Database
WordPress Vulnerability Database (page 1207)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | Cross-Site Request Forgery | — | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2022-41685 | — | |
| High8.8 | Cross-Site Request Forgery to Sitemap Deletion/Creation | CVE-2022-36404 | — | |
| Medium5.5 | Authenticated (Administrator+) Stored Cross-Site Scripting | CVE-2022-3539 | — | |
| Medium6.1 | <= 3.5 - Reflected Cross-Site Scripting | — | — | |
| High8.8 | Cross-Site Request Forgery | — | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2022-3578 | — | |
| High7.2 | CSV Injection | CVE-2022-3574 | — | |
| Medium6.5 | Missing Authorization to Arbitrary Plugin Deactivation | CVE-2022-3538 | — | |
| Medium4.3 | Authenticated Information Disclosure via REST-API WordPress≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3 | — | — | |
| Medium6.4 | Authenticated Cross-Site Scripting in Various Blocks WordPress≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3 | CVE-2022-43500 | — | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting via Customizer WordPress≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3 | — | — | |
| Medium5.5 | Authenticated (Administrator+) Stored Cross-Site Scripting | CVE-2022-3469 | — | |
| Low3.7 | Information Disclosure (Multi-Part Email Leak) WordPress≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3 | — | — | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting | CVE-2022-3415 | — | |
| Medium5.3 | Information Disclosure (Email Address) WordPress≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3 | CVE-2022-43504 | — | |
| Medium5.5 | Authenticated (Editor+) Stored Cross-Site Scripting via Comments WordPress≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3 | — | — | |
| High8.8 | Cross-Site Request Forgery to Plugin Log Deletion | — | — | |
| High8.8 | Cross-Site Request Forgery via wp-trackback.php WordPress≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3 | — | — | |
| High7.2 | Stored Cross-Site Scripting via wp-mail.php WordPress≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3 | — | — | |
| High8.8 | Reflected Cross-Site Scripting via SQL Injection WordPress≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3 | CVE-2022-43497 | — | |
| Medium4.3 | Authenticated (Contributor+) Information Disclosure | CVE-2022-40696 | — | |
| Medium5.4 | Open Redirect WordPress≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3 | — | — | |
| Low3.7 | Shared User Instance Weakness WordPress≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3 | — | — | |
| Critical9.8 | SQL Injection via WP_Date_Query WordPress≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3 | — | — | |
| High7.1 | Missing Authorization | — | — | |
| Medium6.5 | Authenticated (Administrator+) Arbitrary File Upload | CVE-2022-3418 | — | |
| Medium6.5 | Missing Authorization | — | — | |
| High8.8 | Cross-Site Request Forgery to Arbitrary Post Deletion | CVE-2022-2387 | — | |
| Critical9.8 | Unauthenticated SQL Injection | CVE-2022-3481 | — |
- High8.8Cross-Site Request Forgery
Integration for Szamlazz.hu and WooCommerce
≤5.6.3.2Update to 5.6.3.3
- High8.8Cross-Site Request Forgery
Hungarian Pickup Points & Shipping Labels for WooCommerce
≤1.9.0.2Update to 1.9.0.3
- High8.8Cross-Site Request Forgery to Sitemap Deletion/Creation
Simple SEO
≤1.8.12Update to 1.8.13
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Super Testimonial – Testimonial & Customer Review Slider Plugin for WordPress
≤2.6Update to 2.7
- Medium6.1<= 3.5 - Reflected Cross-Site Scripting
LDD Directory Lite
≤3.5Update to 3.6
- High8.8Cross-Site Request Forgery
Wholesale Suite – B2B, Dynamic Pricing & WooCommerce Wholesale Prices
≤2.1.5Update to 2.1.5.1
- Medium6.1Reflected Cross-Site Scripting
ProfileGrid – User Profiles, Groups and Communities
≤5.1.0Update to 5.1.1
- High7.2CSV Injection
WPForms Pro
≤1.7.6Update to 1.7.7
- Medium6.5Missing Authorization to Arbitrary Plugin Deactivation
Webmaster Tools Verification
≤1.2No patch available
- Medium4.3Authenticated Information Disclosure via REST-API
WordPress
≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3
- Medium6.4Authenticated Cross-Site Scripting in Various Blocks
WordPress
≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via Customizer
WordPress
≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WP Attachments – Smarter File Management & Download Lists
≤5.0.4Update to 5.0.5
- Low3.7Information Disclosure (Multi-Part Email Leak)
WordPress
≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting
Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back
≤2.2Update to 2.3
- Medium5.3Information Disclosure (Email Address)
WordPress
≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3
- Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting via Comments
WordPress
≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3
- High8.8Cross-Site Request Forgery to Plugin Log Deletion
RD Station
≤5.1.3Update to 5.2.0
- High8.8Cross-Site Request Forgery via wp-trackback.php
WordPress
≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3
- High7.2Stored Cross-Site Scripting via wp-mail.php
WordPress
≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3
- High8.8Reflected Cross-Site Scripting via SQL Injection
WordPress
≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3
- Medium4.3Authenticated (Contributor+) Information Disclosure
Advanced Custom Fields (ACF®)
≤6.0.2Update to 6.0.3
- Medium5.4Open Redirect
WordPress
≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3
- Low3.7Shared User Instance Weakness
WordPress
≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3
- Critical9.8SQL Injection via WP_Date_Query
WordPress
≤6.0.2Update to 3.7.40 or 3.8.40 or 3.9.38 or 4.0.37 or 4.1.37 or 4.2.34 or 4.3.30 or 4.4.29 or 4.5.28 or 4.6.25 or 4.7.25 or 4.8.21 or 4.9.22 or 5.0.18 or 5.1.15 or 5.2.17 or 5.3.14 or 5.4.12 or 5.5.11 or 5.6.10 or 5.7.8 or 5.8.6 or 5.9.5 or 6.0.3
- High7.1Missing Authorization
Portfolio Gallery
≤1.0No patch available
- Medium6.5Authenticated (Administrator+) Arbitrary File Upload
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
≤3.6.8Update to 3.6.9
- Medium6.5Missing Authorization
Mihdan: Public Post Preview
≤1.9.9Update to 1.9.10
- High8.8Cross-Site Request Forgery to Arbitrary Post Deletion
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.11.7Update to 3.0
- Critical9.8Unauthenticated SQL Injection
WooCommerce Dropshipping Premium
≤4.3Update to 4.4