Database
WordPress Vulnerability Database (page 1264)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | Cross-Site Request Forgery | — | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| High8.8 | Cross-Site Request Forgery | — | — | |
| High8.8 | Missing Authorization to Arbitrary Plugin Deactivation/Activation | CVE-2022-23975 | — | |
| Medium4.8 | Authenticated Stored Cross-Site Scripting | CVE-2021-24904 | — | |
| Medium4.8 | Stored Cross-Site Scripting | CVE-2022-25606 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2022-0149 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-25077 | — | |
| Medium4.8 | Authenticated Cross-Site Scripting | CVE-2021-25029 | — | |
| Medium4.9 | Authenticated Arbitrary File Download | CVE-2021-25004 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2022-0148 | — | |
| Medium5.3 | Uncontrolled Resource Consumption | CVE-2022-21670 | — | |
| Medium4.7 | Reflected Cross-Site Scripting | CVE-2021-25103 | — | |
| Medium4.8 | Multiple Admin+ Stored Cross-Site Scripting | CVE-2021-25105 | — | |
| Critical9.8 | Unauthenticated SQL Injection Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions<2.6.7Update to 2.6.7 | CVE-2021-25114 | — | |
| High7.4 | SQL Injection via WP_Meta_Query WordPress<5.8.3Update to 4.1.34 or 4.2.31 or 4.3.27 or 4.4.26 or 4.5.25 or 4.6.22 or 4.7.22 or 4.8.18 or 4.9.19 or 5.0.15 or 5.1.12 or 5.2.14 or 5.3.11 or 5.4.9 or 5.5.8 or 5.6.7 or 5.7.5 or 5.8.3 | CVE-2022-21664 | — | |
| Medium5.3 | Ban Bypass | CVE-2021-25096 | — | |
| High7.1 | Subscriber+ Arbitrary Country Ban | CVE-2021-25095 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2021-24993 | — | |
| High8.0 | Authenticated (Author+) Stored Cross Site Scripting WordPress<5.8.3Update to 3.7.37 or 3.8.37 or 3.9.35 or 4.0.34 or 4.1.34 or 4.2.31 or 4.3.27 or 4.4.26 or 4.5.25 or 4.6.22 or 4.7.22 or 4.8.18 or 4.9.19 or 5.0.15 or 5.1.12 or 5.2.14 or 5.3.11 or 5.4.9 or 5.5.8 or 5.6.7 or 5.7.5 or 5.8.3 | CVE-2022-21662 | — | |
| High7.7 | Responsive Vector Maps <= 6.4.1 - Subscriber+ Arbitrary File Read | CVE-2021-24947 | — | |
| Medium6.6 | Super Admin Multi-Site Installation Object Injection WordPress<5.8.3Update to 3.7.37 or 3.8.37 or 3.9.35 or 4.0.34 or 4.1.34 or 4.2.31 or 4.3.27 or 4.4.26 or 4.5.25 or 4.6.22 or 4.7.22 or 4.8.18 or 4.9.19 or 5.0.15 or 5.1.12 or 5.2.14 or 5.3.11 or 5.4.9 or 5.5.8 or 5.6.7 or 5.7.5 or 5.8.3 | CVE-2022-21663 | — | |
| High7.1 | Arbitrary Country Ban via Cross-Site Request Forgery | CVE-2021-25108 | — | |
| Medium4.8 | Authenticated Stored Cross-Site Scripting | CVE-2022-23979 | — | |
| Medium5.4 | WPLegalPages <= 2.7.0 - Arbitrary Settings Update to Stored Cross-Site Scripting | CVE-2021-25106 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-24878 | — | |
| Medium4.4 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2022-23179 | — | |
| Medium6.5 | Subscriber+ SQL Injection | CVE-2021-24928 | — | |
| High7.5 | Unauthenticated Arbitrary Ticket Deletion | CVE-2021-24839 | — | |
| Medium6.1 | Cross-Site Request Forgery to Stored Cross-Site Scripting | CVE-2021-24879 | — |
- High8.8Cross-Site Request Forgery
Arrival
≤1.4.2Update to 1.4.3
- Medium6.1Reflected Cross-Site Scripting
Adaptive Images for WordPress
≤0.6.68Update to 0.6.69
- High8.8Cross-Site Request Forgery
Powerkit – Supercharge your WordPress Site
<2.5.9Update to 2.5.9
