Database
WordPress Vulnerability Database (page 1326)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium4.3 | Cross-Site Request Forgery Bypass | CVE-2021-4421 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| Medium6.4 | Authenticated Stored Cross-Site Scripting | CVE-2020-26672 | — | |
| Medium6.1 | Directory Listing <= 1.2 - Reflected Cross-Site Scripting | — | — | |
| High7.1 | Cross-Site Scripting | — | — | |
| Medium6.4 | Directory Listing WordPress Theme < 1.1.15 - Cross-Site Scripting | — | — | |
| Medium5.4 | Real Estate WordPress Theme <= 1.4 - Insecure Direct Object Reference | — | — | |
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| Medium6.1 | Cross-Site Scripting | — | — | |
| Critical9.8 | Real Estate WordPress Theme <= 1.7 - SQL Injection | CVE-2020-15363 | — | |
| Medium6.1 | Real Estate WordPress Theme < 1.8 - Cross-Site Scripting | CVE-2020-15364 | — | |
| Medium6.1 | Stored Cross-Site Scripting | — | — | |
| Medium6.5 | All Comments Deletion via Cross-Site Request Forgery | CVE-2020-36505 | — | |
| High8.8 | Cross-Site Request Forgery | — | — | |
| High8.8 | Arbitrary File Upload | CVE-2020-36701 | — | |
| High8.8 | Authorization Bypass due to Improper Access Control | CVE-2020-36700 | — | |
| Critical9.8 | wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter | CVE-2020-13640 | — | |
| Medium5.3 | Comment Disclosure WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-25286 | — | |
| Low2.4 | Self-Cross Site Scripting via Theme Folder Name WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4049 | — | |
| Low3.5 | Arbitrary User Meta Update WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4050 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2020-36172 | — | |
| Medium6.8 | Authenticated Stored Cross-Site Scripting WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4047 | — | |
| Medium5.7 | Open Redirect WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4048 | — | |
| Medium5.4 | Authenticated Stored Cross-Site Scripting WordPress≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2 | CVE-2020-4046 | — | |
| High7.2 | Admin+ SQL Injection | CVE-2020-35012 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2020-13892 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2020-35037 | — | |
| Medium5.4 | Stored Cross-Site Scripting | CVE-2020-13865 | — |
- Medium4.3Cross-Site Request Forgery Bypass
Advanced Popups
≤1.1.1Update to 1.1.2
- Medium6.1Reflected Cross-Site Scripting
Reality | Estate Multipurpose WordPress Theme
≤2.5.5Update to 2.5.6
- Medium6.1Reflected Cross-Site Scripting
Reality | Estate Multipurpose WordPress Theme
≤2.5.3Update to 2.5.6
- Medium6.1Reflected Cross-Site Scripting
TownHub - Directory & Listing WordPress Theme
≤1.2.9Update to 1.3.0
- Medium6.4Authenticated Stored Cross-Site Scripting
Testimonial Rotator
<3.0.3No patch available
- Medium6.1Directory Listing <= 1.2 - Reflected Cross-Site Scripting
Prolisting - Directory Listing WordPress Theme
≤1.2Update to 1.27
- High7.1Cross-Site Scripting
Findgo - Directory Listing WordPress Theme
<1.3.32Update to 1.3.32
- Medium6.4Directory Listing WordPress Theme < 1.1.15 - Cross-Site Scripting
Findus - Directory Listing WordPress Theme
<1.1.15Update to 1.1.15
- Medium5.4Real Estate WordPress Theme <= 1.4 - Insecure Direct Object Reference
HomeSweet - Real Estate WordPress Theme
≤1.4No patch available
- Medium6.1Reflected Cross-Site Scripting
CityBook - Directory & Listing WordPress Theme
≤2.4.3Update to 2.4.4
- Medium6.1Cross-Site Scripting
Travel Booking WordPress Theme
≤2.8.1Update to 2.8.2
- Critical9.8Real Estate WordPress Theme <= 1.7 - SQL Injection
Nexos - Real Estate WordPress Theme
<1.8Update to 1.8
- Medium6.1Real Estate WordPress Theme < 1.8 - Cross-Site Scripting
Nexos - Real Estate WordPress Theme
<1.8Update to 1.8
- Medium6.1Stored Cross-Site Scripting
Contact Us all-in-one button
<1.8.8Update to 1.8.8
- Medium6.5All Comments Deletion via Cross-Site Request Forgery
Delete All Comments Easily
≤1.3No patch available
- High8.8Cross-Site Request Forgery
Contact Us all-in-one button
≤1.8.7Update to 1.8.8
- High8.8Arbitrary File Upload
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.9.3Update to 2.9.4
- High8.8Authorization Bypass due to Improper Access Control
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.9.3Update to 2.9.4
- Critical9.8wpDiscuz <= 5.3.5 - Blind SQL Injection via order Parameter
Comments – wpDiscuz
<5.3.6Update to 5.3.6
- Medium5.3Comment Disclosure
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Low2.4Self-Cross Site Scripting via Theme Folder Name
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Low3.5Arbitrary User Meta Update
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Medium6.1Cross-Site Scripting
Advanced Custom Fields (ACF®)
<5.8.12Update to 5.8.12
- Medium6.8Authenticated Stored Cross-Site Scripting
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Medium5.7Open Redirect
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- Medium5.4Authenticated Stored Cross-Site Scripting
WordPress
≤5.3.3Update to 3.7.34 or 3.8.34 or 3.9.32 or 4.0.31 or 4.1.31 or 4.2.28 or 4.3.24 or 4.4.23 or 4.5.22 or 4.6.19 or 4.7.18 or 4.8.14 or 4.9.15 or 5.0.10 or 5.1.6 or 5.2.7 or 5.3.4 or 5.4.2
- High7.2Admin+ SQL Injection
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.7.3Update to 5.9.8
- Medium5.4Cross-Site Scripting
SportsPress – Sports Club & League Manager
<2.7.2Update to 2.7.2
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.7.3Update to 5.9.8
- Medium5.4Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.8Update to 2.9.9