Database
WordPress Vulnerability Database (page 1346)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.5 | Directory Traversal | CVE-2014-8799 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2014-9179 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-8584 | — | |
| Medium6.3 | SQL Injection | CVE-2014-10013 | — | |
| Critical9.8 | Code Injection | CVE-2014-8877 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-10012 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-8955 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-8814 | — | |
| High7.2 | Missing Authorization | CVE-2014-8803 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-8815 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2014-7958 | — | |
| Critical9.8 | 3.11 - SQL Injection | CVE-2014-8621 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2014-8807 | — | |
| Medium4.3 | Server-Side Request Forgery | CVE-2014-8749 | — | |
| Medium6.1 | JavaScript Injection | CVE-2014-10391 | — | |
| Medium6.1 | 2.6 - Cross-Site Scripting | CVE-2014-8087 | — | |
| High7.5 | Missing Authorization | CVE-2014-10076 | — | |
| Medium5.3 | Sensitive Data Exposure | CVE-2014-8491 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-8492 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2014-8739 | — | |
| Critical9.8 | SQL Injection | CVE-2014-8586 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-10382 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-7151 | — | |
| High7.2 | 2.4 - Stored Cross-Site Scripting | CVE-2014-7238 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-8758 | — | |
| Medium6.1 | Stored Cross-Site Scripting | CVE-2014-7240 | — | |
| High7.5 | Sensitive Information Disclosure | CVE-2014-8604 | — | |
| High7.5 | Improper Access Control to Information Disclosure | CVE-2014-8605 | — | |
| Medium4.9 | Directory Traversal | CVE-2014-8606 | — | |
| High7.2 | Remote Code Execution | CVE-2014-8603 | — |
- High7.5Directory Traversal
DukaPress
<2.5.4Update to 2.5.4
- Medium6.4Cross-Site Scripting
supportezzy
≤1.2.5Update to 1.2.6
- Medium6.1Cross-Site Scripting
SpiderVPlayer
≤1.5.1Update to 1.5.2
- Medium6.3SQL Injection
AWP Classifieds
<3.0Update to 3.0
- Critical9.8Code Injection
CM Download Manager – Organize, Protect & Share Files in WordPress
≤2.0.3Update to 2.0.4
- Medium6.1Cross-Site Scripting
AWP Classifieds
<3.0Update to 3.0
- Medium6.1Cross-Site Scripting
Contact Form Clean and Simple
<4.4.1Update to 4.4.1
- Medium6.1Reflected Cross-Site Scripting
WP Photo Album Plus
≤5.4.17Update to 5.4.18
- High7.2Missing Authorization
Smart Forms – when you need more than just a contact form
≤2.1.0Update to 2.1.1
- Medium6.1Reflected Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤2.8.6Update to 2.8.7
- Medium5.4Cross-Site Scripting
BulletProof Security
<.51.1Update to .51.1
- Critical9.83.11 - SQL Injection
Store Locator for WordPress with Google Maps – LotsOfLocales
<3.12Update to 3.12
- High7.2Stored Cross-Site Scripting
Contact Bank – Contact Form Builder for WordPress
≤2.0.69Update to 2.0.70
- Medium4.3Server-Side Request Forgery
BulletProof Security
≤.51Update to .51.1
- Medium6.1JavaScript Injection
WP Support Plus Responsive Ticket System
≤4.0Update to 4.1
- Medium6.12.6 - Cross-Site Scripting
post highlights
2.0 – 2.6Update to 2.6.1
- High7.5Missing Authorization
Database Backup for WordPress
≤2.2.4Update to 2.3.0
- Medium5.3Sensitive Data Exposure
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
<4.25Update to 4.25
- Medium6.1Reflected Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤2.0.2Update to 2.0.3
- Critical9.8Arbitrary File Upload
Creative Contact Form
<1.0.0Update to 1.0.0
- Critical9.8SQL Injection
CP Multi View Events Calendar
<1.0.2Update to 1.0.2
- High8.8Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
- Medium6.1Cross-Site Scripting
NEX-Forms Lite – WordPress Contact Form builder
<3.4Update to 3.4
- High7.22.4 - Stored Cross-Site Scripting
Contact Form Integrated With Google Maps
1.0 – 2.4Update to 2.5
- Medium6.1Reflected Cross-Site Scripting
Gallery Bank – WordPress Photo Gallery Plugin
<3.0.70Update to 3.0.70
- Medium6.1Stored Cross-Site Scripting
Easy Contact Form Solution
<1.7Update to 1.7
- High7.5Sensitive Information Disclosure
Backup, Restore and Migrate your sites with XCloner
<3.1.2Update to 3.1.2
- High7.5Improper Access Control to Information Disclosure
Backup, Restore and Migrate your sites with XCloner
≤3.1.1Update to 3.1.2
- Medium4.9Directory Traversal
Backup, Restore and Migrate your sites with XCloner
<3.1.2Update to 3.1.2
- High7.2Remote Code Execution
Backup, Restore and Migrate your sites with XCloner
<3.1.2Update to 3.1.2