VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1156)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1156)
SeverityVulnerabilityCVEInstallsPublished
Medium4.3Cross-Site Request Forgery to Feedback Submission
WP Time Slots Booking Form≤1.1.76Update to 1.1.77
——
Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
Ever Compare – Products Compare Plugin for WooCommerce≤1.2.3Update to 1.2.4
CVE-2023-0505—
Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
WP Education – Education WordPress Plugin for Elementor≤1.2.6Update to 1.2.7
CVE-2023-0498—
Medium4.3Missing Authorization to Feedback Submission
WP Time Slots Booking Form≤1.1.76Update to 1.1.77
CVE-2022-41790—
Medium4.3Missing Authorization to Feedback Submission
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More≤1.1.120Update to 1.1.121
——
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scritping
WP No External Links≤1.0.2No patch available
CVE-2023-26537—
Medium4.3Cross-Site Request Forgery to Plugin Settings Changes
Dynamic XML Sitemaps Generator for Google≤1.3.3Update to 1.3.4
CVE-2023-26514—
Medium5.3Missing Authorization
WP Repost≤0.1No patch available
CVE-2023-26522—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Simple File List≤6.0.9Update to 6.0.10
CVE-2023-1025—
Medium4.3Cross-Site Request Forgery to Plugins Options Changes
Rus-To-Lat≤0.3No patch available
CVE-2023-25470—
Medium4.3Missing Authorization leading to Authenticated (Subscriber+) Attachment Deletion
OoohBoi Steroids for Elementor≤2.1.3Update to 2.1.5
CVE-2023-0336—
Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
QuickSwish – WooCommerce Product Quick View≤1.0.9Update to 1.1.0
CVE-2023-0499—
Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
WP Film Studio – WordPress Movie Maker/Production Plugin≤1.3.4Update to 1.3.5
CVE-2023-0500—
Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
HT Contact Form – Drag & Drop Form Builder for WordPress≤1.1.5Update to 1.1.6
CVE-2023-0484—
High8.8Cross-Site Request Forgery via imlt_create_admin
Debug Assistant≤1.4Update to 1.5
CVE-2023-26516—
Medium4.3Cross-Site Request Forgery leading to Arbitrary Plugin Activation
WP Insurance – WordPress Insurance Service Plugin≤2.1.3Update to 2.1.4
CVE-2023-0501—
Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
WP Plugin Manager – Deactivate plugins per page≤1.1.7Update to 1.1.8
CVE-2023-1088—
Medium4.3Cross-Site Request Forgery via processAjaxNoticeDismiss
WP Meteor Website Speed Optimization Addon≤3.1.4Update to 3.1.5
CVE-2023-26543—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scritping
WP Repost≤0.1No patch available
CVE-2023-26534—
Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
HT Portfolio – WordPress Portfolio Plugin for Elementor≤1.1.5Update to 1.1.6
CVE-2023-0497—
Medium5.3Missing Authorization via atw_dismiss_admin_notice
Advanced Text Widget≤2.1.2No patch available
CVE-2023-26520—
Medium4.3Cross-Site Request Forgery leading to Arbitrary Plugin Activation
Free WooCommerce Theme 99fy Extension≤1.2.7Update to 1.2.8
CVE-2023-0503—
Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
WC Sales Notification≤1.2.2Update to 1.2.3
CVE-2023-1087—
Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
Preview Link Generator≤1.0.3Update to 1.0.4
CVE-2023-1086—
Medium4.3Cross-Site Request Forgery leading to Arbitrary Plugin Activation
HT Politic – For Political WordPress Themes / Website≤2.3.7Update to 2.3.8
CVE-2023-0504—
Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
WP News – WordPress News / Magazine Plugin≤1.1.9Update to 1.2.0
CVE-2023-0502—
Medium4.3Missing Authorization to Feedback Submission
Search in Place≤1.0.104Update to 1.0.105
——
Medium6.4Ultimate Form Builder <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
NEX-Forms – Ultimate Forms Plugin for WordPress≤8.3.2Update to 8.3.3
CVE-2023-0272—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Debug Assistant≤1.4Update to 1.5
CVE-2023-26527—
Medium4.3Cross-Site Request Forgery via 'delete' in mooauth_client_applist_page
OAuth Single Sign On – SSO (OAuth Client)≤6.24.1Update to 6.24.2
CVE-2023-1092—

Search VulnCrest Radar

Jump to

Are you sure?