VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1187)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,165 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1187)
SeverityVulnerabilityCVEInstallsPublished
High7.2Authenticated (Administrator+) PHP Object Injection
Analyticator≤6.5.5Update to 6.5.6
CVE-2022-3425—
Medium6.5IP Spoofing to Protection Mechanism Bypass
WP Limit Login Attempts≤2.6.4No patch available
CVE-2022-4303—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Sitemap≤4.3Update to 4.4
CVE-2022-4545—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Compact WP Audio Player≤1.9.7Update to 1.9.8
CVE-2022-4542—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Login Logout Menu≤1.3.3Update to 1.4.0
CVE-2022-4625—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Mongoose Page Plugin≤1.8.3Update to 1.9.0
CVE-2022-4675—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Page-list≤5.2Update to 5.3
CVE-2022-4485—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Easy Social Feed – All In One Social Feed Plugin for WordPress≤6.3.9Update to 6.4.0
CVE-2022-4474—
High7.2Authenticated (Admin+) SQL Injection
WP Statistics – Simple, privacy-friendly Google Analytics alternative≤13.2.8Update to 13.2.9
CVE-2022-4230—
Critical9.8Unauthenticated SQL Injection
CBX Petition≤1.0.3Update to 2.0.0
CVE-2022-4383—
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
EU Cookie Law for GDPR/CCPA≤3.1.6No patch available
CVE-2022-3811—
Medium6.4Authenticated (Contributor+) Cross-Site Scripting via Shortcode
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages≤1.4.9.8.9Update to 1.4.9.9
CVE-2022-4718—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Easy Appointments≤3.10.7Update to 3.11.0
CVE-2022-4668—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Simple Shopping Cart≤4.6.1Update to 4.6.2
CVE-2022-4672—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Rate My Post – Star Rating Plugin by FeedbackWP≤3.3.8Update to 3.3.9
CVE-2022-4673—
Medium6.5IP Spoofing to Protection Mechanism Bypass
FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login≤1.0.1Update to 1.0.2
CVE-2022-4746—
High7.2Unauthenticated Stored Cross-Site Scripting
پلاگین پرداخت دلخواه≤2.9.2Update to 2.9.3
CVE-2022-4307—
Critical9.8UPG <= 2.19 - Missing Authorization to Remote Command Execution
User Post Gallery – UPG2.19 – 2.19No patch available
CVE-2022-4060—
High7.2Authenticated (Admin+) SQL Injection
Conditional Payment Methods for WooCommerce≤1.0No patch available
CVE-2022-4547—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Agile Store Locator≤1.4.8Update to 1.4.9
CVE-2022-4832—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Easy Bootstrap Shortcode≤4.5.4No patch available
CVE-2022-4576—
Medium5.4Missing Authorization
Events Made Easy≤2.3.16Update to 2.3.17
CVE-2023-0404—
Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content≤4.5.0Update to 4.5.1
CVE-2022-4697—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Kit (formerly ConvertKit) – Email Subscribers, Email Newsletter, Email Marketing, Landing Pages and Membership≤2.0.4Update to 2.0.5
CVE-2022-4508—
High7.2Authenticated (Admin+) SQL Injection
Formidable PRO2PDF≤3.09Update to 3.10
CVE-2023-28663—
Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting via Form Settings
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content≤4.5.0Update to 4.5.1
CVE-2022-4698—
Medium5.4Unauthenticated Stored Cross-Site Scripting via Google Analytics
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)≤8.9.0Update to 8.9.1
CVE-2022-3904—
Medium5.5Authenticated (Administrator+) Cross-Site Scripting
Waiting: One-click countdowns≤0.6.2No patch available
CVE-2022-4954—
Medium6.3Missing Authorization
Waiting: One-click countdowns≤0.6.2No patch available
CVE-2023-3999—
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Spell Check≤9.12Update to 9.13
CVE-2022-2658—

Search VulnCrest Radar

Jump to

Are you sure?