VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1163)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1163)
SeverityVulnerabilityCVEInstallsPublished
Medium5.4Cross-Site Request Forgery via handleSubmitAction function
Advanced Dynamic Pricing and Discount Rules for WooCommerce≤4.1.5Update to 4.1.6
——
Medium4.3Cross-Site Request Forgery via migrateProductOnlyToCommon function
Advanced Dynamic Pricing and Discount Rules for WooCommerce≤4.1.5Update to 4.1.6
——
Medium4.3Missing Authorization in ajaxCalculateSeveralProducts function
Advanced Dynamic Pricing and Discount Rules for WooCommerce≤4.1.5Update to 4.1.6
CVE-2022-40203—
Medium4.3Missing Authorization in migrateCommonToProductOnly function
Advanced Dynamic Pricing and Discount Rules for WooCommerce≤4.1.5Update to 4.1.6
——
Medium6.3Missing Authorization
vSlider Multi Image Slider for WordPress≤4.1.2No patch available
——
Medium5.4Cross-Site Request Forgery leading to Form Metadata Deletion
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login≤5.1.9.2Update to 5.1.9.3
CVE-2023-25991—
High7.2Authenticated (Administrator+) SQL Injection
Media Library Assistant≤3.05Update to 3.06
CVE-2023-0279—
Medium5.4Cross-Site Request Forgery to Settings Update
Protected Posts Logout Button≤1.4.4Update to 1.4.5
——
Medium6.5Missing Authorization on pplb_options_save
Protected Posts Logout Button≤1.4.5Update to 1.4.6
CVE-2023-25454—
Medium5.3Unauthenticated Arbitrary Content Injection
Woodmart≤7.0.4Update to 7.1.1
CVE-2023-25790—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Campaign URL Builder≤1.8.1Update to 1.8.2
CVE-2023-0538—
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Nooz≤1.6.0Update to 1.7.0
CVE-2023-25794—
Medium4.3Cross-Site Request Forgery in exec_admin_widget function
VikBooking Hotel Booking Engine & PMS≤1.5.12Update to 1.6.0
——
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Open Social≤5.0No patch available
CVE-2023-25792—
Medium6.4Authenticated (Contributor+) Cross Site Scripting
Quick PayPal Payments: Payment Button & Form≤5.7.25Update to 5.7.26
CVE-2023-23889—
Medium4.3Cross-Site Request Forgery in widgets_watch_data function
VikBooking Hotel Booking Engine & PMS≤1.5.12Update to 1.6.0
——
Medium5.4Cross-Site Request Forgery in savetranslation function
VikBooking Hotel Booking Engine & PMS≤1.5.12Update to 1.6.0
——
Medium4.4Authenticated (Contributor+) Stored Cross-Site Scripting
Social Login, Social Sharing by miniOrange≤7.5.14Update to 7.6.0
CVE-2023-23710—
Medium5.4Cross-Site Request Forgery via process_form function
Podlove Subscribe button≤1.3.7Update to 1.3.9
——
Medium5.4Cross-Site Request Forgery via save function
Podlove Subscribe button≤1.3.7Update to 1.3.9
CVE-2023-25481—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Service Area Postcode Checker≤2.0.8No patch available
CVE-2023-25782—
Medium5.4Cross-Site Request Forgery in savetranslationstay function
VikBooking Hotel Booking Engine & PMS≤1.5.12Update to 1.6.0
——
Medium4.3Cross-Site Request Forgery in exec_multitask_widgets function
VikBooking Hotel Booking Engine & PMS≤1.5.12Update to 1.6.0
——
Medium4.3Cross-Site Request Forgery via admin_options
Wallet for WooCommerce≤1.3.24Update to 1.4.0
CVE-2022-40198—
Medium5.3Cross-Site Request Forgery in save_admin_widgets function
VikBooking Hotel Booking Engine & PMS≤1.5.12Update to 1.6.0
CVE-2023-25707—
Medium4.4Wp-Insert <= 2.5.0 Authenticated (Admin+) Stored Cross Site Scripting
Wp-Insert≤2.5.0Update to 2.5.1
CVE-2023-25461—
Medium5.4Cross-Site Request Forgery
Meta Slider and Carousel with Lightbox≤1.6.2Update to 1.7
CVE-2023-25703—
High8.8Cross-Site Request Forgery
Social Login, Social Sharing by miniOrange≤7.5.14Update to 7.5.15
CVE-2023-23706—
Medium6.4Authenticated (Contributor+) Stored Cross Site Scripting
Ultimate WP Query Search Filter≤1.0.10No patch available
CVE-2023-23832—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Upload File Type Settings Plugin≤1.1No patch available
CVE-2023-25781—

Search VulnCrest Radar

Jump to

Are you sure?