VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1068)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1068)
SeverityVulnerabilityCVEInstallsPublished
Medium4.3Cross-Site Request Forgery
Video Playlist for YouTube≤6.1Update to 6.2
CVE-2023-45653—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
EMC – Embed Calendly Scheduling With Ease≤3.6Update to 3.7
CVE-2023-4995—
Medium4.3Cross-Site Request Forgery
AGP Font Awesome Collection≤3.2.4No patch available
CVE-2023-45749—
Medium6.1Reflected Cross-Site Scripting
Fast WP Speed≤1.0.0No patch available
CVE-2023-45770—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Next Page≤1.5.2No patch available
CVE-2023-45768—
Medium4.3Cross-Site Request Forgery
Lazy Load for Videos≤2.18.2Update to 2.18.3
CVE-2023-45656—
Medium6.16.3.1 - Reflected Cross-Site Scripting via Application Password Requests
WordPress≤6.3.1Update to 5.6.12 or 5.7.10 or 5.8.8 or 5.9.8 or 6.0.6 or 6.1.4 or 6.2.3 or 6.3.2
——
Medium4.7Open Redirect via responsive_column_widgets_link
Responsive Column Widgets≤1.2.7No patch available
CVE-2023-45762—
Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Simple Tweet≤1.4.0.2No patch available
CVE-2023-45767—
Medium4.3Cross-Site Request Forgery
PixFields≤0.7.0Update to 0.7.1
CVE-2023-45655—
Medium6.46.3.1 - Authenticated(Contributor+) Cross-Site Scripting via Footnotes Block
WordPress6.3 – 6.3.1Update to 6.3.2
——
High8.8Authenticated (Subscriber+) SQL Injection via 'to' and 'from'
Nexter≤2.0.3Update to 2.0.4
CVE-2023-45657—
Medium5.3Denial of Service via Cache Poisoning
WordPress≤6.3.1Update to 4.7.27 or 4.8.23 or 4.9.24 or 5.0.20 or 5.1.17 or 5.2.19 or 5.3.16 or 5.4.14 or 5.5.13 or 5.6.12 or 5.7.10 or 5.8.8 or 5.9.8 or 6.0.6 or 6.1.4 or 6.2.3 or 6.3.2
——
Medium4.3Cross-Site Request Forgery
Caret Country Access Limit≤1.0.2Update to 1.0.3
CVE-2023-45641—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
WP ULike – Like Buttons, Voting & Engagement Analytics≤4.6.8Update to 4.6.9
CVE-2023-45640—
Medium6.1Reflected Cross-Site Scripting via post and post_id
Nexter Extension – Security, Performance, Code Snippets & Site Toolkit≤2.0.3Update to 2.0.4
CVE-2023-45750—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
CPT Shortcode Generator≤1.0No patch available
CVE-2023-45644—
Medium4.3Cross-Site Request Forgery
Post Gallery≤2.3.12No patch available
CVE-2023-45752—
Medium5.4WordPress Core < 6.3.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via parse-media-shortcode
WordPress≤6.3.1Update to 4.1.39 or 4.2.36 or 4.3.32 or 4.4.31 or 4.5.30 or 4.6.27 or 4.7.27 or 4.8.23 or 4.9.24 or 5.0.20 or 5.1.17 or 5.2.19 or 5.3.16 or 5.4.14 or 5.5.13 or 5.6.12 or 5.7.10 or 5.8.8 or 5.9.8 or 6.0.6 or 6.1.4 or 6.2.3 or 6.3.2
——
Medium4.3Cross-Site Request Forgery via eupago_page_content
Eupago Gateway For Woocommerce≤3.1.9Update to 3.1.10
CVE-2023-45638—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Amministrazione Trasparente≤8.0.2Update to 8.0.5
CVE-2023-45758—
Medium4.3Cross-Site Request Forgery
which template file≤4.8.0Update to 4.9.0
CVE-2023-45753—
Medium4.3Cross-Site Request Forgery via settings_page
Sort SearchResult By Title≤10.0Update to 11.0
CVE-2023-45639—
Medium4.3Cross-Site Request Forgery
Constant Contact Forms by MailMunch≤2.0.10Update to 2.0.11
CVE-2023-45647—
Medium4.3Cross-Site Request Forgery via wp_openstreetmaps
WP Open Street Map≤1.25Update to 1.30
CVE-2023-45645—
Medium5.36.3.1 - Sensitive Information Exposure via User Search REST Endpoint
WordPress≤6.3.1Update to 4.7.27 or 4.8.23 or 4.9.24 or 5.0.20 or 5.1.17 or 5.2.19 or 5.3.16 or 5.4.14 or 5.5.13 or 5.6.12 or 5.7.10 or 5.8.8 or 5.9.8 or 6.0.6 or 6.1.4 or 6.2.3 or 6.3.2
CVE-2023-5561—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PDF Block≤1.1.0No patch available
CVE-2023-45646—
High7.2Authenticated(Editor+) Remote Code Execution via metabox
Nexter Extension – Security, Performance, Code Snippets & Site Toolkit≤2.0.3Update to 2.0.4
CVE-2023-45751—
Medium4.3Cross-Site Request Forgery
WP Attachments – Smarter File Management & Download Lists≤5.0.11Update to 5.0.12
CVE-2023-45651—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Easy Testimonial Slider and Form≤1.0.18Update to 1.0.19
CVE-2023-45754—

Search VulnCrest Radar

Jump to

Are you sure?