VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1111)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1111)
SeverityVulnerabilityCVEInstallsPublished
Medium4.3Missing Authorization to Settings Update
WP-Members Membership Plugin≤3.4.7.3Update to 3.4.8
——
Medium4.3Cross-Site Request Forgery via toggle_widget
Stax Addons for Elementor≤1.4.3Update to 1.4.4
CVE-2023-1807—
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor≤3.3.0Update to 3.3.1
CVE-2023-0708—
High7.2Authenticated (Administrator+) SQL Injection via 'orderby'
WP EasyCart: Shopping Cart and eCommerce Store≤5.4.10Update to 5.4.11
CVE-2023-3023—
Medium4.9Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor≤3.3.0Update to 3.3.1
CVE-2023-0710—
Medium4.3Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor≤3.3.1Update to 3.3.2
CVE-2023-0691—
Medium4.3Missing Authorization in toggle_widget
Stax Addons for Elementor≤1.4.3Update to 1.4.4
CVE-2023-2189—
Medium4.4AJAX Search for WooCommerce <= 1.23.0 - Authenticated (Admin+) Stored Cross-Site Scripting
FiboSearch – Ajax Search for WooCommerce1.23.0 – 1.23.0Update to 1.24.0
CVE-2023-2450—
Medium6.5Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor≤3.3.1Update to 3.3.2
CVE-2023-0688—
High8.8Authenticated(Subscriber+) SQL Injection
Ultra Addons for Contact Form 73.1.23 – 3.1.23Update to 3.1.24
CVE-2023-1615—
Medium4.3Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor≤3.3.1Update to 3.3.2
CVE-2023-0692—
High7.2Unauthenticated Stored Cross-Site Scripting via Email
WP Mail Logging≤1.11.1Update to 1.11.2
CVE-2023-3081—
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor≤3.3.0Update to 3.3.1
CVE-2023-0695—
Medium6.5Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor≤3.3.1Update to 3.3.2
CVE-2023-0693—
Medium6.5Authenticated (Subscriber+) Information Disclosure via mf shortcode
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor≤3.3.1Update to 3.3.2
CVE-2023-0694—
Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor≤3.3.0Update to 3.3.1
CVE-2023-0709—
Medium6.6Authenticated(Shop Manager+) PHP Object Injection via create_dummy_vendor
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy<3.7.20Update to 3.7.20
CVE-2023-34382—
High8.8Authenticated(Subscriber+) Arbitrary File Upload via upload_file
Download Monitor<4.8.4Update to 4.8.4
CVE-2023-34007—
Medium4.3Cross-Site Request Forgery via edd_trigger_upgrades
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy<3.1.2Update to 3.1.2
——
High8.5Authenticated(Subscriber+) Server Side Request Forgery
Getwid – Gutenberg Blocks≤1.8.3Update to 1.8.4
CVE-2023-1895—
Critical9.8Authentication Bypass
Abandoned Cart Lite for WooCommerce≤5.15.1Update to 5.15.2
CVE-2023-2986—
Medium4.3Improper Authorization via get_remote_templates REST endpoint
Getwid – Gutenberg Blocks≤1.8.3Update to 1.8.4
CVE-2023-1910—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'Feed[title]'
PowerPress Podcasting plugin by Blubrry≤10.2.3Update to 10.2.4
——
Medium6.6Authenticated(Administrator+) SQL Injection
Responsive CSS EDITOR≤1.0No patch available
CVE-2023-2482—
Medium6.6Authenticated(Administrator+) SQL Injection
FormCraft – Form Builder≤3.9.5Update to 3.9.6
CVE-2023-2592—
Medium5.4Missing Authorization
KiviCare – Clinic & Patient Management System (EHR)≤3.2.0Update to 3.2.1
CVE-2023-2627—
Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
USM Premium≤16.2Update to 16.3
CVE-2023-1166—
Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
Social Media Share Buttons & Social Sharing Icons≤2.8.1Update to 2.8.2
——
Medium6.5Cross-Site Request Forgery
KiviCare – Clinic & Patient Management System (EHR)≤3.2.0Update to 3.2.1
CVE-2023-2628—
Medium6.5Sensitive Information Exposure
KiviCare – Clinic & Patient Management System (EHR)3.2.0 – 3.2.0Update to 3.2.1
CVE-2023-2623—

Search VulnCrest Radar

Jump to

Are you sure?