Database

WordPress Vulnerability Database (page 1119)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1119)
Severity	Vulnerability	CVE	Installs	Published
Medium6.1	Reflected Cross-Site Scripting Rank Math SEO PRO≤3.0.35Update to 3.0.36	CVE-2023-32800	—	May 22, 2023
Critical9.9	Authenticated Arbitrary File Upload in Template Editing Woocommerce Follow-ups≤4.9.40Update to 4.9.50	CVE-2023-33318	—	May 22, 2023
High8.8	Authenticated (Subscriber+) SQL Injection SupportCandy – Helpdesk, Support Ticket System & AI Chatbot≤3.1.6Update to 3.1.7	CVE-2023-2719	—	May 22, 2023
Medium6.1	Reflected Cross-Site Scripting Easy Captcha≤1.0No patch available	CVE-2023-33312	—	May 22, 2023
Medium4.3	Cross-Site Request Forgery via delete_expired_used_coupon_code Abandoned Cart Lite for WooCommerce<5.14.2Update to 5.14.2	—	—	May 22, 2023
Medium6.5	Cross-Site Request Forgery via Multiple Functions BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)≤1.1.3.1Update to 1.1.3.2	CVE-2023-33314	—	May 22, 2023
Medium5.0	Authenticated(Administrator+) Local File Inclusion via 'view' parameter Unite Gallery Lite≤1.7.59Update to 1.7.60	CVE-2023-33310	—	May 22, 2023
Medium6.1	Reflected Cross-Site Scripting EventPrime – Events Calendar, Bookings, Tickets & AI≤2.8.6Update to 3.0.0	CVE-2023-33326	—	May 22, 2023
Medium6.5	Cross-Site Request Forgery via save_option WIP Custom Login≤1.2.9Update to 1.3.0	CVE-2023-33313	—	May 22, 2023
Medium6.1	Reflected Cross-Site Scripting Duplicator Pro≤4.5.11Update to 4.5.11.1	CVE-2023-33309	—	May 22, 2023
Medium4.4	Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings Custom Post Type Generator≤2.4.2No patch available	CVE-2023-33329	—	May 22, 2023
High7.1	Reflected Cross-Site Scripting WooCommerce Warranty Requests≤2.1.6Update to 2.1.7	CVE-2023-33317	—	May 22, 2023
Medium6.1	Reflected Cross-Site Scripting EventPrime – Events Calendar, Bookings, Tickets & AI≤3.0.5Update to 3.0.6	CVE-2023-35884	—	May 22, 2023
Medium5.3	Sensitive Information Exposure EventPrime – Events Calendar, Bookings, Tickets & AI≤2.8.6Update to 3.0.0	CVE-2023-33321	—	May 22, 2023
High7.2	Authenticated (Admin+) SQL Injection WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms – CRM, Bigin≤1.2.3Update to 1.2.4	CVE-2023-2527	—	May 22, 2023
Critical9.8	Privilege Escalation via Admin Password Reset Leyka≤3.30.2Update to 3.30.3	CVE-2023-33327	—	May 22, 2023
Medium4.4	Authenticated (Administrator+) Stored Cross-Site Scripting WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media≤4.6.0Update to 4.6.1	CVE-2023-3175	5K+	May 22, 2023
Medium6.1	Reflected Cross-Site Scripting Front End Users≤3.2.24Update to 3.2.25	CVE-2023-33322	—	May 22, 2023
Critical9.9	Zip Extraction to Arbitrary File Upload in File Manager Unlimited Elements for Elementor≤1.5.66Update to 1.5.67	CVE-2023-33930	—	May 22, 2023
Medium4.3	Cross-Site Request Forgery via ts_reset_tracking_setting Abandoned Cart Lite for WooCommerce<5.14.2Update to 5.14.2	—	—	May 22, 2023
Medium4.4	Authenticated (Administrator+) Stored Cross-Site Scripting WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media≤4.5.4Update to 4.5.5	CVE-2023-2742	5K+	May 22, 2023
Medium4.4	Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings Ultimate Dashboard – Custom WordPress Dashboard<3.7.6Update to 3.7.6	CVE-2023-2812	—	May 21, 2023
Medium5.4	Cross-Site Request Forgery via wsl_smart_app_banner_options Smart App Banner<1.1.3Update to 1.1.3	CVE-2023-33315	—	May 21, 2023
Medium5.4	Cross-Site Request Forgery to Disable All Plugins Groundhogg — CRM, Newsletters, and Marketing Automation≤2.7.9.8Update to 2.7.10	CVE-2023-2717	—	May 19, 2023
High7.5	Cross-Site Request Forgery to Privilege Escalation Groundhogg — CRM, Newsletters, and Marketing Automation≤2.7.9.8Update to 2.7.10	CVE-2023-2736	—	May 19, 2023
Medium4.9	Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Groundhogg — CRM, Newsletters, and Marketing Automation≤2.7.9.8Update to 2.7.10	CVE-2023-2735	—	May 19, 2023
Medium4.4	Authenticated (Admin+) Stored Cross-Site Scripting AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini<1.6.83Update to 1.6.83	CVE-2023-2580	—	May 19, 2023
Medium6.5	Shortcode Execution in User Generated Content WordPress<6.2.2Update to 5.9.7 or 6.0.5 or 6.1.3 or 6.2.2	—	—	May 19, 2023
Medium6.5	Shortcode Execution in User Generated Content WordPress<6.2.1Update to 5.9.6 or 6.0.4 or 6.1.2 or 6.2.1	—	—	May 19, 2023
Medium4.3	Missing Authorization to Update License Groundhogg — CRM, Newsletters, and Marketing Automation≤2.7.9.8Update to 2.7.10	CVE-2023-2714	—	May 19, 2023

