Database
WordPress Vulnerability Database (page 1359)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | Arbitrary File Upload | CVE-2013-5963 | — | |
| Medium5.4 | Open Redirect | CVE-2013-4339 | — | |
| Medium6.4 | HTML File Upload | CVE-2013-5738 | — | |
| Medium6.4 | .swf and .exe File Upload | CVE-2013-5739 | — | |
| Medium6.3 | Spoof Post Authorship | CVE-2013-4340 | — | |
| High8.8 | Deserialization | CVE-2013-4338 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-5711 | — | |
| Critical9.8 | SQL Injection | CVE-2013-5673 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-5672 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7481 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-5714 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-4626 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-10020 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7478 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7475 | — | |
| High7.1 | Cross-Site Request Forgery | CVE-2013-4240 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-4241 | — | |
| High7.2 | Cross-Site Scripting via sort Parameter | CVE-2013-5098 | — | |
| Medium6.1 | Cross-Site Scripting via p Parameter | CVE-2013-3262 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-4117 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-4944 | — | |
| Medium6.1 | DOM Cross-Site Scripting | CVE-2013-4693 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-3251 | — | |
| Medium5.4 | XXE Injection | CVE-2013-2202 | — | |
| Medium4.6 | Content-Spoofing Attacks | CVE-2013-2204 | — | |
| Medium6.4 | Cross-Site Scripting via Multiple Vectors | CVE-2013-2201 | — | |
| Medium5.4 | Server Side Request Forgery | CVE-2013-2199 | — | |
| Medium5.3 | Denial of Service via wp-postpass cookie | CVE-2013-2173 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2013-2205 | — | |
| Medium4.3 | Sensitive Information Disclosure | CVE-2013-2203 | — |
- Critical9.8Arbitrary File Upload
Simple Dropbox Upload
<1.8.8.1Update to 1.8.8.1
- Medium5.4Open Redirect
WordPress
≤3.6Update to 3.6.1
- Medium6.4HTML File Upload
WordPress
≤3.6Update to 3.6.1
- Medium6.4.swf and .exe File Upload
WordPress
<3.6.1Update to 3.6.1
- Medium6.3Spoof Post Authorship
WordPress
≤3.6Update to 3.6.1
- High8.8Deserialization
WordPress
≤3.6Update to 3.6.1
- Medium6.1Cross-Site Scripting
Design Approval System
≤3.6Update to 3.7
- Critical9.8SQL Injection
Testimonial
<2.3Update to 2.3
- High8.8Cross-Site Request Forgery
Testimonial
<2.3Update to 2.3
- Medium6.1Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
≤3.34Update to 3.35
- Medium6.1Reflected Cross-Site Scripting
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP
≤4.25.3Update to 4.27
- Medium6.1Cross-Site Scripting
BackWPup – WordPress Backup & Restore Plugin
<3.0.13Update to 3.0.13
- Medium6.1Reflected Cross-Site Scripting
A Forms
≤1.4.2Update to 1.4.3
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.5Update to 5.5
- Medium6.1Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
≤3.51Update to 3.52
- High7.1Cross-Site Request Forgery
HMS Testimonials
<2.0.11Update to 2.0.11
- Medium6.1Cross-Site Scripting
HMS Testimonials
<2.0.11Update to 2.0.11
- High7.2Cross-Site Scripting via sort Parameter
Download Monitor
<3.3.6.2Update to 3.3.6.2
- Medium6.1Cross-Site Scripting via p Parameter
Download Monitor
<3.3.6.2Update to 3.3.6.2
- Medium6.1Reflected Cross-Site Scripting
Category Grid View Gallery
≤2.3.1Update to 2.3.2
- Medium6.1Cross-Site Scripting
BuddyPress Extended Friendship Request
<1.0.2Update to 1.0.2
- Medium6.1DOM Cross-Site Scripting
Xorbin Digital Flash Clock
≤1.0No patch available
- High8.8Cross-Site Request Forgery
qTranslate
≤2.5.39No patch available
- Medium5.4XXE Injection
WordPress
≤3.5.1Update to 3.5.2
- Medium4.6Content-Spoofing Attacks
WordPress
≤3.5.1Update to 3.5.2
- Medium6.4Cross-Site Scripting via Multiple Vectors
WordPress
≤3.5.1Update to 3.5.2
- Medium5.4Server Side Request Forgery
WordPress
≤3.5.1Update to 3.5.2
- Medium5.3Denial of Service via wp-postpass cookie
WordPress
<3.5.2Update to 3.5.2
- Medium6.4Cross-Site Scripting
WordPress
≤3.5.1Update to 3.5.2
- Medium4.3Sensitive Information Disclosure
WordPress
≤3.5.1Update to 3.5.2