VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1098)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1098)
SeverityVulnerabilityCVEInstallsPublished
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Login with YourMembership – YM SSO Login≤1.1.3Update to 1.1.4
CVE-2023-37986—
Medium4.9Hardcoded Encryption Key
ProfileGrid – User Profiles, Groups and Communities≤5.5.0Update to 5.5.1
CVE-2023-3404—
Medium5.3Excessive Quiz Attempts
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker≤8.1.10Update to 8.1.11
CVE-2023-37984—
High8.8Authenticated (Subscriber+) Arbitrary Option Update
ProfileGrid – User Profiles, Groups and Communities≤5.5.1Update to 5.5.2
CVE-2023-3713—
Medium6.1Reflected Cross-Site Scripting via multiple parameters
ShopConstruct – Product Catalog, Shopping Cart and eCommerce solution for Store≤1.1.2No patch available
CVE-2023-34011—
Medium5.4Missing Authorization via multiple AJAX actions
Easyship WooCommerce Shipping Rates≤0.8.9Update to 0.9.1
CVE-2023-37989—
Medium5.3Insufficient Authorization
Qubely – Advanced Gutenberg Blocks<1.8.6Update to 1.8.6
CVE-2021-24916—
Medium6.1Reflected Cross-Site Scripting
Contact Form Generator : Creative form builder for WordPress≤2.5.5Update to 2.6.0
CVE-2023-37988—
High7.5Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation
ProfileGrid – User Profiles, Groups and Communities≤5.5.2Update to 5.5.3
CVE-2023-3714—
Medium5.4Missing Authorization to User Import
ProfileGrid – User Profiles, Groups and Communities≤5.5.1Update to 5.5.2
CVE-2023-3403—
Medium6.5Missing Authorization
Login with YourMembership – YM SSO Login≤1.1.3Update to 1.1.4
CVE-2023-37987—
High8.8Authenticated(Subscriber+) SQL Injection via id
NOPARCELS / MultiParcels Shipping For WooCommerce≤1.14.12Update to 1.14.15
CVE-2023-2843—
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Bubble Menu – Floating Button Menu with Sticky Navigation<3.0.5Update to 3.0.5
CVE-2023-3650—
Medium5.3Unauthenticated MailChimp API Key Disclosure
Royal Addons for Elementor – Addons and Templates Kit for Elementor≤1.3.70Update to 1.3.71
CVE-2023-3709—
High7.2Authenticated (Administrator+) SQL Injection via 'form_id'
Contact Form to Any API≤1.1.2Update to 1.1.3
CVE-2023-32741—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Chat Button & Custom ChatGPT-Powered Bot by GetButton.io≤1.8.9.4Update to 1.8.10
CVE-2023-32292—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
YARPP – Yet Another Related Posts Plugin≤5.30.3Update to 5.30.4
CVE-2023-2433—
Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
WP Food Manager – Restaurant Menu & Online Food Ordering for WooCommerce – Food Delivery & Pickup – Table Reservation≤1.0.3Update to 1.0.4
CVE-2023-0604—
High7.1Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Shopping Pages≤1.14No patch available
CVE-2023-3492—
Medium5.3IP Spoofing to Protection Mechanism Bypass
kk Star Ratings – Rate Post & Collect User Feedbacks≤5.4.3Update to 5.4.4
CVE-2023-36528—
Medium6.1Reflected Cross-Site Scripting
Everse≤1.8.10Update to 1.8.12
CVE-2023-3708—
Medium6.1Unauthenticated Reflected Cross-Site Scripting via Tag Filter Links
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager≤2.0.13Update to 2.0.13.1
CVE-2023-3524—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
PDQ CSV≤1.0.0Update to 2.0.0
CVE-2023-31221—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Question Title
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker≤8.1.10Update to 8.1.11
CVE-2023-3575—
Medium6.1Reflected Cross-Site Scripting
NOPARCELS / MultiParcels Shipping For WooCommerce≤1.15.3Update to 1.15.4
CVE-2023-3671—
Medium4.3Cross-Site Request Forgery via maybe_duplicate_item
Five Star Restaurant Menu and Food Ordering<2.4.7Update to 2.4.7
CVE-2023-37985—
Medium5.3Missing Authorization via wp_spaios_save_attachment_data
Slider a SlidersPack – Image Slider, Post Slider, ACF Gallery Slider≤2.0.2Update to 2.3
CVE-2022-46845—
Medium6.3Missing Authorization via get_history
NOPARCELS / MultiParcels Shipping For WooCommerce≤1.14.13Update to 1.14.14
CVE-2023-3365—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPBulky – WordPress Bulk Edit Post Types≤1.0.9Update to 1.0.10
CVE-2023-30482—
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
INDIGITALL – Instant Chat, Web Push Notifications<3.2.3Update to 3.2.3
CVE-2023-3647—

Search VulnCrest Radar

Jump to

Are you sure?