Database

WordPress Vulnerability Database (page 1408)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1408)
Severity	Vulnerability	CVE	Installs	Published
Medium5.4	Cross-Site Scripting WP Membership≤1.2.3No patch available	CVE-2015-4039	—	May 21, 2015
High7.2	Authenticated (Admin+) Remote Code Execution Custom Content Type Manager≤0.9.8.5Update to 0.9.8.6	CVE-2015-3173	—	May 21, 2015
Medium6.1	Cross-Site Scripting Polls CP<1.0.5Update to 1.0.5	CVE-2015-9346	—	May 20, 2015
High7.1	Cross-Site Scripting WP Photo Album Plus<6.1.3Update to 6.1.3	CVE-2015-3647	—	May 20, 2015
High7.5	Arbitrary File Download via Path Traversal Simple Backup<2.7.11Update to 2.7.11	CVE-2015-10134	—	May 19, 2015
Critical9.8	SQL Injection FeedWordPress<2015.0514Update to 2015.0514	CVE-2015-4018	—	May 19, 2015
High8.8	Cross-Site Request Forgery Brute Force Login Protection≤1.5.1No patch available	CVE-2014-5034	—	May 17, 2015
High7.5	Sensitive Information Disclosure Almera Responsive Portfolio Site Template<1.1.8Update to 1.1.8	CVE-2015-9488	—	May 15, 2015
High7.5	Sensitive Information Disclosure Invento \| Architecture Building Agency Template≤2015-05-15No patch available	CVE-2015-9483	—	May 15, 2015
High7.5	Sensitive Information Disclosure Almera Responsive Portfolio Site Template<1.1.8Update to 1.1.8	CVE-2015-9487	—	May 15, 2015
High7.5	Information Disclosure Axioma Premium Responsive<1.1.2Update to 1.1.2	CVE-2015-9486	—	May 15, 2015
High7.5	Sensitive Information Disclosure Blessing Premium Responsive WordPress Theme<1.3.2.1Update to 1.3.2.1	CVE-2015-9491	—	May 15, 2015
Medium6.1	Reflected Cross-Site Scripting FGallery Plus≤1.0No patch available	—	—	May 15, 2015
High7.5	Sensitive Information Disclosure Goodnex Responsive HTML5/CSS3 Site Template<1.1.3Update to 1.1.3	CVE-2015-9489	—	May 15, 2015
Critical9.8	Path Traversal to Remote Code Execution My Calendar – Accessible Event Manager≤2.3.29Update to 2.3.30	—	—	May 15, 2015
Critical9.8	Arbitrary File Upload Husker Portfolio≤0.3No patch available	—	—	May 15, 2015
High8.8	Cross-Site Request Forgery to SQL Injection Visual Form Builder<2.8.3Update to 2.8.3	—	—	May 15, 2015
Critical9.8	SQL Injection wp-forum≤2.4No patch available	—	—	May 15, 2015
High7.5	Sensitive Information Disclosure GamesTheme≤1.0.3No patch available	CVE-2015-9490	—	May 15, 2015
Medium6.5	Arbitrary Shortcode Execution Awesome Support – WordPress HelpDesk & Support Plugin<3.1.7Update to 3.1.7	CVE-2015-9318	—	May 15, 2015
High7.5	Sensitive Information Disclosure WP Backup+all versionsNo patch available	—	—	May 15, 2015
High7.5	Sensitive Information Disclosure Diplomat \| Political Campaign, Party, Blog Responsive WordPress Theme≤1.0.1Update to 1.0.2	CVE-2015-9481	—	May 15, 2015
Medium6.1	Reflected Cross-Site Scripting My Calendar – Accessible Event Manager<2.3.30Update to 2.3.30	—	—	May 15, 2015
Critical9.8	Authenticated SQL Injection BigContact Contact Page<1.4.7Update to 1.4.7	—	—	May 15, 2015
High7.2	Authenticated SQL Injection Visual Form Builder<2.8.3Update to 2.8.3	—	—	May 15, 2015
High7.5	Sensitive Information Disclosure Car Dealer Automotive WordPress Theme – Responsive<1.1.9Update to 1.1.9	CVE-2015-9482	—	May 15, 2015
Medium6.1	Cross-Site Scripting Awesome Support – WordPress HelpDesk & Support Plugin<3.1.7Update to 3.1.7	CVE-2015-9317	—	May 15, 2015
High7.1	Cross-Site Scripting BuddyPress BP Gallery Plus≤1.2.5No patch available	—	—	May 15, 2015
Medium5.3	Multiple Full Path Disclosures NextGen Cu3er Gallery≤0.1No patch available	—	—	May 15, 2015
High7.5	Information Disclosure SmartIT Premium Responsiveall versionsNo patch available	CVE-2015-9492	—	May 15, 2015

Medium5.4
Cross-Site Scripting
WP Membership
≤1.2.3No patch available
