Database
WordPress Vulnerability Database (page 1254)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.5 | Admin+ Stored Cross-Site Scripting | CVE-2022-0840 | — | |
| Medium5.3 | Sensitive Data Disclosure | CVE-2022-0919 | — | |
| High7.2 | SQL Injection | CVE-2022-25607 | — | |
| Critical9.8 | Prototype Pollution | — | — | |
| Medium4.4 | Authenticated (Administrator+) Stored Cross-Site Scripting via 'publish_terms_text' | CVE-2023-0422 | — | |
| Medium6.3 | Missing Authorization Checks | CVE-2022-25602 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2022-0271 | — | |
| Critical9.8 | SQL Injection | CVE-2022-0949 | — | |
| Medium6.8 | Admin+ Arbitrary File Deletion via Zip Slip | CVE-2022-0246 | — | |
| High7.5 | Unauthenticated Brute Force of File Master Key | CVE-2022-0828 | — | |
| Medium5.4 | Subscriber+ Stored Cross-Site Scripting | CVE-2021-25090 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2022-0447 | — | |
| High7.5 | Abuse of Functionality | CVE-2022-0989 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2021-24986 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-24746 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-24987 | — | |
| Medium6.0 | Admin+ File Upload to Remote Code Execution | CVE-2022-0537 | — | |
| Medium4.8 | Admin+ Stored Cross-Site Scripting | CVE-2022-0958 | — | |
| Medium5.4 | Arbitrary Booking Update and Sensitive Data Exposure | CVE-2022-0825 | — | |
| Medium6.4 | Cross-Site Request Forgery to Stored Cross-Site Scripting | CVE-2021-25113 | — | |
| Medium6.4 | Information Disclosure and SMS Spam | CVE-2022-0837 | — | |
| High8.8 | Subscriber+ Arbitrary File Creation/Upload/Deletion | CVE-2022-0403 | — | |
| High8.5 | Authenticated Arbitrary Profile Creation and Stored Cross-Site Scripting | CVE-2021-25048 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| High8.8 | jQuery Prototype Pollution WordPress≤5.9.1Update to 3.7.38 or 3.8.38 or 3.9.36 or 4.0.35 or 4.1.35 or 4.2.32 or 4.3.28 or 4.4.27 or 4.5.26 or 4.6.23 or 4.7.23 or 4.8.19 or 4.9.20 or 5.0.16 or 5.1.13 or 5.2.15 or 5.3.12 or 5.4.10 or 5.5.9 or 5.6.8 or 5.7.6 or 5.8.4 or 5.9.2 | CVE-2021-20083 | — | |
| Medium6.4 | 5.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | — | — | |
| Medium6.5 | Missing Authorization to Arbitrary Settings Update | CVE-2022-0404 | — | |
| Medium5.4 | Prototype Pollution via Block Editor WordPress≤5.9.1Update to 3.7.38 or 3.8.38 or 3.9.36 or 4.0.35 or 4.1.35 or 4.2.32 or 4.3.28 or 4.4.27 or 4.5.26 or 4.6.23 or 4.7.23 or 4.8.19 or 4.9.20 or 5.0.16 or 5.1.13 or 5.2.15 or 5.3.12 or 5.4.10 or 5.5.9 or 5.6.8 or 5.7.6 or 5.8.4 or 5.9.2 | — | — | |
| Medium4.3 | Unauthorized Order Status Change WooCommerce<6.3.1Update to 3.5.10 or 3.6.7 or 3.7.3 or 3.8.3 or 3.9.5 or 4.0.4 or 4.1.4 or 4.2.5 or 4.3.6 or 4.4.4 or 4.5.5 or 4.6.5 or 4.7.4 or 4.8.3 or 4.9.5 or 5.0.3 or 5.1.3 or 5.2.5 or 5.3.3 or 5.4.4 or 5.5.4 or 5.6.2 or 5.7.2 or 5.8.1 or 5.9.1 or 6.0.1 or 6.1.2 or 6.2.2 or 6.3.1 | — | — | |
| High7.5 | Unauthenticated Sensitive Data Disclosure | CVE-2022-0709 | — |
- Medium5.5Admin+ Stored Cross-Site Scripting
Easy Social Icons
<3.2.1Update to 3.2.1
- Medium5.3Sensitive Data Disclosure
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤7.6.2Update to 7.6.3
- High7.2SQL Injection
FV Flowplayer Video Player
≤7.5.15.727Update to 7.5.18.727
- Critical9.8Prototype Pollution
Insert Special Characters
