Database
WordPress Vulnerability Database (page 1121)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.4 | Directory Traversal WordPress<6.2.1Update to 4.1.38 or 4.2.35 or 4.3.31 or 4.4.30 or 4.5.29 or 4.6.26 or 4.7.26 or 4.8.22 or 4.9.23 or 5.0.19 or 5.1.16 or 5.2.18 or 5.3.15 or 5.4.13 or 5.5.12 or 5.6.11 or 5.7.9 or 5.8.7 or 5.9.6 or 6.0.4 or 6.1.2 or 6.2.1 | CVE-2023-2745 | — | |
| High7.2 | Authenticated (Administrator+) SQL Injection | CVE-2023-2607 | — | |
| Medium4.3 | Cross-Site Request Forgery WordPress<6.2.1Update to 4.1.38 or 4.2.35 or 4.3.31 or 4.4.30 or 4.5.29 or 4.6.26 or 4.7.26 or 4.8.22 or 4.9.23 or 5.0.19 or 5.1.16 or 5.2.18 or 5.3.15 or 5.4.13 or 5.5.12 or 5.6.11 or 5.7.9 or 5.8.7 or 5.9.6 or 6.0.4 or 6.1.2 or 6.2.1 | — | — | |
| Medium5.4 | Cross-Site Request Forgery via AJAX action Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics≤1.7.24Update to 1.7.25 | CVE-2023-2528 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2023-2568 | — | |
| Low3.1 | Cross-Site Request Forgery to SQL Injection | CVE-2023-2608 | — | |
| Medium5.3 | Missing Authorization to Arbitrary Plugin Activation | CVE-2023-32959 | — | |
| Medium5.3 | Cross-Site Request Forgery to Arbitrary Plugin Activation | — | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Embed Discovery WordPress<6.2.1Update to 4.1.38 or 4.2.35 or 4.3.31 or 4.4.30 or 4.5.29 or 4.6.26 or 4.7.26 or 4.8.22 or 4.9.23 or 5.0.19 or 5.1.16 or 5.2.18 or 5.3.15 or 5.4.13 or 5.5.12 or 5.6.11 or 5.7.9 or 5.8.7 or 5.9.6 or 6.0.4 or 6.1.2 or 6.2.1 | — | — | |
| High8.1 | Authentication Bypass to Privilege Escalation | CVE-2023-2706 | — | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | CVE-2023-0431 | — | |
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting | — | — | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting | CVE-2023-2584 | — | |
| Medium5.4 | Reflected Cross-Site Scripting | CVE-2023-32961 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2023-25019 | — | |
| Medium4.3 | Cross-Site Request Forgery | — | — | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting | CVE-2023-2718 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2023-32745 | — | |
| Medium6.5 | Missing Authorization | — | — | |
| Medium4.3 | Insecure Direct Object Reference | CVE-2023-32747 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2023-32801 | — | |
| Medium6.1 | Reflected Cross-Site Scripting via 'page' parameter | CVE-2023-2572 | — | |
| Medium6.1 | Reflected Cross-Site Scripting via 'delete_mobile' | CVE-2023-32742 | — | |
| Medium4.3 | Insecure Direct Object Reference | CVE-2023-32799 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2023-32241 | — | |
| Critical9.8 | Authentication Bypass RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login≤5.2.1.0Update to 5.2.1.1 | CVE-2023-2499 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2023-2708 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2023-2488 | — | |
| Medium4.3 | Missing Authorization via recaptcha_for_all_image_select | CVE-2023-32599 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2023-32744 | — |
- Medium5.4Directory Traversal
WordPress
<6.2.1Update to 4.1.38 or 4.2.35 or 4.3.31 or 4.4.30 or 4.5.29 or 4.6.26 or 4.7.26 or 4.8.22 or 4.9.23 or 5.0.19 or 5.1.16 or 5.2.18 or 5.3.15 or 5.4.13 or 5.5.12 or 5.6.11 or 5.7.9 or 5.8.7 or 5.9.6 or 6.0.4 or 6.1.2 or 6.2.1
