Database
WordPress Vulnerability Database (page 1115)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.1 | 1.1.1 - Missing Authorization to Authentication Bypass and Privilege Escalation | CVE-2023-2545 | — | |
| Medium5.5 | Authenticated (Admin+) Server-Side Request Forgery | CVE-2023-31219 | — | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting | CVE-2023-34187 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2023-25700 | — | |
| High7.2 | Authenticated (Editor+) SQL Injection | CVE-2023-34168 | — | |
| Medium6.5 | Authenticated (Author+) Arbitrary File Manipulation Jetpack – AI Agents & MCP, Security, Backup & Analytics≤12.1Update to 10.0.1 or 10.1.1 or 10.2.2 or 10.3.1 or 10.4.1 or 10.5.2 or 10.6.2 or 10.7.1 or 10.8.1 or 10.9.2 or 11.0.1 or 11.1.3 or 11.2.1 or 11.3.3 or 11.4.1 or 11.5.2 or 11.6.1 or 11.7.2 or 11.8.5 or 11.9.2 or 12.0.1 or 12.1.1 or 2.0.9 or 2.1.7 or 2.2.10 or 2.3.10 or 2.4.7 or 2.5.5 or 2.6.6 or 2.7.5 or 2.8.5 or 2.9.6 or 3.0.6 or 3.1.5 or 3.2.5 or 3.3.6 or 3.4.6 or 3.5.6 or 3.6.4 or 3.7.5 or 3.8.5 or 3.9.9 or 4.0.6 or 4.1.3 or 4.2.4 or 4.3.4 or 4.4.4 or 4.5.2 or 4.6.2 or 4.7.3 or 4.8.4 or 4.9.2 or 5.0.2 or 5.1.3 or 5.2.4 or 5.3.3 or 5.4.3 or 5.5.4 or 5.6.4 or 5.7.4 or 5.8.3 or 5.9.3 or 6.0.3 or 6.1.4 or 6.2.4 or 6.3.6 or 6.4.5 or 6.5.3 or 6.6.4 or 6.7.3 or 6.8.4 or 6.9.3 or 7.0.4 or 7.1.4 or 7.2.4 or 7.3.4 or 7.4.4 or 7.5.6 or 7.6.3 or 7.7.5 or 7.8.3 or 7.9.3 or 8.0.2 or 8.1.3 or 8.2.5 or 8.3.2 or 8.4.4 or 8.5.2 or 8.6.3 or 8.7.3 or 8.8.4 or 8.9.3 or 9.0.4 or 9.1.2 or 9.2.3 or 9.3.4 or 9.4.3 or 9.5.4 or 9.6.3 or 9.7.2 or 9.8.2 or 9.9.2 | CVE-2023-2996 | — | |
| Medium4.3 | Cross-Site Request Forgery to Form Duplication | CVE-2023-31216 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2023-34180 | — | |
| Low3.8 | Missing Authorization to Authenticated (Editor+) Plugin Settings Reset | CVE-2023-2434 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2023-34030 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2023-34174 | — | |
| High7.2 | Authenticated (Administrator+) SQL Injection | CVE-2023-34179 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2023-34175 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2023-34182 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2023-34176 | — | |
| High8.8 | Authenticated (Student+) SQL Injection | CVE-2023-25800 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2023-34184 | — | |
| High8.8 | 1.1.1 - Cross-Site Request Forgery to Privilege Escalation | CVE-2023-2549 | — | |
| Medium6.5 | Missing Authorization | CVE-2023-34186 | — | |
| Medium5.4 | Cross-Site Request Forgery | CVE-2023-34178 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2023-34185 | — | |
| Medium4.3 | Missing Authorization to Arbitrary Post Featured Image Modification | CVE-2023-2764 | — | |
| High7.2 | Authenticated (Editor+) Local File Inclusion via Shortcode | CVE-2023-2435 | — | |
| Medium4.3 | Missing Authorization to Arbitrary Plugin Activation | — | — | |
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2023-2836 | — | |
| Medium4.3 | Cross-Site Request Forgery to Arbitrary Plugin Activation | CVE-2023-33923 | — | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting | — | — | |
| High8.8 | Authenticated (Tutor Instructor+) SQL Injection | CVE-2023-25990 | — | |
| Medium5.4 | 1.1.1 - Missing Authorization to Non-Arbitrary User Deletion | CVE-2023-2547 | — | |
| Medium5.4 | Cross-Site Request Forgery | CVE-2023-24417 | — |
- High8.11.1.1 - Missing Authorization to Authentication Bypass and Privilege Escalation
Login | Login Page | Login Logo | Rename Login Page | Custom Login Page | Temporary Users | Rebrand Login | Login Captcha
1.0.7 – 1.1.1Update to 1.1.2
- Medium5.5Authenticated (Admin+) Server-Side Request Forgery
Download Monitor
≤4.8.1Update to 4.8.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Call Now Icon Animate
≤0.1.0No patch available
- Critical9.8Unauthenticated SQL Injection