- High8.8Missing Authorization to Arbitrary Plugin Deactivation/Activation
Arrival
≤1.4.2Update to 1.4.3
- Medium4.8Authenticated Stored Cross-Site Scripting
Mortgage Calculators WP
<1.53Update to 1.53
- Medium4.8Stored Cross-Site Scripting
WP-DownloadManager
<1.68.7Update to 1.68.7
- Medium6.1Reflected Cross-Site Scripting
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
≤2.7Update to 2.7.1
- Medium6.1Reflected Cross-Site Scripting
Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools
<2.3.2Update to 2.3.2
- Medium4.8Authenticated Cross-Site Scripting
CLUEVO LMS, E-Learning Platform
<1.8.1Update to 1.8.1
- Medium4.9Authenticated Arbitrary File Download
SEUR Oficial
<1.7.2Update to 1.7.2
- Medium6.1Reflected Cross-Site Scripting
All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements
≤2.0.3Update to 2.0.4
- Medium5.3Uncontrolled Resource Consumption
Block for Apple Maps
1.0.3 – 1.0.3Update to 1.1.0
- Medium4.7Reflected Cross-Site Scripting
Translate WordPress with GTranslate
<2.9.7Update to 2.9.7
- Medium4.8Multiple Admin+ Stored Cross-Site Scripting
Ivory Search – WordPress Search Plugin
≤5.4Update to 5.4.1
- Critical9.8Unauthenticated SQL Injection
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
<2.6.7Update to 2.6.7
- High7.4SQL Injection via WP_Meta_Query
WordPress
<5.8.3Update to 4.1.34 or 4.2.31 or 4.3.27 or 4.4.26 or 4.5.25 or 4.6.22 or 4.7.22 or 4.8.18 or 4.9.19 or 5.0.15 or 5.1.12 or 5.2.14 or 5.3.11 or 5.4.9 or 5.5.8 or 5.6.7 or 5.7.5 or 5.8.3
- Medium5.3Ban Bypass
IP2Location Country Blocker
≤2.26.4Update to 2.26.5
- High7.1Subscriber+ Arbitrary Country Ban
IP2Location Country Blocker
≤2.26.4Update to 2.26.5
- Medium6.5Cross-Site Request Forgery
Ultimate Product Catalog
<5.0.26Update to 5.0.26
- High8.0Authenticated (Author+) Stored Cross Site Scripting
WordPress
<5.8.3Update to 3.7.37 or 3.8.37 or 3.9.35 or 4.0.34 or 4.1.34 or 4.2.31 or 4.3.27 or 4.4.26 or 4.5.25 or 4.6.22 or 4.7.22 or 4.8.18 or 4.9.19 or 5.0.15 or 5.1.12 or 5.2.14 or 5.3.11 or 5.4.9 or 5.5.8 or 5.6.7 or 5.7.5 or 5.8.3
- High7.7Responsive Vector Maps <= 6.4.1 - Subscriber+ Arbitrary File Read
RVM – Responsive Vector Maps
≤6.4.1Update to 6.4.2
- Medium6.6Super Admin Multi-Site Installation Object Injection
WordPress
<5.8.3Update to 3.7.37 or 3.8.37 or 3.9.35 or 4.0.34 or 4.1.34 or 4.2.31 or 4.3.27 or 4.4.26 or 4.5.25 or 4.6.22 or 4.7.22 or 4.8.18 or 4.9.19 or 5.0.15 or 5.1.12 or 5.2.14 or 5.3.11 or 5.4.9 or 5.5.8 or 5.6.7 or 5.7.5 or 5.8.3
- High7.1Arbitrary Country Ban via Cross-Site Request Forgery
IP2Location Country Blocker
≤2.26.5Update to 2.26.6
- Medium4.8Authenticated Stored Cross-Site Scripting
Ultimate Reviews
≤3.0.15Update to 3.0.16
- Medium5.4WPLegalPages <= 2.7.0 - Arbitrary Settings Update to Stored Cross-Site Scripting
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages
<2.7.1Update to 2.7.1
- Medium6.1Reflected Cross-Site Scripting
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
≤2.2.6Update to 2.2.7
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Lead Form Builder & Contact Form
<1.7.0Update to 1.7.0
- Medium6.5Subscriber+ SQL Injection
Rearrange Products for WooCommerce
<3.0.8Update to 3.0.8
- High7.5Unauthenticated Arbitrary Ticket Deletion
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
≤2.2.4Update to 2.2.5
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
<2.2.7Update to 2.2.7