Database

WordPress Vulnerability Database (page 1393)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1393)
Severity	Vulnerability	CVE	Installs	Published
Medium6.5	Unauthorized Settings Change WP-Invoice – Web Invoice and Billing≤4.1.0Update to 4.1.1	CVE-2016-11006	—	Feb 3, 2016
Medium5.3	Missing Authorization WP-Invoice – Web Invoice and Billing<4.1.1Update to 4.1.1	CVE-2016-11008	—	Feb 3, 2016
High8.8	Privilege Escalation WP-Invoice – Web Invoice and Billing<4.1.1Update to 4.1.1	CVE-2016-11011	—	Feb 3, 2016
Medium5.3	Insecure Direct Object Reference WP-Invoice – Web Invoice and Billing≤4.1.0Update to 4.1.1	CVE-2016-11007	—	Feb 3, 2016
Medium5.3	Missing Authorization WP-Invoice – Web Invoice and Billing≤4.1.0Update to 4.1.1	CVE-2016-11010	—	Feb 3, 2016
Medium5.3	Missing Authorization WP-Invoice – Web Invoice and Billing<4.1.1Update to 4.1.1	CVE-2016-11009	—	Feb 3, 2016
High8.8	Multiple SQL Injections eShop≤6.3.14No patch available	CVE-2016-0769	—	Feb 2, 2016
High8.8	Cross-Site Request Forgery Simple add pages or posts<1.7Update to 1.7	CVE-2016-10883	—	Feb 2, 2016
Medium5.4	Open Redirect via wp_validate_redirect WordPress≤4.4.1Update to 3.7.13 or 3.8.13 or 3.9.11 or 4.0.10 or 4.1.10 or 4.2.7 or 4.3.3 or 4.4.2	CVE-2016-2221	—	Feb 2, 2016
Medium6.1	Multiple Cross-Site Scripting eShop≤6.3.14No patch available	CVE-2016-0765	—	Feb 2, 2016
Medium6.1	Reflected Cross-Site Scripting MailPoet Newsletters (Previous)<2.7Update to 2.7	—	—	Feb 2, 2016
Medium6.4	Server-Side Request Forgery WordPress≤4.4.1Update to 3.7.13 or 3.8.13 or 3.9.11 or 4.0.10 or 4.1.10 or 4.2.7 or 4.3.3 or 4.4.2	CVE-2016-2222	—	Feb 2, 2016
High8.8	Privilege Escalation User Meta Manager<3.4.7Update to 3.4.7	—	—	Feb 2, 2016
High8.8	Cross-Site Request Forgery SP Project & Document Manager≤2.5.9.5Update to 2.6.0.0	—	—	Feb 2, 2016
Medium6.5	Missing Authorization to Sensitive Information Disclosure User Meta Manager<3.4.8Update to 3.4.8	—	—	Feb 1, 2016
Medium6.1	Cross-Site Scripting Connections Business Directory<8.5.9Update to 8.5.9	CVE-2016-0770	—	Feb 1, 2016
Medium6.1	Cross-Site Scripting Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter<4.2Update to 4.2	—	—	Jan 30, 2016
Medium6.1	Cross-Site Scripting rtMedia for WordPress, BuddyPress and bbPress<3.10.2Update to 3.10.2	—	—	Jan 28, 2016
Medium6.4	Cross-Site Scripting Sola Support Tickets<3.13Update to 3.13	CVE-2016-11012	—	Jan 28, 2016
Critical9.8	SQL Injection Appointment Booking Calendar≤1.2.24Update to 1.2.25	—	—	Jan 27, 2016
Medium6.1	Reflected Cross-Site Scripting IMPress Listings≤2.0.1Update to 2.0.2	CVE-2016-11013	—	Jan 27, 2016
Medium6.5	Stored Cross-Site Scripting WP Easy Gallery – WordPress Gallery Plugin<4.1.5Update to 4.1.5	—	—	Jan 26, 2016
High8.8	SQL Injection Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder≤1.07.11Update to 2.0	CVE-2014-9309	—	Jan 26, 2016
High7.2	Cross-Site Scripting Appointment Booking Calendar≤1.2.24Update to 1.2.25	—	—	Jan 26, 2016
Critical9.8	SQL Injection Appointment Booking Calendar<1.1.24Update to 1.1.24	CVE-2016-10916	—	Jan 25, 2016
High7.5	Authentication Bypass OneLogin SAML SSO<2.2.0Update to 2.2.0	CVE-2016-10928	—	Jan 21, 2016
Critical9.1	Missing Authorization Download Manager<2.8.8Update to 2.8.8	—	—	Jan 19, 2016
Medium6.5	Privilege Escalation Download Manager<2.8.8Update to 2.8.8	—	—	Jan 19, 2016
Critical9.9	Missing Authorization Simple Download Monitor≤3.2.8Update to 3.2.9	—	—	Jan 19, 2016
Medium5.3	Sensitive Information Disclosure via Directory Listing Download Manager<2.8.8Update to 2.8.8	—	—	Jan 19, 2016

Medium6.5
Unauthorized Settings Change
WP-Invoice – Web Invoice and Billing
≤4.1.0Update to 4.1.1
