Database
WordPress Vulnerability Database (page 1361)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2013-3720 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-7476 | — | |
| High7.2 | Cross-Site Scripting | CVE-2013-3529 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2700 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2013-2744 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-2741 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-2742 | — | |
| Critical9.8 | Authentication Bypass | CVE-2013-2743 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2013-2640 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-0731 | — | |
| High7.2 | SQL Injection | CVE-2013-1852 | — | |
| Medium6.1 | Cross-Site Scripting via playerID | CVE-2013-2714 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2013-2501 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-7472 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2013-7480 | — | |
| Critical9.8 | SQL Injection | CVE-2013-0735 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2013-0734 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1765 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1759 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1758 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-1808 | — | |
| High7.5 | 1.9.11 - Full Path Disclosure | CVE-2013-0291 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2013-0286 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2013-10023 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2013-1409 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2013-0724 | — | |
| High7.2 | Multiple SQL Injections | CVE-2013-1408 | — | |
| Critical9.8 | Unauthenticated Remote File Inclusion | CVE-2012-4919 | — | |
| Medium6.1 | Cross-Site Scripting via playerID Parameter | CVE-2013-1464 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2013-0236 | — |
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Feedweb
<1.9Update to 1.9
- High8.8Cross-Site Request Forgery
Simple Fields
<1.2Update to 1.2
- High7.2Cross-Site Scripting
WP FuneralPress
≤1.1.6Update to 1.1.7
- High8.8Cross-Site Request Forgery
WP125
≤1.4.9Update to 1.5.0
- Medium5.3Sensitive Information Disclosure
BackupBuddy
<3.0Update to 3.0
- Critical9.8Authentication Bypass
BackupBuddy
<3.0Update to 3.0
- Critical9.8Authentication Bypass
BackupBuddy
<3.0Update to 3.0
- Critical9.8Authentication Bypass
BackupBuddy
<3.0Update to 3.0
- Medium6.4Cross-Site Scripting
MailUp newsletter sign-up form
<1.3.2Update to 1.3.2
- Medium6.1Cross-Site Scripting
MailUp newsletter sign-up form
<1.3.3Update to 1.3.3
- High7.2SQL Injection
LeagueManager
<3.8.1Update to 3.8.1
- Medium6.1Cross-Site Scripting via playerID
podpress
≤8.8.10.17No patch available
- Medium6.4Stored Cross-Site Scripting
Terillion Reviews
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
Count per Day
<3.2.6Update to 3.2.6
- Medium6.1Multiple Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.3.6Update to 5.3.6.1
- Critical9.8SQL Injection
Mingle Forum
≤1.0.33.3Update to 1.0.34
- High7.2Stored Cross-Site Scripting
Mingle Forum
≤1.0.33.3Update to 1.0.34
- Medium6.1Cross-Site Scripting
Smart Flv
≤1.0No patch available
- Medium6.1Cross-Site Scripting
Responsive Logo Slideshow
<1.2Update to 1.2
- Medium6.1Cross-Site Scripting
Marekkis Watermark-Plugin
≤0.9.4No patch available
- Medium6.1Cross-Site Scripting
Zendesk Chat
<1.2.6Update to 1.2.6
- High7.51.9.11 - Full Path Disclosure
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
1.9.10 – 1.9.11Update to 2.0.0
- Medium5.4Cross-Site Scripting
Pinboard
≤1.1.11Update to 1.1.12
- High7.2Authenticated (Admin+) SQL Injection
Editorial Calendar
≤2.6Update to 2.7
- Medium6.1Reflected Cross-Site Scripting
CommentLuv
<2.92.4Update to 2.92.4
- Critical9.8Remote File Inclusion
WP eCommerce Shop Styling
<1.8Update to 1.8
- High7.2Multiple SQL Injections
MailPoet Newsletters (Previous)
≤2.2Update to 2.2.1
- Critical9.8Unauthenticated Remote File Inclusion
WordPress Gallery Plugin
≤1.4No patch available
- Medium6.1Cross-Site Scripting via playerID Parameter
audio-player
<2.0.4.6Update to 2.0.4.6
- Medium6.4Stored Cross-Site Scripting
WordPress
<3.5.1Update to 3.5.1