VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1394)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,153 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1394)
SeverityVulnerabilityCVEInstallsPublished
Medium5.5Cross-Site Scripting via Theme Names
WordPress≤4.4Update to 3.7.12 or 3.8.12 or 3.9.10 or 4.0.9 or 4.1.9 or 4.2.6 or 4.3.2 or 4.4.1
CVE-2016-1564—
Medium5.3Remote Code Execution
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation<1.1.4.6Update to 1.1.4.6
CVE-2016-10996—
Medium6.1Reflected Cross-Site Scripting
commentator<2.5.3Update to 2.5.3
——
High8.8Cross-Site Request Forgery
WP Symposium Pro<16.01Update to 16.01
——
High7.1Cross-Site Scripting
WP Symposium Pro<16.01Update to 16.01
——
Critical9.8SQL Injection
Simple Ads Manager<2.9.5.118Update to 2.9.5.118
——
High8.8Unrestricted File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery≤2.1.10Update to 2.1.15
CVE-2015-9228—
Medium6.4Stored Cross-Site Scripting
mTouch Quiz≤3.1.2Update to 3.1.3
CVE-2015-9389—
High8.8Cross-Site Request Forgery to Cross-Site Scripting
mTouch Quiz<3.1.3Update to 3.1.3
CVE-2015-9388—
Medium6.1Reflected Cross-Site Scripting
mTouch Quiz≤3.1.2Update to 3.1.3
CVE-2015-9386—
Medium6.5Cross-Site Request Forgery
mTouch Quiz<3.1.3Update to 3.1.3
CVE-2015-9387—
High8.8SQL Injection
Welcart e-Commerce<1.5.3Update to 1.5.3
CVE-2015-7791—
Medium4.3Missing Authorization Checks
Admin Management Xtended≤2.4.0Update to 2.4.0.1
CVE-2015-9390—
Critical9.8SQL Injection
Smart External Link Click Monitor [Link Log]<2.1Update to 2.1
CVE-2015-9344—
Medium6.1Cross-Site Scripting
YAWPP (Yet Another WordPress Petition Plugin)≤1.2.2No patch available
CVE-2015-9391—
High7.2Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder≤2.9.28Update to 2.9.29
——
Medium6.4Cross-Site Scripting
Content text slider on post<6.9Update to 6.9
CVE-2015-20019—
Medium6.1Reflected Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin<1.3.29Update to 1.3.29
CVE-2015-8354—
Medium5.4Cross-Site Scripting via p_name parameter
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin<1.5.63Update to 1.5.63
CVE-2015-9392—
High8.8Authenticated Command Injection
Cool Video Gallery<2.0Update to 2.0
CVE-2015-7527—
Medium6.1Cross-Site Scripting
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin<1.5.63Update to 1.5.63
CVE-2015-9393—
High8.8Cross-Site Request Forgery
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin<1.5.63Update to 1.5.63
CVE-2015-9394—
Medium6.1Reflected Cross-Site Scripting
Role Scoper (Obsolete – Please install PublishPress Permissions)<1.3.67Update to 1.3.67
CVE-2015-8353—
High8.8SQL Injection
Breezing Forms≤1.2.7.30Update to 1.2.7.31
——
Medium5.3Reflected Cross-Site Scripting
Page Builder by SiteOrigin<2.0.5Update to 2.0.5
——
High8.8Authenticated Blind SQL Injection
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin<1.5.64Update to 1.5.64
CVE-2015-9395—
Critical9.8SQL Injection
Google Doc Embedder<2.5.17Update to 2.5.17
CVE-2014-9173—
Medium6.1Reflected Cross-Site Scripting
Auto Thickbox Plus≤1.9No patch available
CVE-2015-9396—
Medium6.1Reflected Cross-Site Scripting
Contact Form Manager≤1.4.1Update to 1.4.2
——
Critical9.8SQL Injection
Double Opt-In for Download<2.0.9Update to 2.0.9
CVE-2015-7517—
  • Medium5.5
    Cross-Site Scripting via Theme Names

    WordPress

    ≤4.4Update to 3.7.12 or 3.8.12 or 3.9.10 or 4.0.9 or 4.1.9 or 4.2.6 or 4.3.2 or 4.4.1

