Database

WordPress Vulnerability Database (page 1392)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1392)
Severity	Vulnerability	CVE	Installs	Published
High8.8	Arbitrary File Upload JetBackup – Backup, Restore & Migrate<1.0.3Update to 1.0.3	—	—	Feb 15, 2016
Critical9.8	Missing Authorization WP e-Commerce – Store Exporter≤1.6.6Update to 1.6.7	—	—	Feb 15, 2016
Critical9.8	Missing Authorization WP e-Commerce – Store Toolkit≤2.0.1Update to 2.0.2	—	—	Feb 15, 2016
High7.2	Multiple Vulnerabilities mb.miniAudioPlayer – an HTML5 audio player for your mp3 files≤1.7.6No patch available	CVE-2016-0796	—	Feb 12, 2016
Critical9.8	Missing Authorization Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers<1.8.4Update to 1.8.4	CVE-2016-10935	—	Feb 10, 2016
High8.8	Privilege Escalation Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools≤1.5.7Update to 1.5.8	CVE-2016-10923	—	Feb 10, 2016
High7.2	Reflected Cross-Site Scripting User Submitted Posts – Enable Users to Submit Posts from the Front End<20160215Update to 20160215	CVE-2016-11001	—	Feb 10, 2016
Medium6.1	Reflected Cross-Site Scripting Simplified Content<1.0.1Update to 1.0.1	CVE-2016-1000150	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting anti-plagiarism≤3.60No patch available	CVE-2016-1000128	—	Feb 9, 2016
Medium6.1	Cross-Site Scripting Easy Contact Form Builder≤1.0Update to 1.1	CVE-2016-1000152	—	Feb 9, 2016
Medium6.1	Cross-Site Scripting Recipes Writer≤1.0.4No patch available	CVE-2016-1000147	—	Feb 9, 2016
High7.3	Missing Authorization Sprout Invoices – Client Invoicing & Estimates≤9.3Update to 9.4	—	—	Feb 9, 2016
Medium6.5	Cross-Site Request Forgery Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More<1.1.4Update to 1.1.4	—	1M+	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting Admin Font Editor<1.8Update to 1.8	CVE-2016-1000126	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting Bulk change of posts terms and post types≤1.0No patch available	—	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting Pondol Form to Mail≤1.1No patch available	CVE-2016-1000146	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting heat-trackr<1.01Update to 1.01	CVE-2016-1000136	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting via title_az parameter E-Search≤1.0No patch available	CVE-2016-1000130	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting new-year-firework≤1.1.9No patch available	CVE-2016-1000140	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting PhotoXhibit≤2.1.8No patch available	CVE-2016-1000144	—	Feb 9, 2016
Medium6.1	Reflected Cross-Site Scripting ajax-random-post≤2.00No patch available	CVE-2016-1000127	—	Feb 9, 2016
High8.1	Shortcode SQL Injection Booking Calendar Contact Form≤1.0.23Update to 1.0.24	CVE-2016-20068	—	Feb 8, 2016
Critical9.8	Arbitrary File Upload User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission<2.3.11Update to 2.3.11	—	—	Feb 8, 2016
Medium6.3	Authorization Bypass Beaver Builder Page Builder – Drag and Drop Website Builder≤1.7Update to 1.7.1	—	—	Feb 8, 2016
Medium6.1	Reflected Cross-Site Scripting Booking Calendar Contact Form≤1.0.23Update to 1.0.24	CVE-2016-10908	—	Feb 8, 2016
Critical9.8	Blind SQL Injection Booking Calendar Contact Form<1.0.24Update to 1.0.24	CVE-2016-10909	—	Feb 8, 2016
Medium6.1	Reflected Cross-Site Scripting via linkbutton Image Gallery - Responsive Photo Gallery≤1.7.0Update to 1.7.1	—	—	Feb 8, 2016
High8.8	Missing Authorization Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools≤1.5.6Update to 1.5.7	CVE-2016-10922	—	Feb 8, 2016
Medium6.1	Reflected Cross-Site Scripting Elfsight Instagram Widget – Instagram Gallery<1.1.2Update to 1.1.2	CVE-2016-11005	—	Feb 7, 2016
Medium6.4	Cross-Site Scripting Universal Analytics≤1.3.0Update to 1.3.1	CVE-2016-10912	—	Feb 4, 2016

High8.8
Arbitrary File Upload
