Database
WordPress Vulnerability Database (page 1353)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High7.1 | Cross-Site Scripting | CVE-2014-4598 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4586 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4567 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4594 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4579 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4568 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4582 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4575 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4591 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4585 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2014-4595 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4573 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4601 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4580 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4590 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-4163 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3850 | — | |
| Medium4.3 | Cross-Site Request Forgery leading to player deletion | CVE-2014-4030 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-5345 | — | |
| Critical9.8 | SQL Injection | CVE-2014-3961 | — | |
| High7.2 | Cross-Site Scripting | CVE-2014-3921 | — | |
| High7.5 | Path Traversal | CVE-2014-4941 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4547 | — | |
| Critical9.1 | Authenticated (Admin+) SQL Injection | CVE-2014-5180 | — | |
| Medium5.3 | Directory Traversal | CVE-2014-5181 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4527 | — | |
| High7.2 | Authenticated SQL Injection | CVE-2014-5186 | — | |
| High7.5 | Server-Side Request Forgery | CVE-2014-9292 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4574 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4554 | — |
- High7.1Cross-Site Scripting
wp-tmkm-amazon
<1.5.3Update to 1.5.3
- Medium6.1Cross-Site Scripting
wp-football
≤1.1No patch available
- Medium6.1Cross-Site Scripting
Webcam/Screen/Mic Recorder for Video Comments and Forms
≤1.55Update to 1.55.3
- Medium6.1Reflected Cross-Site Scripting
WordPress Responsive Preview
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
Appointments Scheduler
≤1.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Webcam Microphone Screen Recorder – Media Capture
≤1.55.4Update to 1.55.5
- Medium6.1Reflected Cross-Site Scripting
WP Consultant
≤1.0No patch available
- Medium6.1Cross-Site Scripting
WikiPop
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
WP-Picasa-Image
≤1.0No patch available
- Medium6.1Cross-Site Scripting
WP-FaceThumb
≤1.0No patch available
- Medium6.1Multiple Cross-Site Scripting
wp-restful
≤0.1No patch available
- High7.1Cross-Site Scripting
Walk Score Plugin
≤0.5.5No patch available
- Medium6.1Cross-Site Scripting
Wu-Rating
≤1.0 12319No patch available
- Medium6.1Cross-Site Scripting
WP BlipBot
≤3.0.9No patch available
- High7.1Cross-Site Scripting
WP Microblogs
≤0.4.0No patch available
- High8.8Cross-Site Request Forgery
Featured Comments
<1.2.5Update to 1.2.5
- Medium6.1Cross-Site Scripting
Member Approval
≤131109No patch available
- Medium4.3Cross-Site Request Forgery leading to player deletion
JW Player for Flash & HTML5 Video
<2.1.4Update to 2.1.4
- Medium6.1Reflected Cross-Site Scripting
Disqus Comment System
<2.76Update to 2.76
- Critical9.8SQL Injection
Participants Database
<1.5.4.9Update to 1.5.4.9
- High7.2Cross-Site Scripting
simple-popup-images
≤1.0Update to 1.1
- High7.5Path Traversal
Cross-RSS
≤1.7No patch available
- Medium6.1Cross-Site Scripting
Rezgo Online Booking
<1.8.2Update to 1.8.2
- Critical9.1Authenticated (Admin+) SQL Injection
HDW Player Plugin (Video Player & Video Gallery)
≤2.4.2Update to 3.0
- Medium5.3Directory Traversal
lastfm-rotation
≤1.0No patch available
- Medium6.1Cross-Site Scripting
EnvíaloSimple: Email Marketing y Newsletters
≤1.97Update to 1.98
- High7.2Authenticated SQL Injection
All Video Gallery Plugin for WordPress
≤1.2No patch available
- High7.5Server-Side Request Forgery
jRSS Widget
≤1.2No patch available
- Medium6.1Cross-Site Scripting
WebEngage Feedback, Survey and Notification
<2.0.1Update to 2.0.1
- Medium6.1Cross-Site Scripting
SS Downloads
≤1.4.4.1Update to 1.5