VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1143)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1143)
SeverityVulnerabilityCVEInstallsPublished
Medium6.3Cross-Site Request Forgery via health_check_troubleshoot_get_captures
Health Check & Troubleshooting≤1.5.1Update to 1.6.0
CVE-2022-47161—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
PI Delivery & Pickup Date Time for WooCommerce≤3.0.19Update to 3.0.20
CVE-2023-28991—
Medium4.3Cross-Site Request Forgery via plugin_activation
Really Simple Google Tag Manager (GTM)≤1.0.6Update to 1.0.7
CVE-2023-23801—
Medium4.3Cross-Site Request Forgery via plugin_activation
HT Menu – WordPress Mega Menu Builder for Elementor≤1.2.1Update to 1.2.2
CVE-2023-23791—
Medium5.3Missing Authorization to Notification Dismissal
No CAPTCHA reCAPTCHA for WooCommerce≤1.2.6No patch available
——
Medium4.3Cross-Site Request Forgery via plugin_activation
Swatchly – Product Variation Swatches for WooCommerce≤1.2.0Update to 1.2.1
CVE-2023-23792—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
PixFields≤0.7.0No patch available
CVE-2022-46844—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WPMobile.App – Android and iOS App Builder≤11.20Update to 11.21
CVE-2023-28932—
Medium4.3Cross-Site Request Forgery via ctc_options_page()
Configurable Tag Cloud (CTC)≤5.2Update to 5.3
CVE-2023-28995—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Custom More Link Complete≤1.4.1No patch available
CVE-2023-23788—
Medium4.3Cross-Site Request Forgery via deleteRedirect()
Premmerce Redirect Manager≤1.0.10Update to 1.0.11
CVE-2023-23787—
Medium4.3Cross-Site Request Forgery via wtpsw_post_view_count
Trending/Popular Post Slider and Widget≤1.5.7Update to 1.5.8
CVE-2022-46846—
Medium4.3Authenticated (Contributor+) Sensitive Information Disclosure
Zippy≤1.6.1Update to 1.6.2
CVE-2023-26533—
Medium4.3Missing Authorization to Arbitrary Plugin Activation
Viral Mag≤1.0.9Update to 1.1.0
CVE-2023-28990—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Add to Cart Redirect for WooCommerce≤2.1.48Update to 2.1.49
CVE-2023-28988—
Medium6.4Authenticated(Author+) File Upload to Stored Cross-Site Scripting via SVG
External Media≤1.0.36No patch available
——
High7.2Unauthenticated Stored Cross-Site Scripting
Easy Quiz Maker≤1.5Update to 2.0
——
High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce≤4.9.3.3Update to 4.9.3.4
——
Medium5.3Cross-Site Request Forgery via plugin_activation()
JustTables – WooCommerce Product Table≤1.4.9Update to 1.5.0
CVE-2023-23803—
Medium4.3Cross-Site Request Forgery via plugin_activation()
WishSuite – Wishlist for WooCommerce≤1.3.3Update to 1.3.4
CVE-2023-23731—
Medium4.4Authenticated(Admin+) Stored Cross-Site Scripting via Plugin Settings
No CAPTCHA reCAPTCHA for WooCommerce≤1.2.6No patch available
——
Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display≤3.3.3Update to 3.3.4
CVE-2023-23786—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Premmerce Redirect Manager≤1.0.9Update to 1.0.12
CVE-2023-23789—
Medium5.5Authenticated (Administrator+) Cross-Site Scripting
Mega Main Menu≤2.2.2No patch available
CVE-2023-1575—
High8.8Cross-Site Request Forgery to Arbitrary File Modification (Creation/Overwrite/Deletion)
GMAce≤1.5.2No patch available
CVE-2023-1509—
Medium5.4Missing Authorization on openai_settings_option_callback
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media≤4.4.7Update to 4.4.8
—5K+
Medium4.3Cross-Site Request Forgery
WP Ultimate Review≤2.0.3Update to 2.1.0
CVE-2023-28987—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Ultimate Review≤2.0.3Update to 2.1.0
CVE-2023-28751—
Medium6.1Reflected Cross-Site Scripting
Easy Forms for Mailchimp≤6.8.7Update to 6.8.8
CVE-2023-1324—
Critical9.8Unauthenticated SQL Injection
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported)≤4.3.2Update to 4.3.3
CVE-2023-28662—

Search VulnCrest Radar

Jump to

Are you sure?