VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1070)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1070)
SeverityVulnerabilityCVEInstallsPublished
Medium4.3Cross-Site Request Forgery on AJAX actions
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media≤4.9.2Update to 4.9.1 or 4.9.3
CVE-2023-55345K+
Critical9.6AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media≤4.9.2Update to 4.9.1 or 4.9.3
CVE-2023-52125K+
Critical9.8Unauthenticated SQL Injection via qc_wpbo_search_response
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media≤4.8.9Update to 4.9.1
CVE-2023-52045K+
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)<1.7.0.14Update to 1.7.0.14
CVE-2023-47816—
Medium5.3Missing Authorization on AJAX actions
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media≤4.9.2Update to 4.9.1 or 4.9.3
CVE-2023-55335K+
Medium5.4Missing Authorization via Multiple AJAX Actions
Gallery – Image and Video Gallery with Thumbnails≤2.0.3No patch available
CVE-2023-45631—
Critical9.8Unauthenticated Arbitrary File Upload
User Submitted Posts – Enable Users to Submit Posts from the Front End≤20230902Update to 20230914
CVE-2023-45603—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Add to Calendar Button≤1.5.0Update to 1.5.1
CVE-2023-46613—
Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Custom Meta Widget
Get Custom Field Values<4.1Update to 4.1
——
Medium6.1Unauthenticated Stored Cross-Site Scripting via headers
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe<21.2.8.1Update to 21.2.8.1
CVE-2023-5307—
Medium5.5Authenticated (Author+) Stored Cross-Site Scripting via Shortcode
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages≤2.9.2Update to 2.9.3
CVE-2023-4968—
Medium4.4Authenticated(Admin+) Stored Cross-Site Scripting
Login Screen Manager≤3.5.2No patch available
CVE-2023-5243—
High7.1Missing Authorization to Authenticated(Subscriber+) Options Update via ajax_dismiss_notice
Campaign Monitor Forms by Optin Cat≤2.5.5Update to 2.5.6
CVE-2023-5098—
Medium6.1Reflected Cross-Site Scripting via keyword and ep_filter_date
EventPrime – Events Calendar, Bookings, Tickets & AI<3.2.0Update to 3.2.0
CVE-2023-4250—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
E2Pdf – Export Pdf Tool for WordPress<1.20.20Update to 1.20.20
CVE-2023-5229—
Critical9.8Unauthenticated Arbitrary File Upload
Royal Addons for Elementor – Addons and Templates Kit for Elementor≤1.3.78Update to 1.3.79
CVE-2023-5360—
Medium6.1Reflected Cross-Site Scripting via 'id'
Fattura24≤6.2.7Update to 6.2.8
CVE-2023-5211—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
GEO my WP≤4.0Update to 4.0.1
CVE-2023-5467—
Medium6.4Authenticated(Author+) Stored Cross-Site Scripting via SVG Upload
CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts<3.0Update to 3.0
CVE-2023-5458—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slick Contact Forms≤1.3.7No patch available
CVE-2023-5468—
Medium5.3Sensitive Information Exposure
Image Regenerate & Select Crop≤7.3.0Update to 7.3.1
CVE-2023-46820—
Medium6.1Reflected Cross-Site Scripting
Ebook Store≤5.8009Update to 5.8010
CVE-2023-45602—
Medium4.3Cross-Site Request Forgery
EventPrime – Events Calendar, Bookings, Tickets & AI<3.2.0Update to 3.2.0
CVE-2023-4251—
Medium4.3Reflected HTML Content Injection
EventPrime – Events Calendar, Bookings, Tickets & AI<3.2.0Update to 3.2.0
CVE-2023-5238—
High8.8Authenticated (Contributor+) SQL Injection
Contact Form Generator : Creative form builder for WordPress≤2.7.1Update to 2.9.0
CVE-2023-35911—
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
WP Custom Cursors | WordPress Cursor Plugin≤3.2No patch available
CVE-2023-5911—
Medium6.1Reflected Cross-Site Scripting via section_id
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login<5.2.4.2Update to 5.2.4.2
CVE-2023-51509—
Medium4.3Cross-Site Request Forgery via bml_settings
Blog Manager Light≤1.20No patch available
CVE-2023-45102—
Medium4.3Cross-Site Request Forgery via sgc_plugin_options
Stout Google Calendar≤1.2.3No patch available
CVE-2023-45273—
Low3.4Open Redirect via atkpout.php
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display≤3.3.9Update to 3.4.0
CVE-2023-45105—

Search VulnCrest Radar

Jump to

Are you sure?