Database
WordPress Vulnerability Database (page 1357)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| High8.8 | Cross-Site Request Forgery | CVE-2016-10902 | — | |
| Medium5.4 | Cross-Site Request Forgery | CVE-2014-2340 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2014-100009 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100008 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-2838 | — | |
| High7.2 | Blind SQL Injection | CVE-2014-2839 | — | |
| Critical9.8 | Local File Inclusion | CVE-2014-2674 | — | |
| Critical9.8 | SQL Injection | CVE-2014-3937 | — | |
| Critical9.8 | SQL Injection | CVE-2014-10017 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-10016 | — | |
| Medium5.3 | Full Path Disclosure | CVE-2014-1908 | — | |
| Critical9.8 | Arbitrary File Read/Deletion | CVE-2014-1907 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2014-1905 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-2297 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100023 | — | |
| Critical9.8 | SQL Injection | CVE-2014-100022 | — | |
| Medium5.3 | CAPTCHA Bypass | CVE-2014-2265 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-2315 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-10381 | — | |
| Critical9.8 | 3.9.4 - SQL Injection | CVE-2014-1854 | — | |
| High8.8 | Cross-Site Request Forgery to Cross-Site Scripting | CVE-2014-2274 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-8800 | — | |
| Critical9.1 | SQL Injection | CVE-2014-2316 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-1906 | — | |
| Medium6.5 | Authorization Bypass | CVE-2014-1889 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2014-2040 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-100016 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-125090 | — | |
| Medium6.1 | Open Redirect | CVE-2014-1750 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2012-6629 | — |
- High8.8Cross-Site Request Forgery
WP Customer Reviews
<3.0.9Update to 3.0.9
- Medium5.4Cross-Site Request Forgery
Backup, Restore and Migrate your sites with XCloner
<3.1.1Update to 3.1.1
- Medium5.3Full Path Disclosure
JS Multi Hotel
≤2.2.1No patch available
- Medium6.1Cross-Site Scripting
JS Multi Hotel
≤2.2.1No patch available
- High8.8Cross-Site Request Forgery
GD Star Rating
≤1.9.22No patch available
- High7.2Blind SQL Injection
GD Star Rating
≤1.9.22No patch available
- Critical9.8Local File Inclusion
Ajax Pagination (twitter Style)
≤1.1No patch available
- Critical9.8SQL Injection
Contextual Related Posts
<1.8.10.2Update to 1.8.10.2
- Critical9.8SQL Injection
Welcart e-Commerce
≤2.9.1Update to 2.9.2
- Medium6.1Cross-Site Scripting
Welcart e-Commerce
≤2.11.1Update to 2.11.2
- Medium5.3Full Path Disclosure
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
- Critical9.8Arbitrary File Read/Deletion
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
- Critical9.8Arbitrary File Upload
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤4.27.4Update to 4.29.5
- Medium6.1Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤4.29.6Update to 4.29.9
- Medium6.1Cross-Site Scripting
mTouch Quiz
<3.0.7Update to 3.0.7
- Critical9.8SQL Injection
mTouch Quiz
<3.0.7Update to 3.0.7
- Medium5.3CAPTCHA Bypass
Contact Form 7
<3.7.2Update to 3.7.2
- Medium6.1Cross-Site Scripting
Thank You Counter Button
≤1.9.3No patch available
- High8.8Cross-Site Request Forgery
User Domain Whitelist
<1.5Update to 1.5
- Critical9.83.9.4 - SQL Injection
AdRotate Banner Manager
3.9 – 3.9.4Update to 3.9.5
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Subscribe To Comments Reloaded
≤140129Update to 140219
- High7.1Cross-Site Scripting
Nextend Social Login and Register
<1.5.1Update to 1.5.1
- Critical9.1SQL Injection
Search Everything
<7.0.3Update to 7.0.3
- High7.1Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
<4.29.5Update to 4.29.5
- Medium6.5Authorization Bypass
BuddyPress
<1.9.2Update to 1.9.2
- Medium6.4Stored Cross-Site Scripting
Media File Renamer: Rename Images & Files for SEO (AI-Powered)
<1.9.4Update to 1.9.4
- Medium6.1Cross-Site Scripting
Photocrati
≤4.8.0Update to 4.8.1
- Medium6.1Reflected Cross-Site Scripting
Media Downloader
≤0.1.992Update to 0.1.993
- Medium6.1Open Redirect
Nokia Maps & Places
<1.6.7Update to 1.6.7
- High8.8Cross-Site Request Forgery
Newsletter Manager
<1.4Update to 1.4