VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1123)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1123)
SeverityVulnerabilityCVEInstallsPublished
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
iframe popup≤3.3No patch available
CVE-2023-24394—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Register Profile With Shortcode≤3.5.7Update to 3.5.8
CVE-2023-23818—
Medium5.4GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via ajax_delete_snapshot
Complianz GDPR/CCPA Cookie Consent Banner≤6.4.4Update to 6.4.5
——
Medium4.3GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via cmplz_duplicate_cookiebanner
Complianz GDPR/CCPA Cookie Consent Banner≤6.4.4Update to 6.4.5
——
Medium4.3Missing Authorization via save_fields_settings
Booking Ultra Pro Appointments Booking Calendar Plugin≤1.1.6Update to 1.1.7
CVE-2023-32601—
Medium4.3Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Deletion
WPCS – WordPress Currency Switcher Professional≤1.1.9Update to 1.2.0
CVE-2023-2556—
Medium6.6Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login≤5.2.0.5Update to 5.2.1.0
CVE-2023-2548—
Medium4.3Missing Authorization to Custom Drop-Down Currency Switcher Creation
WPCS – WordPress Currency Switcher Professional≤1.1.9Update to 1.2.0
CVE-2023-2555—
Medium4.3GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via run_sync
Complianz GDPR/CCPA Cookie Consent Banner≤6.4.4Update to 6.4.5
CVE-2023-33333—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Sunny Search≤1.0.2No patch available
CVE-2023-32595—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WPCS – WordPress Currency Switcher Professional≤1.1.9Update to 1.2.0
CVE-2023-2558—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Multistore Locator — WP Store Locator Plugin: Effortless Integration With Snazzy Maps≤2.4.9Update to 2.5.1
CVE-2023-0152—
Medium4.3Missing Authorization to Arbitrary Custom Drop-Down Currency Switcher Editing
WPCS – WordPress Currency Switcher Professional≤1.1.9Update to 1.2.0
CVE-2023-2557—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Quick Page/Post Redirect Plugin≤5.2.3Update to 5.2.4
CVE-2023-25063—
Medium5.4Cross-Site Request Forgery to Backup Storage Modification
WP All Backup≤2.4.3No patch available
CVE-2023-32583—
Medium5.4Missing Authorization to Settings Update
Elementor Website Builder – more than just a page builder≤3.13.1Update to 3.13.2
——
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
D-Bargain≤3.0.0Update to 4.0.0
CVE-2023-32591—
Medium6.1GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via ajax_script_add
Complianz GDPR/CCPA Cookie Consent Banner≤6.4.4Update to 6.4.5
——
Medium5.4Cross-Site Request Forgery to Settings Reset
Post State Tags≤2.0.6No patch available
CVE-2023-32588—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
weebotLite≤1.0.0No patch available
CVE-2023-32596—
Medium6.1GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via ajax_script_save
Complianz GDPR/CCPA Cookie Consent Banner≤6.4.4Update to 6.4.5
——
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
itemprop WP for SERP/SEO Rich snippets≤3.5.201706131No patch available
CVE-2023-23819—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Get your number≤1.1.3No patch available
CVE-2023-2634—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
Product page shipping calculator for WooCommerce≤1.3.25Update to 1.3.26
CVE-2023-32575—
Medium4.3Cross-Site Request Forgery via AJAX action
WP Reactions Lite≤1.3.8Update to 1.3.9
CVE-2023-32587—
High7.2Authenticated (Administrator+) SQL Injection
Active Directory Integration / LDAP Integration≤4.1.4Update to 4.1.5
CVE-2023-2484—
Medium5.4Missing Authorization
WP-Chatbot for Messenger≤4.7Update to 4.8
CVE-2023-32581—
Critical9.8Authentication Bypass to Privilege Escalation
Woodmart Core≤1.0.36Update to 1.0.37
CVE-2023-32244—
Medium4.3Missing Authorization via ig_update
Injection Guard≤1.2.1Update to 1.2.2
CVE-2023-32574—
High7.2Authenticated (Administrator+) SQL Injection
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce≤5.0.4Update to 5.0.5
CVE-2022-45373—

Search VulnCrest Radar

Jump to

Are you sure?