Database

WordPress Vulnerability Database (page 1411)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1411)
Severity	Vulnerability	CVE	Installs	Published
High8.8	Multiple Vulnerabilities Ultimate Product Catalog<3.1.3Update to 3.1.3	—	—	Apr 22, 2015
Medium6.1	Reflected Cross-Site Scripting WooSidebars Sidebar Manager Converter≤1.1.1Update to 1.1.2	CVE-2015-10115	—	Apr 22, 2015
Critical9.8	Arbitrary File Upload Ultimate Product Catalog<4.2.22Update to 4.2.22	—	—	Apr 22, 2015
Medium6.1	Reflected Cross-Site Scripting WooFramework Branding≤1.0.1Update to 1.0.2	CVE-2015-10112	—	Apr 22, 2015
Medium6.4	Authenticated Stored Cross-Site Scripting Add Link to Facebook<1.216Update to 1.216	—	—	Apr 22, 2015
Medium6.1	Cross-Site Scripting OptionTree≤2.5.3Update to 2.5.4	CVE-2015-9320	—	Apr 22, 2015
Medium6.1	Reflected Cross-Site Scripting WooFramework Tweaks≤1.0.1Update to 1.0.2	CVE-2015-10113	—	Apr 22, 2015
Medium6.1	Reflected Cross-Site Scripting CM Tooltip Glossary≤3.1.3Update to 3.1.4	—	—	Apr 22, 2015
Medium6.1	Reflected Cross-Site Scripting WooSidebars≤1.4.1Update to 1.4.2	CVE-2015-10114	—	Apr 22, 2015
Medium6.1	Reflected Cross-Site Scripting Mark User as Spammer≤1.0.1Update to 1.0.2	CVE-2015-10093	—	Apr 22, 2015
High8.8	Remote Code Execution MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder<1.2Update to 1.2	—	—	Apr 21, 2015
Critical9.8	SQL Injection NEX-Forms – Ultimate Forms Plugin for WordPress<3.4Update to 3.4	—	—	Apr 21, 2015
High7.2	Cross-Site Scripting WordPress≤4.1.1Update to 3.7.6 or 3.8.6 or 3.9.4 or 4.0.2 or 4.1.2	CVE-2015-3438	—	Apr 21, 2015
High7.1	Cross-Site Scripting WP-Spreadplugin<3.8.6.2Update to 3.8.6.2	CVE-2015-10132	—	Apr 21, 2015
Medium6.1	Reflected Cross-Site Scripting Shortcode Factory≤1.1Update to 1.1.1	CVE-2015-9321	—	Apr 21, 2015
Medium6.1	Reflected Cross-Site Scripting Jetpack – AI Agents & MCP, Security, Backup & Analytics<3.4.3Update to 3.4.3	CVE-2015-9359	—	Apr 20, 2015
High7.2	Cross-Site Scripting MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)≤5.3.3Update to 5.4	—	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting WP Print Friendly<0.6.1Update to 0.6.1	—	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads – Attach Accounts to Orders≤2.0.1Update to 2.0.2	CVE-2015-9507	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Download Monitor≤1.7.0Update to 1.6.5 or 1.7.1	—	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting WP Print Friendly≤0.6Update to 0.6.1	—	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting 2Checkout Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9364	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy US Sales Taxes Add-on for iThemes Exchange<1.1.0Update to 1.1.0	CVE-2015-9369	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Easy Digital Downloads – Content Restriction≤2.0.7Update to 2.0.8	CVE-2015-9509	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting iThemes Builder Style Manager<0.7.7Update to 0.7.7	CVE-2015-9379	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Taxonomy Switcher≤1.0.3Update to 1.0.4	CVE-2015-10013	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – eCommerce Payments and Subscriptions made easy<2.3.7Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7	CVE-2015-9505	—	Apr 20, 2015
Medium6.1	Reflected Cross-Site Scripting Post Connector<1.0.4Update to 1.0.4	—	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – Invoices<1.0.4Update to 1.0.4	CVE-2015-9518	—	Apr 20, 2015
Medium6.1	Cross-Site Scripting Easy Digital Downloads – Invoices≤1.0.3Update to 1.0.4	CVE-2015-9516	—	Apr 20, 2015

High8.8
Multiple Vulnerabilities