CVE-2015-4039May 21, 2015
High7.2
Authenticated (Admin+) Remote Code Execution
Custom Content Type Manager
≤0.9.8.5Update to 0.9.8.6
CVE-2015-3173May 21, 2015
Medium6.1
Cross-Site Scripting
Polls CP
<1.0.5Update to 1.0.5
CVE-2015-9346May 20, 2015
High7.1
Cross-Site Scripting
WP Photo Album Plus
<6.1.3Update to 6.1.3
CVE-2015-3647May 20, 2015
High7.5
Arbitrary File Download via Path Traversal
Simple Backup
<2.7.11Update to 2.7.11
CVE-2015-10134May 19, 2015
Critical9.8
SQL Injection
FeedWordPress
<2015.0514Update to 2015.0514
CVE-2015-4018May 19, 2015
High8.8
Cross-Site Request Forgery
Brute Force Login Protection
≤1.5.1No patch available
CVE-2014-5034May 17, 2015
High7.5
Sensitive Information Disclosure
Almera Responsive Portfolio Site Template
<1.1.8Update to 1.1.8
CVE-2015-9488May 15, 2015
High7.5
Sensitive Information Disclosure
Invento | Architecture Building Agency Template
≤2015-05-15No patch available
CVE-2015-9483May 15, 2015
High7.5
Sensitive Information Disclosure
Almera Responsive Portfolio Site Template
<1.1.8Update to 1.1.8
CVE-2015-9487May 15, 2015
High7.5
Information Disclosure
Axioma Premium Responsive
<1.1.2Update to 1.1.2
CVE-2015-9486May 15, 2015
High7.5
Sensitive Information Disclosure
Blessing Premium Responsive WordPress Theme
<1.3.2.1Update to 1.3.2.1
CVE-2015-9491May 15, 2015
Medium6.1
Reflected Cross-Site Scripting
FGallery Plus
≤1.0No patch available
c7fef895-95d3-4106-94f1-52f8044c3b62May 15, 2015
High7.5
Sensitive Information Disclosure
Goodnex Responsive HTML5/CSS3 Site Template
<1.1.3Update to 1.1.3
CVE-2015-9489May 15, 2015
Critical9.8
Path Traversal to Remote Code Execution
My Calendar – Accessible Event Manager
≤2.3.29Update to 2.3.30
cfffe880-e3f9-4163-a726-e248433e1034May 15, 2015
Critical9.8
Arbitrary File Upload
Husker Portfolio
≤0.3No patch available
436fc1c8-3141-445d-902e-f759feefe1ccMay 15, 2015
High8.8
Cross-Site Request Forgery to SQL Injection
Visual Form Builder
<2.8.3Update to 2.8.3
373e9a7c-cdc3-43cb-9c8f-2be25f514b61May 15, 2015
Critical9.8
SQL Injection
wp-forum
≤2.4No patch available
3d7b4428-99ac-4f84-8595-941124121eb2May 15, 2015
High7.5
Sensitive Information Disclosure
GamesTheme
≤1.0.3No patch available
CVE-2015-9490May 15, 2015
Medium6.5
Arbitrary Shortcode Execution
Awesome Support – WordPress HelpDesk & Support Plugin
<3.1.7Update to 3.1.7
CVE-2015-9318May 15, 2015
High7.5
Sensitive Information Disclosure
WP Backup+
all versionsNo patch available
0fa4585d-9ffa-4a32-aeb7-60cdad63187bMay 15, 2015
High7.5
Sensitive Information Disclosure
Diplomat | Political Campaign, Party, Blog Responsive WordPress Theme
≤1.0.1Update to 1.0.2
CVE-2015-9481May 15, 2015
Medium6.1
Reflected Cross-Site Scripting
My Calendar – Accessible Event Manager
<2.3.30Update to 2.3.30
8de8a412-af19-4a1e-a131-47815b38517fMay 15, 2015
Critical9.8
Authenticated SQL Injection
BigContact Contact Page
<1.4.7Update to 1.4.7
5b53fa6f-7fb8-4643-a365-7630102e7e46May 15, 2015
High7.2
Authenticated SQL Injection
Visual Form Builder
<2.8.3Update to 2.8.3
79289ad7-f289-4472-973d-d0ec2996c5c5May 15, 2015
High7.5
Sensitive Information Disclosure
Car Dealer Automotive WordPress Theme – Responsive
<1.1.9Update to 1.1.9
CVE-2015-9482May 15, 2015
Medium6.1
Cross-Site Scripting
Awesome Support – WordPress HelpDesk & Support Plugin
<3.1.7Update to 3.1.7
CVE-2015-9317May 15, 2015
High7.1
Cross-Site Scripting
BuddyPress BP Gallery Plus
≤1.2.5No patch available
98527ebf-26a3-4900-84b5-3d2245783e8eMay 15, 2015
Medium5.3
Multiple Full Path Disclosures
NextGen Cu3er Gallery
≤0.1No patch available
5c408a27-7ed9-4106-8b65-9169ecc0e6f5May 15, 2015
High7.5
Information Disclosure
SmartIT Premium Responsive
all versionsNo patch available
CVE-2015-9492May 15, 2015