    CVE-2016-1564

  • Medium5.3
    Remote Code Execution

    Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation

    <1.1.4.6Update to 1.1.4.6

    CVE-2016-10996

  • Medium6.1
    Reflected Cross-Site Scripting

    commentator

    <2.5.3Update to 2.5.3

    c55e1d38-081c-4ef6-aad7-04ef52c6bee0

  • High8.8
    Cross-Site Request Forgery

    WP Symposium Pro

    <16.01Update to 16.01

    c7296fdb-d5d6-4d4f-ac80-b9d5452191b4

  • High7.1
    Cross-Site Scripting

    WP Symposium Pro

    <16.01Update to 16.01

    52c7edcc-d8dd-401a-9d36-e395fa7189bf

  • Critical9.8
    SQL Injection

    Simple Ads Manager

    <2.9.5.118Update to 2.9.5.118

    806e5056-5c29-49d0-9150-add6ee485758

  • High8.8
    Unrestricted File Upload

    Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

    ≤2.1.10Update to 2.1.15

    CVE-2015-9228

  • Medium6.4
    Stored Cross-Site Scripting

    mTouch Quiz

    ≤3.1.2Update to 3.1.3

    CVE-2015-9389

  • High8.8
    Cross-Site Request Forgery to Cross-Site Scripting

    mTouch Quiz

    <3.1.3Update to 3.1.3

    CVE-2015-9388

  • Medium6.1
    Reflected Cross-Site Scripting

    mTouch Quiz

    ≤3.1.2Update to 3.1.3

    CVE-2015-9386

  • Medium6.5
    Cross-Site Request Forgery

    mTouch Quiz

    <3.1.3Update to 3.1.3

    CVE-2015-9387

  • High8.8
    SQL Injection

    Welcart e-Commerce

    <1.5.3Update to 1.5.3

    CVE-2015-7791

  • Medium4.3
    Missing Authorization Checks

    Admin Management Xtended

    ≤2.4.0Update to 2.4.0.1

    CVE-2015-9390

  • Critical9.8
    SQL Injection

    Smart External Link Click Monitor [Link Log]

    <2.1Update to 2.1

    CVE-2015-9344

  • Medium6.1
    Cross-Site Scripting

    YAWPP (Yet Another WordPress Petition Plugin)

    ≤1.2.2No patch available

    CVE-2015-9391

  • High7.2
    Stored Cross-Site Scripting

    Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

    ≤2.9.28Update to 2.9.29

    7bd89bd9-4f99-4828-bacc-15d2cfe13066

  • Medium6.4
    Cross-Site Scripting

    Content text slider on post

    <6.9Update to 6.9

    CVE-2015-20019

  • Medium6.1
    Reflected Cross-Site Scripting

    Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

    <1.3.29Update to 1.3.29

    CVE-2015-8354

  • Medium5.4
    Cross-Site Scripting via p_name parameter

    Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin

    <1.5.63Update to 1.5.63

    CVE-2015-9392

  • High8.8
    Authenticated Command Injection

    Cool Video Gallery

    <2.0Update to 2.0

    CVE-2015-7527

  • Medium6.1
    Cross-Site Scripting

    Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin

    <1.5.63Update to 1.5.63

    CVE-2015-9393

  • High8.8
    Cross-Site Request Forgery

    Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin

    <1.5.63Update to 1.5.63

    CVE-2015-9394

  • Medium6.1
    Reflected Cross-Site Scripting

    Role Scoper (Obsolete – Please install PublishPress Permissions)

    <1.3.67Update to 1.3.67

    CVE-2015-8353

  • High8.8
    SQL Injection

    Breezing Forms

    ≤1.2.7.30Update to 1.2.7.31

    da025593-ad11-4a48-97e1-d31c6f0e62ea

  • Medium5.3
    Reflected Cross-Site Scripting

    Page Builder by SiteOrigin

    <2.0.5Update to 2.0.5

    d10364ed-179d-4506-a6f0-42b03c005242

  • High8.8
    Authenticated Blind SQL Injection

    Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin

    <1.5.64Update to 1.5.64

    CVE-2015-9395

  • Critical9.8
    SQL Injection

    Google Doc Embedder

    <2.5.17Update to 2.5.17

    CVE-2014-9173

  • Medium6.1
    Reflected Cross-Site Scripting

    Auto Thickbox Plus

    ≤1.9No patch available

    CVE-2015-9396

  • Medium6.1
    Reflected Cross-Site Scripting

    Contact Form Manager

    ≤1.4.1Update to 1.4.2

    f268974a-db92-42d2-9e1d-f990ea067740

  • Critical9.8
    SQL Injection

    Double Opt-In for Download

    <2.0.9Update to 2.0.9

    CVE-2015-7517

Search VulnCrest Radar

Jump to

Are you sure?