- High7.2Authenticated (Administrator+) SQL Injection
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤3.3.17Update to 3.3.18
- Medium4.3Cross-Site Request Forgery
WordPress
<6.2.1Update to 4.1.38 or 4.2.35 or 4.3.31 or 4.4.30 or 4.5.29 or 4.6.26 or 4.7.26 or 4.8.22 or 4.9.23 or 5.0.19 or 5.1.16 or 5.2.18 or 5.3.15 or 5.4.13 or 5.5.12 or 5.6.11 or 5.7.9 or 5.8.7 or 5.9.6 or 6.0.4 or 6.1.2 or 6.2.1
- Medium5.4Cross-Site Request Forgery via AJAX action
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.7.24Update to 1.7.25
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery by Ays – Responsive Image Gallery
≤5.1.6Update to 5.1.7
- Low3.1Cross-Site Request Forgery to SQL Injection
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤3.3.17Update to 3.3.18
- Medium5.3Missing Authorization to Arbitrary Plugin Activation
Appzend
≤1.2.3Update to 1.2.4
- Medium5.3Cross-Site Request Forgery to Arbitrary Plugin Activation
Appzend
≤1.2.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Embed Discovery
WordPress
<6.2.1Update to 4.1.38 or 4.2.35 or 4.3.31 or 4.4.30 or 4.5.29 or 4.6.26 or 4.7.26 or 4.8.22 or 4.9.23 or 5.0.19 or 5.1.16 or 5.2.18 or 5.3.15 or 5.4.13 or 5.5.12 or 5.6.11 or 5.7.9 or 5.8.7 or 5.9.6 or 6.0.4 or 6.1.2 or 6.2.1
- High8.1Authentication Bypass to Privilege Escalation
OTP Login & Register Woocommerce
≤2.2Update to 2.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
File Away
≤3.9.9.0.1No patch available
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
≤3.0.9Update to 3.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
PixelYourSite Pro – Your smart PIXEL (TAG) Manager
≤9.6.1Update to 9.6.2
- Medium5.4Reflected Cross-Site Scripting
Zotpress
≤7.3.3Update to 7.3.4
- Medium6.1Reflected Cross-Site Scripting
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
≤3.0.9Update to 3.1
- Medium4.3Cross-Site Request Forgery
Ricerca – advanced search
≤1.0.15Update to 1.0.16
- High7.2Unauthenticated Stored Cross-Site Scripting
Contact Form Email
≤1.3.37Update to 1.3.38
- Medium4.3Cross-Site Request Forgery
AutomateWoo
≤5.7.1Update to 5.7.2
- Medium6.5Missing Authorization
Predictive Search
≤1.2.2Update to 1.2.3
- Medium4.3Insecure Direct Object Reference
WooCommerce Bookings
≤1.15.78Update to 1.15.79
- Medium6.1Reflected Cross-Site Scripting
WooCommerce Composite Products
≤8.7.5Update to 8.7.6
- Medium6.1Reflected Cross-Site Scripting via 'page' parameter
Survey Maker by AYS
≤3.4.6Update to 3.4.7
- Medium6.1Reflected Cross-Site Scripting via 'delete_mobile'
WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS
≤6.1.4Update to 6.1.5
- Medium4.3Insecure Direct Object Reference
WooCommerce Ship to Multiple Addresses
≤3.8.3Update to 3.8.4
- Medium6.1Reflected Cross-Site Scripting
Essential Addons for Elementor Pro
≤5.4.8Update to 5.4.9
- Critical9.8Authentication Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤5.2.1.0Update to 5.2.1.1
- Medium6.1Reflected Cross-Site Scripting
Video Gallery
≤1.0.10Update to 1.0.11
- Medium6.1Reflected Cross-Site Scripting
Stop Spammers Classic
≤2022.6Update to 2023
- Medium4.3Missing Authorization via recaptcha_for_all_image_select
Integrator for Turnstile and reCAPTCHA.
≤1.22Update to 1.23
- Medium4.3Cross-Site Request Forgery
Product Recommendations
<2.3.0Update to 2.3.0