VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1153)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1153)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Cross-Site Request Forgery to Cross-Site Scripting via render_dropdown
GiveWP – Donation Plugin and Fundraising Platform≤2.25.1Update to 2.25.2
——
Medium5.4Cross-Site Request Forgery via plugin_activation
HT Easy GA4 – Google Analytics WordPress Plugin≤1.0.6Update to 1.0.7
CVE-2023-23802—
Medium4.1Authenticated (Admin+) Server-Side Request Forgery via give_get_content_by_ajax_handler
GiveWP – Donation Plugin and Fundraising Platform≤2.25.1Update to 2.25.2
CVE-2022-40312—
Medium6.1Reflected Cross-Site Scripting via 'replytocom'
Webmention≤4.0.8Update to 4.0.9
——
Medium5.3Information Disclosure via updraft_ajaxrestore
UpdraftPlus Premium≤1.22.24Update to 1.23.1
——
Medium4.3Cross-Site Request Forgery via wp_ajax_tifm_save_decision
Clone≤2.3.7Update to 2.3.8
——
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Image Over Image For WPBakery Page Builder<3.0Update to 3.0
CVE-2023-0399—
Medium5.3Information Exposure
CMP – Coming Soon & Maintenance Plugin by NiteoThemes≤4.1.6Update to 4.1.7
CVE-2023-1263—
High7.1Missing Authorization in 'create_mollie_profile'
Paytium: Mollie payment forms & donations≤4.3.7Update to 4.4
CVE-2023-7294—
Medium4.3Missing Authorization in 'check_mollie_account_details'
Paytium: Mollie payment forms & donations≤4.3.7Update to 4.4
CVE-2023-7293—
Medium5.4Missing Authorization in 'pt_cancel_subscription'
Paytium: Mollie payment forms & donations≤4.3.7Update to 4.4
CVE-2023-7287—
Medium4.3Missing Authorization in 'paytium_notice_dismiss'
Paytium: Mollie payment forms & donations≤4.3.7Update to 4.4
CVE-2023-7292—
High8.8Authenticated (Subscriber+) Local File Inclusion via 'style'
Dark Mode – Improve Accessibility with AI Powered Dark Theme≤4.0.7Update to 4.0.8
CVE-2023-0467—
High7.1Missing Authorization in 'create_mollie_account'
Paytium: Mollie payment forms & donations≤4.3.7Update to 4.4
CVE-2023-7291—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'cookies_revoke_shortcode' Shortcode
Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA≤2.4.6Update to 2.4.7
CVE-2023-0823—
Medium5.4Missing Authorization in 'paytium_sw_save_api_keys'
Paytium: Mollie payment forms & donations≤4.3.7Update to 4.4
CVE-2023-7289—
Medium4.3Missing Authorization in 'check_for_verified_profiles'
Paytium: Mollie payment forms & donations≤4.3.7Update to 4.4
CVE-2023-7290—
Medium5.3IP Spoofing via HTTP header
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder≤6.0.1Update to 6.1
CVE-2023-0816—
High8.8Authenticated (Subscriber+) Privilege Escalation
WP Membership<1.5.7Update to 1.5.7
CVE-2020-36666—
Medium6.4GDPR/CCPA Cookie Consent <= 6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Complianz GDPR/CCPA Cookie Consent Banner≤6.4.1Update to 6.4.2
CVE-2023-1069—
Medium5.4Missing Authorization in 'update_profile_preference'
Paytium: Mollie payment forms & donations≤4.3.7Update to 4.4
CVE-2023-7288—
High7.2Authenticated (Admin+) SQL Injection
WP Statistics – Simple, privacy-friendly Google Analytics alternative≤13.2.16Update to 14.0
CVE-2023-0955—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation≤5.4.4Update to 5.5.0
CVE-2023-27429—
Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
Big Store≤1.9.3Update to 1.9.4
CVE-2023-27431—
Medium5.3Feature Bypass
Event Espresso – Event Registration & Ticketing Sales≤4.10.44.decafUpdate to 4.10.45.decaf
CVE-2023-27437—
Medium4.3Cross-Site Request Forgery via get_settings_page
DecaLog≤3.7.0Update to 3.7.1
CVE-2023-27444—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
FareHarbor for WordPress≤3.6.6Update to 3.6.7
CVE-2023-25021—
Low3.8Authenticated (Author+) Stored Cross-Site Scripting via Email Logs
FluentSMTP – WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP≤2.2.2Update to 2.2.3
CVE-2023-0219—
Medium4.3Cross-Site Request Forgery
Resize at Upload Plus≤1.3No patch available
CVE-2023-25467—
Medium4.3Cross-Site Request Forgery
TotalPoll for Polls and Contests≤4.8.6Update to 4.8.7
CVE-2023-27449—

Search VulnCrest Radar

Jump to

Are you sure?