JetBackup – Backup, Restore & Migrate
<1.0.3Update to 1.0.3
7ee267ff-b650-44a5-994b-3a22d34722e8Feb 15, 2016
Critical9.8
Missing Authorization
WP e-Commerce – Store Exporter
≤1.6.6Update to 1.6.7
668ba3a9-d53c-45ab-854f-1a9e83dd54b8Feb 15, 2016
Critical9.8
Missing Authorization
WP e-Commerce – Store Toolkit
≤2.0.1Update to 2.0.2
588ece40-a848-4b2c-9db5-e63e0d11dda0Feb 15, 2016
High7.2
Multiple Vulnerabilities
mb.miniAudioPlayer – an HTML5 audio player for your mp3 files
≤1.7.6No patch available
CVE-2016-0796Feb 12, 2016
Critical9.8
Missing Authorization
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
<1.8.4Update to 1.8.4
CVE-2016-10935Feb 10, 2016
High8.8
Privilege Escalation
Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools
≤1.5.7Update to 1.5.8
CVE-2016-10923Feb 10, 2016
High7.2
Reflected Cross-Site Scripting
User Submitted Posts – Enable Users to Submit Posts from the Front End
<20160215Update to 20160215
CVE-2016-11001Feb 10, 2016
Medium6.1
Reflected Cross-Site Scripting
Simplified Content
<1.0.1Update to 1.0.1
CVE-2016-1000150Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
anti-plagiarism
≤3.60No patch available
CVE-2016-1000128Feb 9, 2016
Medium6.1
Cross-Site Scripting
Easy Contact Form Builder
≤1.0Update to 1.1
CVE-2016-1000152Feb 9, 2016
Medium6.1
Cross-Site Scripting
Recipes Writer
≤1.0.4No patch available
CVE-2016-1000147Feb 9, 2016
High7.3
Missing Authorization
Sprout Invoices – Client Invoicing & Estimates
≤9.3Update to 9.4
5cdbd5fd-bb12-4202-b6c7-f314ad8987f5Feb 9, 2016
Medium6.5
Cross-Site Request Forgery
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
<1.1.4Update to 1.1.4
3f753961-3eeb-402d-876f-4a4dea41a96a1M+Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
Admin Font Editor
<1.8Update to 1.8
CVE-2016-1000126Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
Bulk change of posts terms and post types
≤1.0No patch available
aac6fcee-cb8b-4862-a1f1-9af692ae741fFeb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
Pondol Form to Mail
≤1.1No patch available
CVE-2016-1000146Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
heat-trackr
<1.01Update to 1.01
CVE-2016-1000136Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting via title_az parameter
E-Search
≤1.0No patch available
CVE-2016-1000130Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
new-year-firework
≤1.1.9No patch available
CVE-2016-1000140Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
PhotoXhibit
≤2.1.8No patch available
CVE-2016-1000144Feb 9, 2016
Medium6.1
Reflected Cross-Site Scripting
ajax-random-post
≤2.00No patch available
CVE-2016-1000127Feb 9, 2016
High8.1
Shortcode SQL Injection
Booking Calendar Contact Form
≤1.0.23Update to 1.0.24
CVE-2016-20068Feb 8, 2016
Critical9.8
Arbitrary File Upload
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
<2.3.11Update to 2.3.11
8a2186c9-fa27-4d7d-be41-c82711c49334Feb 8, 2016
Medium6.3
Authorization Bypass
Beaver Builder Page Builder – Drag and Drop Website Builder
≤1.7Update to 1.7.1
cd88b116-0a6e-412b-8d43-024fdf36bcdfFeb 8, 2016
Medium6.1
Reflected Cross-Site Scripting
Booking Calendar Contact Form
≤1.0.23Update to 1.0.24
CVE-2016-10908Feb 8, 2016
Critical9.8
Blind SQL Injection
Booking Calendar Contact Form
<1.0.24Update to 1.0.24
CVE-2016-10909Feb 8, 2016
Medium6.1
Reflected Cross-Site Scripting via linkbutton
Image Gallery - Responsive Photo Gallery
≤1.7.0Update to 1.7.1
3f0b212a-969b-4cd3-a31c-40b9ff9dce5fFeb 8, 2016
High8.8
Missing Authorization
Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools
≤1.5.6Update to 1.5.7
CVE-2016-10922Feb 8, 2016
Medium6.1
Reflected Cross-Site Scripting
Elfsight Instagram Widget – Instagram Gallery
<1.1.2Update to 1.1.2
CVE-2016-11005Feb 7, 2016
Medium6.4
Cross-Site Scripting
Universal Analytics
≤1.3.0Update to 1.3.1
CVE-2016-10912Feb 4, 2016