress News/Magazine | News / Editorial

    ≤5.11.1No patch available

    CVE-2016-10999

  • Medium4.9
    Sensitive Information Disclosure

    Jetpack – AI Agents & MCP, Security, Backup & Analytics

    ≤3.9.1Update to 3.9.2

    9b86a259-b102-411a-8d4c-c131737b90d8

  • Critical9.8
    SQL Injection

    Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export

    ≤1.1Update to 1.2

    CVE-2016-11000

  • Medium6.1
    Cross-Site Scripting via LaTeX markup within HTML elements

    Jetpack – AI Agents & MCP, Security, Backup & Analytics

    ≤3.9.1Update to 3.9.2

    0691cff0-86ed-47d3-9492-5ebc930d3eb7

  • Medium6.1
    Reflected Cross-Site Scripting

    Import WooCommerce Suite for Products, Orders, Coupons, Reviews, and Customers | WP Ultimate CSV Importer

    <1.1Update to 1.1

    64a7a4db-8b28-4085-91b0-4ea5343c5643

  • Medium6.1
    Reflected Cross-Site Scripting

    Export All Posts, Products, Orders & Users | WP Ultimate Exporter | WordPress CSV Export

    <1.1Update to 1.1

    b269a5c9-9f0e-4dba-a06e-2d8dd94643b4

  • Medium6.1
    Reflected Cross-Site Scripting

    WP Advanced Importer

    ≤2.1.1Update to 2.2

    cf02db2c-5fd2-4f21-a95c-e7645e22ecc6

  • Medium6.1
    Cross-Site Scripting

    All-In-One Security (AIOS) – Security and Firewall

    <4.0.6Update to 4.0.6

    CVE-2016-10867

  • Medium6.1
    Reflected Cross-Site Scripting

    CSV Import

    ≤1.0Update to 1.1

    92a9ca70-2867-433a-932e-191ed7f01945

  • Medium6.1
    Cross-Site Scripting

    All-In-One Security (AIOS) – Security and Firewall

    <4.0.5Update to 4.0.5

    CVE-2016-10868

  • High8.8
    Sensitive Information Disclosure

    Bloom Email Opt-In

    <1.1.0Update to 1.1.1

    CVE-2016-11003

  • High8.8
    Privilege Escalation

    Divi Extra

    ≤1.2.3Update to 1.2.4

    CVE-2016-11002

  • High8.8
    Privilege Escalation

    Bloom Email Opt-In

    ≤1.1.0Update to 1.1.1

    CVE-2016-11004

  • Critical9.1
    Missing Authorization Checks

    Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder

    ≤2.0.21Update to 2.0.22

    faed1198-b8c4-46b1-b6a6-5fc35cd7bdf8

  • Medium5.7
    Cross-Site Request Forgery

    ALO EasyMail Newsletter

    <2.7.0Update to 2.7.0

    a68f024d-b80d-4e6c-8420-5e0dde87d8f0

  • Critical9.8
    Missing Authorization Checks

    Jigoshop – Store Toolkit

    ≤1.3.8Update to 1.3.9

    761ec035-5961-45a5-8197-b5209df8bc3a

Search VulnCrest Radar

Jump to

Are you sure?