Ultimate Product Catalog
<3.1.3Update to 3.1.3
0f2e39b3-c18c-4660-b23d-00790156bc7fApr 22, 2015
Medium6.1
Reflected Cross-Site Scripting
WooSidebars Sidebar Manager Converter
≤1.1.1Update to 1.1.2
CVE-2015-10115Apr 22, 2015
Critical9.8
Arbitrary File Upload
Ultimate Product Catalog
<4.2.22Update to 4.2.22
a30863c5-2e94-4952-b360-856394262023Apr 22, 2015
Medium6.1
Reflected Cross-Site Scripting
WooFramework Branding
≤1.0.1Update to 1.0.2
CVE-2015-10112Apr 22, 2015
Medium6.4
Authenticated Stored Cross-Site Scripting
Add Link to Facebook
<1.216Update to 1.216
a60d8102-1f15-4e61-b715-81e2111651a4Apr 22, 2015
Medium6.1
Cross-Site Scripting
OptionTree
≤2.5.3Update to 2.5.4
CVE-2015-9320Apr 22, 2015
Medium6.1
Reflected Cross-Site Scripting
WooFramework Tweaks
≤1.0.1Update to 1.0.2
CVE-2015-10113Apr 22, 2015
Medium6.1
Reflected Cross-Site Scripting
CM Tooltip Glossary
≤3.1.3Update to 3.1.4
5463a730-a8cf-40c9-83fc-3e451e4db1c9Apr 22, 2015
Medium6.1
Reflected Cross-Site Scripting
WooSidebars
≤1.4.1Update to 1.4.2
CVE-2015-10114Apr 22, 2015
Medium6.1
Reflected Cross-Site Scripting
Mark User as Spammer
≤1.0.1Update to 1.0.2
CVE-2015-10093Apr 22, 2015
High8.8
Remote Code Execution
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder
<1.2Update to 1.2
680746a3-8a72-4ec2-9f58-d744f40168edApr 21, 2015
Critical9.8
SQL Injection
NEX-Forms – Ultimate Forms Plugin for WordPress
<3.4Update to 3.4
2e88aa9e-6d1d-44ba-8d63-2f4d4161bc9eApr 21, 2015
High7.2
Cross-Site Scripting
WordPress
≤4.1.1Update to 3.7.6 or 3.8.6 or 3.9.4 or 4.0.2 or 4.1.2
CVE-2015-3438Apr 21, 2015
High7.1
Cross-Site Scripting
WP-Spreadplugin
<3.8.6.2Update to 3.8.6.2
CVE-2015-10132Apr 21, 2015
Medium6.1
Reflected Cross-Site Scripting
Shortcode Factory
≤1.1Update to 1.1.1
CVE-2015-9321Apr 21, 2015
Medium6.1
Reflected Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<3.4.3Update to 3.4.3
CVE-2015-9359Apr 20, 2015
High7.2
Cross-Site Scripting
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)
≤5.3.3Update to 5.4
9c40773d-3a2f-46b6-861e-608d662250daApr 20, 2015
Medium6.1
Cross-Site Scripting
WP Print Friendly
<0.6.1Update to 0.6.1
c7bfc7bf-19bb-43aa-95fc-7f4558699f41Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads – Attach Accounts to Orders
≤2.0.1Update to 2.0.2
CVE-2015-9507Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Download Monitor
≤1.7.0Update to 1.6.5 or 1.7.1
93cb6d59-6654-4ce1-b65f-0e162ae58bacApr 20, 2015
Medium6.1
Cross-Site Scripting
WP Print Friendly
≤0.6Update to 0.6.1
980ed456-b6a9-4ca0-99ce-513b20af6d8fApr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
2Checkout Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9364Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy US Sales Taxes Add-on for iThemes Exchange
<1.1.0Update to 1.1.0
CVE-2015-9369Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Easy Digital Downloads – Content Restriction
≤2.0.7Update to 2.0.8
CVE-2015-9509Apr 20, 2015
Medium6.1
Cross-Site Scripting
iThemes Builder Style Manager
<0.7.7Update to 0.7.7
CVE-2015-9379Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Taxonomy Switcher
≤1.0.3Update to 1.0.4
CVE-2015-10013Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<2.3.7Update to 1.8.7 or 1.9.10 or 2.0.5 or 2.1.11 or 2.2.9 or 2.3.7
CVE-2015-9505Apr 20, 2015
Medium6.1
Reflected Cross-Site Scripting
Post Connector
<1.0.4Update to 1.0.4
c3d7728f-7c25-4505-8db3-b67a5c17a439Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – Invoices
<1.0.4Update to 1.0.4
CVE-2015-9518Apr 20, 2015
Medium6.1
Cross-Site Scripting
Easy Digital Downloads – Invoices
≤1.0.3Update to 1.0.4
CVE-2015-9516Apr 20, 2015