Medium6.1
Reflected Cross-Site Scripting
Rank Math SEO PRO
≤3.0.35Update to 3.0.36
CVE-2023-32800May 22, 2023
Critical9.9
Authenticated Arbitrary File Upload in Template Editing
Woocommerce Follow-ups
≤4.9.40Update to 4.9.50
CVE-2023-33318May 22, 2023
High8.8
Authenticated (Subscriber+) SQL Injection
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
≤3.1.6Update to 3.1.7
CVE-2023-2719May 22, 2023
Medium6.1
Reflected Cross-Site Scripting
Easy Captcha
≤1.0No patch available
CVE-2023-33312May 22, 2023
Medium4.3
Cross-Site Request Forgery via delete_expired_used_coupon_code
Abandoned Cart Lite for WooCommerce
<5.14.2Update to 5.14.2
a1e51a99-f5d4-47d4-bead-00ca1f5f72c2May 22, 2023
Medium6.5
Cross-Site Request Forgery via Multiple Functions
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server)
≤1.1.3.1Update to 1.1.3.2
CVE-2023-33314May 22, 2023
Medium5.0
Authenticated(Administrator+) Local File Inclusion via 'view' parameter
Unite Gallery Lite
≤1.7.59Update to 1.7.60
CVE-2023-33310May 22, 2023
Medium6.1
Reflected Cross-Site Scripting
EventPrime – Events Calendar, Bookings, Tickets & AI
≤2.8.6Update to 3.0.0
CVE-2023-33326May 22, 2023
Medium6.5
Cross-Site Request Forgery via save_option
WIP Custom Login
≤1.2.9Update to 1.3.0
CVE-2023-33313May 22, 2023
Medium6.1
Reflected Cross-Site Scripting
Duplicator Pro
≤4.5.11Update to 4.5.11.1
CVE-2023-33309May 22, 2023
Medium4.4
Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Custom Post Type Generator
≤2.4.2No patch available
CVE-2023-33329May 22, 2023
High7.1
Reflected Cross-Site Scripting
WooCommerce Warranty Requests
≤2.1.6Update to 2.1.7
CVE-2023-33317May 22, 2023
Medium6.1
Reflected Cross-Site Scripting
EventPrime – Events Calendar, Bookings, Tickets & AI
≤3.0.5Update to 3.0.6
CVE-2023-35884May 22, 2023
Medium5.3
Sensitive Information Exposure
EventPrime – Events Calendar, Bookings, Tickets & AI
≤2.8.6Update to 3.0.0
CVE-2023-33321May 22, 2023
High7.2
Authenticated (Admin+) SQL Injection
WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms – CRM, Bigin
≤1.2.3Update to 1.2.4
CVE-2023-2527May 22, 2023
Critical9.8
Privilege Escalation via Admin Password Reset
Leyka
≤3.30.2Update to 3.30.3
CVE-2023-33327May 22, 2023
Medium4.4
Authenticated (Administrator+) Stored Cross-Site Scripting
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤4.6.0Update to 4.6.1
CVE-2023-31755K+May 22, 2023
Medium6.1
Reflected Cross-Site Scripting
Front End Users
≤3.2.24Update to 3.2.25
CVE-2023-33322May 22, 2023
Critical9.9
Zip Extraction to Arbitrary File Upload in File Manager
Unlimited Elements for Elementor
≤1.5.66Update to 1.5.67
CVE-2023-33930May 22, 2023
Medium4.3
Cross-Site Request Forgery via ts_reset_tracking_setting
Abandoned Cart Lite for WooCommerce
<5.14.2Update to 5.14.2
e743e656-2dd9-43ed-a190-b03af7c75c54May 22, 2023
Medium4.4
Authenticated (Administrator+) Stored Cross-Site Scripting
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤4.5.4Update to 4.5.5
CVE-2023-27425K+May 22, 2023
Medium4.4
Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings
Ultimate Dashboard – Custom WordPress Dashboard
<3.7.6Update to 3.7.6
CVE-2023-2812May 21, 2023
Medium5.4
Cross-Site Request Forgery via wsl_smart_app_banner_options
Smart App Banner
<1.1.3Update to 1.1.3
CVE-2023-33315May 21, 2023
Medium5.4
Cross-Site Request Forgery to Disable All Plugins
Groundhogg — CRM, Newsletters, and Marketing Automation
≤2.7.9.8Update to 2.7.10
CVE-2023-2717May 19, 2023
High7.5
Cross-Site Request Forgery to Privilege Escalation
Groundhogg — CRM, Newsletters, and Marketing Automation
≤2.7.9.8Update to 2.7.10
CVE-2023-2736May 19, 2023
Medium4.9
Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Groundhogg — CRM, Newsletters, and Marketing Automation
≤2.7.9.8Update to 2.7.10
CVE-2023-2735May 19, 2023
Medium4.4
Authenticated (Admin+) Stored Cross-Site Scripting
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
<1.6.83Update to 1.6.83
CVE-2023-2580May 19, 2023
Medium6.5
Shortcode Execution in User Generated Content
WordPress
<6.2.2Update to 5.9.7 or 6.0.5 or 6.1.3 or 6.2.2
4e3a6fe2-6292-44ff-8925-a4aeb77c2a7fMay 19, 2023
Medium6.5
Shortcode Execution in User Generated Content
WordPress
<6.2.1Update to 5.9.6 or 6.0.4 or 6.1.2 or 6.2.1
6300c8c2-f539-46b2-9ee0-80bebbe4cad3May 19, 2023
Medium4.3
Missing Authorization to Update License
Groundhogg — CRM, Newsletters, and Marketing Automation
≤2.7.9.8Update to 2.7.10
CVE-2023-2714May 19, 2023