Database
WordPress Vulnerability Database (page 1358)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-100026 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4563 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-1232 | — | |
| High7.5 | Directory Traversal | CVE-2013-7240 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-6992 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6991 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7276 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7279 | — | |
| High8.8 | Cross-Site Request Forgery to Denial of Service | CVE-2013-7233 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6993 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2013-7319 | — | |
| Critical9.8 | SQL Injection | CVE-2013-7187 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7129 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-7419 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-7102 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-20002 | — | |
| Critical9.1 | Authentication Bypass | CVE-2013-4462 | — | |
| High7.1 | Cross-Site Request Forgery and to Cross-Site Scripting | CVE-2013-6797 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6281 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2701 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-5978 | — | |
| Critical9.8 | SQL Injection | CVE-2013-6243 | — | |
| Medium4.3 | Cross-Site Request Forgery | CVE-2013-10027 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-3264 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3263 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-3491 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-5916 | — | |
| Critical9.8 | SQL Injection | CVE-2013-5917 | — | |
| High7.2 | Cross-Site Scripting | CVE-2013-6010 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2013-5962 | — |
- Medium6.1Reflected Cross-Site Scripting
April's Super Functions Pack
≤1.4.7Update to 1.4.8
- Medium6.1Cross-Site Scripting
URL Cloak & Encrypt
<3.8.0Update to 3.8.0
- Medium6.1Cross-Site Scripting
Foliopress WYSIWYG
<2.6.8.5Update to 2.6.8.5
- High7.5Directory Traversal
Advanced Dewplayer
≤1.2Update to 1.3
- High8.8Cross-Site Request Forgery
AskApache Firefox Adsense
≤3.0No patch available
- Medium6.1Cross-Site Scripting
WP-Cron Dashboard
<1.1.6Update to 1.1.6
- Medium6.1Cross-Site Scripting
Recommend to a friend
≤2.2.2No patch available
- Medium6.1Cross-Site Scripting
S3 Video Plugin
≤0.982Update to 0.983
- High8.8Cross-Site Request Forgery to Denial of Service
WordPress
≤2.0.11Update to 2.1
- Medium6.1Cross-Site Scripting
ad-minister
≤0.6No patch available
- High7.2Stored Cross-Site Scripting
Download Manager
≤2.5.8Update to 2.5.9
- Critical9.8SQL Injection
FormCraft
≤1.3.7Update to 1.3.8
- Medium6.1Cross-Site Scripting
Bloog
≤1.1Update to 1.2
- Medium6.1Reflected Cross-Site Scripting
JS Multi Hotel
≤2.2.1No patch available
- Critical9.8Arbitrary File Upload
OptimizePress
<1.6Update to 1.6
- Critical9.8Arbitrary File Upload
Elemin
<1.4.3Update to 1.4.3
- Critical9.1Authentication Bypass
Portable phpMyAdmin
≤1.5.0No patch available
- High7.1Cross-Site Request Forgery and to Cross-Site Scripting
Blue Wrench Video Widget
≤1.0.5Update to 2.0.0
- Medium6.1Cross-Site Scripting
dhtmlxspreadsheet
≤2.0No patch available
- High8.8Cross-Site Request Forgery
Social Sharing Toolkit
≤2.1.1Update to 2.1.2
- Medium6.1Cross-Site Scripting
Cart66 Lite :: WordPress Ecommerce
<1.5.1.15Update to 1.5.1.15
- Critical9.8SQL Injection
WordPress Landing Pages
<1.2.3Update to 1.2.3
- Medium4.3Cross-Site Request Forgery
Blogger Importer
≤0.5Update to 0.6
- Critical9.8Authentication Bypass
WP Ultimate Email Marketer
≤1.2.0No patch available
- Medium6.1Cross-Site Scripting
WP Ultimate Email Marketer
≤1.2.0No patch available
- Medium6.1Cross-Site Scripting
Sharebar
≤1.4.2Update to 1.4.3
- Medium6.1Cross-Site Scripting
Bradesco Gateway
≤2.0No patch available
- Critical9.8SQL Injection
NOSpamPTI
≤2.1No patch available
- High7.2Cross-Site Scripting
Comment Attachment
≤1.5.5No patch available
- Critical9.8Arbitrary File Upload
Complete Gallery Manager for WordPress | Galleries
<3.3.4Update to 3.3.4