CVE-2016-11006Feb 3, 2016
Medium5.3
Missing Authorization
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
CVE-2016-11008Feb 3, 2016
High8.8
Privilege Escalation
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
CVE-2016-11011Feb 3, 2016
Medium5.3
Insecure Direct Object Reference
WP-Invoice – Web Invoice and Billing
≤4.1.0Update to 4.1.1
CVE-2016-11007Feb 3, 2016
Medium5.3
Missing Authorization
WP-Invoice – Web Invoice and Billing
≤4.1.0Update to 4.1.1
CVE-2016-11010Feb 3, 2016
Medium5.3
Missing Authorization
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
CVE-2016-11009Feb 3, 2016
High8.8
Multiple SQL Injections
eShop
≤6.3.14No patch available
CVE-2016-0769Feb 2, 2016
High8.8
Cross-Site Request Forgery
Simple add pages or posts
<1.7Update to 1.7
CVE-2016-10883Feb 2, 2016
Medium5.4
Open Redirect via wp_validate_redirect
WordPress
≤4.4.1Update to 3.7.13 or 3.8.13 or 3.9.11 or 4.0.10 or 4.1.10 or 4.2.7 or 4.3.3 or 4.4.2
CVE-2016-2221Feb 2, 2016
Medium6.1
Multiple Cross-Site Scripting
eShop
≤6.3.14No patch available
CVE-2016-0765Feb 2, 2016
Medium6.1
Reflected Cross-Site Scripting
MailPoet Newsletters (Previous)
<2.7Update to 2.7
14667d93-4fba-4c50-8228-737ae91f2789Feb 2, 2016
Medium6.4
Server-Side Request Forgery
WordPress
≤4.4.1Update to 3.7.13 or 3.8.13 or 3.9.11 or 4.0.10 or 4.1.10 or 4.2.7 or 4.3.3 or 4.4.2
CVE-2016-2222Feb 2, 2016
High8.8
Privilege Escalation
User Meta Manager
<3.4.7Update to 3.4.7
616c65e7-8d0c-4be8-bd6f-f98187ff1539Feb 2, 2016
High8.8
Cross-Site Request Forgery
SP Project & Document Manager
≤2.5.9.5Update to 2.6.0.0
47b75e7f-87d3-40d5-b3c4-998d3164d48aFeb 2, 2016
Medium6.5
Missing Authorization to Sensitive Information Disclosure
User Meta Manager
<3.4.8Update to 3.4.8
e0365efc-f443-40a6-a365-fd36c1818242Feb 1, 2016
Medium6.1
Cross-Site Scripting
Connections Business Directory
<8.5.9Update to 8.5.9
CVE-2016-0770Feb 1, 2016
Medium6.1
Cross-Site Scripting
Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter
<4.2Update to 4.2
6d93ce6c-0139-472c-a5ec-21fdf33cd898Jan 30, 2016
Medium6.1
Cross-Site Scripting
rtMedia for WordPress, BuddyPress and bbPress
<3.10.2Update to 3.10.2
7b19b0b2-d6cb-4d92-9925-c77d517ddfb7Jan 28, 2016
Medium6.4
Cross-Site Scripting
Sola Support Tickets
<3.13Update to 3.13
CVE-2016-11012Jan 28, 2016
Critical9.8
SQL Injection
Appointment Booking Calendar
≤1.2.24Update to 1.2.25
4d79df74-bb28-412b-bba1-9f8a40ae981dJan 27, 2016
Medium6.1
Reflected Cross-Site Scripting
IMPress Listings
≤2.0.1Update to 2.0.2
CVE-2016-11013Jan 27, 2016
Medium6.5
Stored Cross-Site Scripting
WP Easy Gallery – WordPress Gallery Plugin
<4.1.5Update to 4.1.5
436d77d9-242a-452b-93d4-707881f59034Jan 26, 2016
High8.8
SQL Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤1.07.11Update to 2.0
CVE-2014-9309Jan 26, 2016
High7.2
Cross-Site Scripting
Appointment Booking Calendar
≤1.2.24Update to 1.2.25
13c9a71f-ec0a-4d4a-be08-787aa22a0faeJan 26, 2016
Critical9.8
SQL Injection
Appointment Booking Calendar
<1.1.24Update to 1.1.24
CVE-2016-10916Jan 25, 2016
High7.5
Authentication Bypass
OneLogin SAML SSO
<2.2.0Update to 2.2.0
CVE-2016-10928Jan 21, 2016
Critical9.1
Missing Authorization
Download Manager
<2.8.8Update to 2.8.8
d7d381af-bb2a-43cb-9e5d-0b3d0e5f88f0Jan 19, 2016
Medium6.5
Privilege Escalation
Download Manager
<2.8.8Update to 2.8.8
c59cddfb-c434-4a69-9c1c-7d58f022c1aaJan 19, 2016
Critical9.9
Missing Authorization
Simple Download Monitor
≤3.2.8Update to 3.2.9
f5ad74c5-93ba-414c-98ad-0987547f172fJan 19, 2016
Medium5.3
Sensitive Information Disclosure via Directory Listing
Download Manager
<2.8.8Update to 2.8.8
639bf20c-04d4-49e5-8da1-685421a6f63aJan 19, 2016