Database
WordPress Vulnerability Database (page 1351)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | Arbitrary File Upload | CVE-2014-4725 | — | |
| Critical9.8 | Remote Code Execution | CVE-2013-2011 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2013-0721 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6342 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4578 | — | |
| Medium6.1 | Cross-Site scripting | CVE-2014-4588 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-2550 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-5329 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-20003 | — | |
| Medium5.3 | Information Disclosure | CVE-2013-4454 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2706 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3870 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2014-1888 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4855 | — | |
| Medium5.3 | Cross-Site Scripting | CVE-2011-4562 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-3434 | — | |
| Critical9.8 | Unauthenticated Command Injection | CVE-2014-3114 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3253 | — | |
| Medium6.3 | Cross-Site Request Forgery | CVE-2013-2708 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3487 | — | |
| Medium6.1 | Open Redirection | CVE-2013-2694 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2013-1636 | — | |
| High8.1 | Unauthenticated Local File Inclusion | CVE-2012-20002 | — | |
| Medium6.5 | Cross-Site Request Forgery | CVE-2014-2675 | — | |
| High7.3 | Authentication Bypass | CVE-2012-5469 | — | |
| Medium6.1 | Cross-Site Scripting via Search Parameter | CVE-2013-5988 | — | |
| High8.8 | SQL Injection | CVE-2012-5328 | — | |
| Medium6.1 | Reflected Cross Site Scripting | CVE-2011-5194 | — | |
| High8.8 | Remote Code Execution | CVE-2013-2009 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2013-2698 | — |
- Critical9.8Arbitrary File Upload
MailPoet Newsletters (Previous)
≤2.6.6Update to 2.6.7
- Critical9.8Remote Code Execution
WP Super Cache
<1.3.2Update to 1.3.2
- Medium5.3Full Path Disclosure
WP PHP widget
≤1.0.2No patch available
- Medium6.1Cross-Site Scripting
Tweet Blender
≤4.0.1Update to 4.0.2
- Medium6.1Reflected Cross-Site Scripting
WP App Maker
≤1.0.16.4No patch available
- Medium6.1Cross-Site scripting
Hot Files: File Sharing and Download Manager Plugin
≤1.0.0No patch available
- High8.8Cross-Site Request Forgery
Disable Comments
<1.0.4Update to 1.0.4
- Medium6.1Reflected Cross-Site Scripting
Redirection
<2.2.9Update to 2.2.9
- Medium6.1Reflected Cross-Site Scripting
custom-tables
≤3.4.4No patch available
- Medium5.3Information Disclosure
Portable phpMyAdmin
≤1.4.1No patch available
- High8.8Cross-Site Request Forgery
Stream Video Player
≤1.4.1No patch available
- Medium6.1Cross-Site Scripting
bib2html
≤0.9.3No patch available
- Medium6.4Stored Cross-Site Scripting
BuddyPress
≤1.9.1Update to 1.9.2
- High7.1Cross-Site Scripting
Polylang
<1.5.2Update to 1.5.2
- Medium5.3Cross-Site Scripting
Redirection
<2.2.10Update to 2.2.10
- Medium6.1Cross-Site Scripting
Count per Day
≤3.1.1Update to 3.2
- Critical9.8Unauthenticated Command Injection
EZPZ One Click Backup
≤12.03.10No patch available
- High8.8Cross-Site Request Forgery
Xhanch – My Twitter
≤2.7.6Update to 2.7.7
- Medium6.3Cross-Site Request Forgery
WordPress Content Slide
≤1.4.2No patch available
- Medium6.1Cross-Site Scripting
BulletProof Security
≤.48.9Update to .49
- Medium6.1Open Redirection
WP Symposium
≤13.04Update to 13.05
- High7.2Stored Cross-Site Scripting
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<1.6.3Update to 1.6.3
- High8.1Unauthenticated Local File Inclusion
Tinymce Thumbnail Gallery
≤1.0.0Update to 1.1.0
- Medium6.5Cross-Site Request Forgery
wp-html-sitemap
≤1.2No patch available
- High7.3Authentication Bypass
Portable phpMyAdmin
≤1.3.0Update to 1.3.1
- Medium6.1Cross-Site Scripting via Search Parameter
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤2.0.3Update to 2.0.3.1
- High8.8SQL Injection
Mingle Forum
<1.0.33Update to 1.0.33
- Medium6.1Reflected Cross Site Scripting
WHOIS
≤1.4.2.2Update to 1.4.2.3
- High8.8Remote Code Execution
WP Super Cache
≤1.2Update to 1.3
- Medium4.3Cross-Site Request Forgery
Calendar
≤1.3.2Update to 1.3.3