≤1.0.4Update to 1.0.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'publish_terms_text'
Article Directory
≤1.3No patch available
- Medium6.3Missing Authorization Checks
Responsive Menu – Mobile Menu & Hamburger Menu Builder
<4.1.8Update to 4.1.8
- Medium6.1Reflected Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
<4.1.6Update to 4.1.6
- Critical9.8SQL Injection
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
<6.930Update to 6.930
- Medium6.8Admin+ Arbitrary File Deletion via Zip Slip
iQ Block Country
<1.2.13Update to 1.2.13
- High7.5Unauthenticated Brute Force of File Master Key
Download Manager
<3.2.39Update to 3.2.39
- Medium5.4Subscriber+ Stored Cross-Site Scripting
Portfolio, Gallery, Product Catalog – Grid KIT Portfolio
<2.1.0Update to 2.1.0
- Medium6.1Reflected Cross-Site Scripting
Post Grid
<2.1.16Update to 2.1.16
- High7.5Abuse of Functionality
NS Watermark For WooCommerce
≤2.11.3Update to 3.0.0
- Medium6.1Cross-Site Scripting
Post Grid
<2.1.16Update to 2.1.16
- Medium6.1Reflected Cross-Site Scripting
Social Sharing Plugin – Sassy Social Share
<3.3.40Update to 3.3.40
- Medium6.1Reflected Cross-Site Scripting
Social Share, Social Login and Social Comments Plugin – Super Socializer
<7.13.30Update to 7.13.30
- Medium6.0Admin+ File Upload to Remote Code Execution
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
<2.73.13Update to 2.73.13
- Medium4.8Admin+ Stored Cross-Site Scripting
Mark Posts
<2.0.1Update to 2.0.1
- Medium5.4Arbitrary Booking Update and Sensitive Data Exposure
Booking for Appointments and Events Calendar – Amelia
<1.0.49Update to 1.0.49
- Medium6.4Cross-Site Request Forgery to Stored Cross-Site Scripting
Dropdown Menu Widget
≤1.9.7No patch available
- Medium6.4Information Disclosure and SMS Spam
Booking for Appointments and Events Calendar – Amelia
<1.0.48Update to 1.0.48
- High8.8Subscriber+ Arbitrary File Creation/Upload/Deletion
File Manager
≤5.2.2Update to 5.2.3
- High8.5Authenticated Arbitrary Profile Creation and Stored Cross-Site Scripting
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.9.6No patch available
- Medium6.1Reflected Cross-Site Scripting
Members List Plugin
≤4.3.6Update to 4.3.7
- High8.8jQuery Prototype Pollution
WordPress
≤5.9.1Update to 3.7.38 or 3.8.38 or 3.9.36 or 4.0.35 or 4.1.35 or 4.2.32 or 4.3.28 or 4.4.27 or 4.5.26 or 4.6.23 or 4.7.23 or 4.8.19 or 4.9.20 or 5.0.16 or 5.1.13 or 5.2.15 or 5.3.12 or 5.4.10 or 5.5.9 or 5.6.8 or 5.7.6 or 5.8.4 or 5.9.2
- Medium6.45.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
WordPress
5.9 – <5.9.2Update to 5.9.2
- Medium6.5Missing Authorization to Arbitrary Settings Update
Material Design for Contact Form 7
≤2.6.4No patch available
- Medium5.4Prototype Pollution via Block Editor
WordPress
≤5.9.1Update to 3.7.38 or 3.8.38 or 3.9.36 or 4.0.35 or 4.1.35 or 4.2.32 or 4.3.28 or 4.4.27 or 4.5.26 or 4.6.23 or 4.7.23 or 4.8.19 or 4.9.20 or 5.0.16 or 5.1.13 or 5.2.15 or 5.3.12 or 5.4.10 or 5.5.9 or 5.6.8 or 5.7.6 or 5.8.4 or 5.9.2
- Medium4.3Unauthorized Order Status Change
WooCommerce
<6.3.1Update to 3.5.10 or 3.6.7 or 3.7.3 or 3.8.3 or 3.9.5 or 4.0.4 or 4.1.4 or 4.2.5 or 4.3.6 or 4.4.4 or 4.5.5 or 4.6.5 or 4.7.4 or 4.8.3 or 4.9.5 or 5.0.3 or 5.1.3 or 5.2.5 or 5.3.3 or 5.4.4 or 5.5.4 or 5.6.2 or 5.7.2 or 5.8.1 or 5.9.1 or 6.0.1 or 6.1.2 or 6.2.2 or 6.3.1
- High7.5Unauthenticated Sensitive Data Disclosure
Booking Package
<1.5.29Update to 1.5.29