Tutor LMS – eLearning and online course solution
≤2.1.10Update to 2.2.0
- High7.2Authenticated (Editor+) SQL Injection
WP Report Post
≤2.1.2No patch available
- Medium6.5Authenticated (Author+) Arbitrary File Manipulation
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤12.1Update to 10.0.1 or 10.1.1 or 10.2.2 or 10.3.1 or 10.4.1 or 10.5.2 or 10.6.2 or 10.7.1 or 10.8.1 or 10.9.2 or 11.0.1 or 11.1.3 or 11.2.1 or 11.3.3 or 11.4.1 or 11.5.2 or 11.6.1 or 11.7.2 or 11.8.5 or 11.9.2 or 12.0.1 or 12.1.1 or 2.0.9 or 2.1.7 or 2.2.10 or 2.3.10 or 2.4.7 or 2.5.5 or 2.6.6 or 2.7.5 or 2.8.5 or 2.9.6 or 3.0.6 or 3.1.5 or 3.2.5 or 3.3.6 or 3.4.6 or 3.5.6 or 3.6.4 or 3.7.5 or 3.8.5 or 3.9.9 or 4.0.6 or 4.1.3 or 4.2.4 or 4.3.4 or 4.4.4 or 4.5.2 or 4.6.2 or 4.7.3 or 4.8.4 or 4.9.2 or 5.0.2 or 5.1.3 or 5.2.4 or 5.3.3 or 5.4.3 or 5.5.4 or 5.6.4 or 5.7.4 or 5.8.3 or 5.9.3 or 6.0.3 or 6.1.4 or 6.2.4 or 6.3.6 or 6.4.5 or 6.5.3 or 6.6.4 or 6.7.3 or 6.8.4 or 6.9.3 or 7.0.4 or 7.1.4 or 7.2.4 or 7.3.4 or 7.4.4 or 7.5.6 or 7.6.3 or 7.7.5 or 7.8.3 or 7.9.3 or 8.0.2 or 8.1.3 or 8.2.5 or 8.3.2 or 8.4.4 or 8.5.2 or 8.6.3 or 8.7.3 or 8.8.4 or 8.9.3 or 9.0.4 or 9.1.2 or 9.2.3 or 9.3.4 or 9.4.3 or 9.5.4 or 9.6.3 or 9.7.2 or 9.8.2 or 9.9.2
- Medium4.3Cross-Site Request Forgery to Form Duplication
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.6.0Update to 2.6.1
- Medium6.1Reflected Cross-Site Scripting
Google Fonts For WordPress
≤3.0.0Update to 3.0.1
- Low3.8Missing Authorization to Authenticated (Editor+) Plugin Settings Reset
Nested Pages
≤3.2.3Update to 3.2.4
- Medium4.3Cross-Site Request Forgery
Complianz GDPR/CCPA Cookie Consent Banner
<6.4.6Update to 6.4.6
- Medium6.1Reflected Cross-Site Scripting
BBS e-Popup
≤2.4.5No patch available
- High7.2Authenticated (Administrator+) SQL Injection
Groundhogg — CRM, Newsletters, and Marketing Automation
≤2.7.11Update to 2.7.11.1
- Medium6.1Reflected Cross-Site Scripting
Login Configurator
≤2.1No patch available
- Medium4.3Cross-Site Request Forgery
LH Password Changer
≤1.55No patch available
- Medium6.1Reflected Cross-Site Scripting
Chilexpress woo oficial
≤1.2.9No patch available
- High8.8Authenticated (Student+) SQL Injection
Tutor LMS – eLearning and online course solution
≤2.2.0Update to 2.2.1
- Medium6.1Reflected Cross-Site Scripting
Woocommerce Order address Print
≤3.2No patch available
- High8.81.1.1 - Cross-Site Request Forgery to Privilege Escalation
Login | Login Page | Login Logo | Rename Login Page | Custom Login Page | Temporary Users | Rebrand Login | Login Captcha
1.0.7 – 1.1.1Update to 1.1.2
- Medium6.5Missing Authorization
Headless CMS
≤2.0.3No patch available
- Medium5.4Cross-Site Request Forgery
Groundhogg — CRM, Newsletters, and Marketing Automation
≤2.7.11Update to 2.7.11.1
- Medium4.3Cross-Site Request Forgery
WordPress NextGen GalleryView
≤0.5.5No patch available
- Medium4.3Missing Authorization to Arbitrary Post Featured Image Modification
Interactive Image Map Plugin – Draw Attention
≤2.0.11Update to 2.0.12
- High7.2Authenticated (Editor+) Local File Inclusion via Shortcode
Blog-in-Blog
≤2.0.0Update to 2.0.1
- Medium4.3Missing Authorization to Arbitrary Plugin Activation
Viral News
≤1.4.5Update to 1.4.6
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
CRM Perks Forms – WordPress Form Builder
≤1.1.1Update to 1.1.2
- Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
Viral News
≤1.4.5Update to 1.4.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Bulk Order Form for WooCommerce
≤3.5.7Update to 3.6.0
- High8.8Authenticated (Tutor Instructor+) SQL Injection
Tutor LMS – eLearning and online course solution
≤2.1.10Update to 2.2.0
- Medium5.41.1.1 - Missing Authorization to Non-Arbitrary User Deletion
Login | Login Page | Login Logo | Rename Login Page | Custom Login Page | Temporary Users | Rebrand Login | Login Captcha
1.0.7 – 1.1.1Update to 1.1.2
- Medium5.4Cross-Site Request Forgery
Worthy – VG WORT Integration für WordPress
≤1.6.5-6497609Update to 1.7.0-0cde1c2