VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1145)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1145)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Reflected Cross-Site Scripting via search_term, order_by and order_pos
Image Ticker & Logo Slider – Continuous Auto-Scroll Carousel with Lightbox≤1.0.15Update to 1.0.16
CVE-2023-28792—
High7.2Authenticated (Administrator+) SQL Injection
WC Fields Factory≤4.1.5Update to 4.1.6
CVE-2023-0277—
Medium6.1Reflected Cross-Site Scripting via search_term, order_by and order_pos
Image Ticker & Logo Slider – Continuous Auto-Scroll Carousel with Lightbox≤1.0.15Update to 1.0.16
CVE-2023-28776—
Critical9.8Unauthenticated SQL Injection
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup≤3.4.11Update to 4.0
CVE-2022-46808—
Medium6.1Reflected Cross-Site Scripting
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe≤21.1.2Update to 21.1.2.1
CVE-2023-28784—
High8.8Authenticated (Author+) SQL Injection
Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress≤4.6.9Update to 4.7.0
CVE-2023-0765—
High8.8Authenticated(Subscriber+) Privilege Escalation via tf_numb_save_licenses
Themeflection Numbers – Number Counter and Animated Numbers≤1.8.1Update to 2.0.1
CVE-2023-0889—
Medium5.4Missing Authorization via resAdminPermissionsCheck
FileBird – WordPress Media Library Folders & File Manager≤5.1.4Update to 5.1.5
CVE-2023-25966—
Medium4.7Reflected Cross-Site Scripting
Newsletter – Send awesome emails from WordPress≤7.6.8Update to 7.6.9
CVE-2023-27922—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Pagination by BestWebSoft – Customizable WordPress Content Splitter and Navigation Plugin≤1.2.2Update to 1.2.3
CVE-2023-28778—
High7.2Unauthenticated Stored Cross-Site Scripting
Contact Forms by Cimatti≤1.5.4Update to 1.5.5
CVE-2023-28781—
Medium6.1Reflected Cross-Site Scripting via 'form-field-id', 'edit-fid', 'id', 'name', 'type', 'description' Parameters
Contact Forms by Cimatti≤1.5.4Update to 1.5.5
CVE-2023-28789—
Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress≤4.6.9Update to 4.7.0
CVE-2023-0764—
High8.8Authenticated (Author+) PHAR Deserialization
WP Meta SEO≤4.5.4Update to 4.5.5
CVE-2023-1381—
Medium6.1Reflected Cross-Site Scripting via 'Errore'
Albo Pretorio On line≤4.6Update to 4.6.1
CVE-2023-28750—
High8.8Authenticated (Contributor+) SQL Injection
Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress≤6.4.2Update to 6.4.2.1
CVE-2023-28788—
High7.2Unauthenticated Cross-Site Scripting
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content≤4.5.3Update to 4.5.4
CVE-2022-47444—
Medium4.3Cross-Site Request Forgery
ThemeHunk – Side Cart, Ajax Cart & Menu Cart for WooCommerce≤1.1.1Update to 1.1.2
——
Medium5.3Cross-Site Request Forgery via give_ajax_delete_payment_note
GiveWP – Donation Plugin and Fundraising Platform≤2.25.2Update to 2.25.3
——
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Pagination by BestWebSoft – Customizable WordPress Content Splitter and Navigation Plugin≤1.2.2Update to 1.2.3
——
Critical9.85.6.1 Authentication Bypass and Privilege Escalation
WooPayments: Integrated WooCommerce Payments4.8.0 – 5.6.1Update to 5.6.2
CVE-2023-28121—
Medium4.3Cross-Site Request Forgery
GiveWP – Donation Plugin and Fundraising Platform≤2.25.2Update to 2.25.3
——
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress≤4.6.9Update to 4.7.0
——
Medium5.3Cross-Site Request Forgery via give_ajax_store_payment_note
GiveWP – Donation Plugin and Fundraising Platform≤2.25.2Update to 2.25.3
——
High7.2Cross-Site Scripting Bypass
Safe SVG≤2.0.3Update to 2.1.0
CVE-2023-28426—
Medium6.1Reflected Cross-Site Scripting
Bulk Price Update for Woocommerce≤2.2.1Update to 2.2.2
CVE-2023-28665—
Medium4.3Cross-Site Request Forgery via send_email
Thanko Thank You Page Customizer for WooCommerce≤1.0.13Update to 1.0.14
CVE-2022-46812—
Medium6.1Unauthenticated Cross-Site Scripting
WooCommerce JazzCash Gateway Plugin≤2.0No patch available
CVE-2022-46822—
Medium4.3Cross-Site Request Forgery
Stock Sync for WooCommerce≤2.3.2Update to 2.4.0
——
Medium4.3Missing Authorization to Toggle Crawler State
LiteSpeed Cache≤5.3Update to 5.3.1
CVE-2022-46800—

Search VulnCrest Radar

Jump to

Are you sure?