Database

WordPress Vulnerability Database (page 1362)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1362)
Severity	Vulnerability	CVE	Installs	Published
Medium5.4	Server-Side Request Forgery WordPress≤3.5Update to 3.5.1	CVE-2013-0235	—	Jan 24, 2013
Medium6.4	Cross-Site Scripting WordPress≤3.5Update to 3.5.1	CVE-2013-0237	—	Jan 24, 2013
Critical9.8	SQL Injection WordPress Poll≤34.05Update to 34.06	CVE-2013-1401	—	Jan 21, 2013
Critical9.8	SQL Injection WordPress Poll≤34.05Update to 34.06	CVE-2013-1400	—	Jan 21, 2013
High7.5	Directory Traversal Forums<1.4.4Update to 1.4.4	CVE-2012-4920	—	Jan 9, 2013
High7.5	Directory Traversal Google Doc Embedder<2.5.4Update to 2.5.4	CVE-2012-4915	—	Jan 8, 2013
Low3.8	Remote Code Execution via Remote File Inclusion Advanced Custom Fields (ACF®)≤3.5.1Update to 3.5.2	CVE-2012-10025	—	Jan 3, 2013
High7.5	Directory Traversal Download Shortcode≤0.2.3Update to 1.0	CVE-2014-5465	—	Jan 3, 2013
High8.8	Cross-Site Request Forgery Mingle Forum≤1.0.34Update to 1.0.35	CVE-2013-0736	—	Jan 2, 2013
Medium5.4	Missing Session Cookie Expiration WordPress<4.0Update to 4.0	CVE-2012-5868	—	Dec 27, 2012
Medium6.1	Cross-Site Scripting Welcart e-Commerce<1.2.2Update to 1.2.2	CVE-2012-5177	—	Dec 14, 2012
High8.8	Cross-Site Request Forgery Welcart e-Commerce<1.2.2Update to 1.2.2	CVE-2012-5178	—	Dec 14, 2012
Medium6.1	Reflected Cross-Site Scripting BuddyStream≤3.6.2Update to 3.6.3	CVE-2012-10007	—	Dec 4, 2012
Medium6.1	Cross-Site Scripting Video Lead Form<0.6Update to 0.6	CVE-2012-6312	—	Nov 26, 2012
Medium5.3	Sensitive Information Disclosure Simple Gmail Login<1.1.4Update to 1.1.4	CVE-2012-6313	—	Nov 24, 2012
Medium6.1	Cross-Site Scripting Advanced Text Widget≤2.0.1Update to 2.0.2	CVE-2011-4618	—	Nov 21, 2012
Medium6.1	Cross-Site Scripting Uk Cookie≤1.1No patch available	CVE-2012-5856	—	Nov 13, 2012
Medium6.1	Cross-Site Scripting Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery≤1.9.6Update to 1.9.7	CVE-2012-3414	—	Nov 9, 2012
Critical9.8	Unauthenticated SQL Injection Cardoza AJAX Search<1.3Update to 1.3	CVE-2012-5853	—	Nov 6, 2012
High7.3	SQL Injection All Video Gallery Plugin for WordPress<1.2Update to 1.2	CVE-2012-6653	—	Nov 2, 2012
Medium6.1	Cross Site Scripting via post_title parameter Yoast SEO – Advanced SEO with real-time guidance and built-in AI≤2.1.1Update to 2.2	CVE-2012-6692	—	Oct 31, 2012
High7.1	Reflected Cross-Site Scripting White Label CMS<1.5.1Update to 1.5.1	CVE-2012-5387	—	Oct 21, 2012
High7.1	Cross-Site Scripting White Label CMS<1.5.1Update to 1.5.1	CVE-2012-5388	—	Oct 21, 2012
Medium6.1	Cross-Site Scripting WHOIS≤1.4.2.4No patch available	CVE-2011-5193	—	Sep 23, 2012
Medium6.1	Cross-Site Scripting MF Gig Calendar≤0.9.4.1Update to 0.9.5	CVE-2012-4242	—	Sep 23, 2012
High7.5	Information Disclosure via Arbitrary File Downloads simple-download-button-shortcode1.0 – 1.0Update to 1.1	CVE-2012-10016	—	Sep 17, 2012
High8.8	Cross-Site Request Forgery DVS Custom Notification≤1.0.1No patch available	CVE-2012-4921	—	Sep 14, 2012
Medium6.3	Missing Authorization Checks on create_post WordPress<3.4.2Update to 3.4.2	CVE-2012-4421	—	Sep 6, 2012
Low3.8	Missing Authorization Checks WordPress≤3.4.1Update to 3.4.2	CVE-2012-4422	—	Sep 6, 2012
Medium6.4	Cross-Site Scripting WordPress≤3.4.1Update to 3.4.2	CVE-2012-3383	—	Sep 6, 2012

Medium5.4
Server-Side Request Forgery
WordPress
≤3.5Update to 3.5.1
CVE-2013-0235Jan 24, 2013
Medium6.4
Cross-Site Scripting
WordPress
≤3.5Update to 3.5.1
CVE-2013-0237Jan 24, 2013
Critical9.8
SQL Injection
WordPress Poll
≤34.05Update to 34.06
CVE-2013-1401Jan 21, 2013
Critical9.8
SQL Injection
WordPress Poll
≤34.05Update to 34.06
CVE-2013-1400Jan 21, 2013
High7.5
Directory Traversal
Forums
<1.4.4Update to 1.4.4
CVE-2012-4920Jan 9, 2013
High7.5
Directory Traversal
Google Doc Embedder
<2.5.4Update to 2.5.4
CVE-2012-4915Jan 8, 2013
Low3.8
Remote Code Execution via Remote File Inclusion
Advanced Custom Fields (ACF®)
≤3.5.1Update to 3.5.2
CVE-2012-10025Jan 3, 2013
High7.5
Directory Traversal
Download Shortcode
≤0.2.3Update to 1.0
CVE-2014-5465Jan 3, 2013
High8.8
Cross-Site Request Forgery
Mingle Forum
≤1.0.34Update to 1.0.35
CVE-2013-0736Jan 2, 2013
Medium5.4
Missing Session Cookie Expiration
WordPress
<4.0Update to 4.0
CVE-2012-5868Dec 27, 2012
Medium6.1
Cross-Site Scripting
Welcart e-Commerce
<1.2.2Update to 1.2.2
CVE-2012-5177Dec 14, 2012
High8.8
Cross-Site Request Forgery
Welcart e-Commerce
<1.2.2Update to 1.2.2
CVE-2012-5178Dec 14, 2012
Medium6.1
Reflected Cross-Site Scripting
BuddyStream
≤3.6.2Update to 3.6.3
CVE-2012-10007Dec 4, 2012
Medium6.1
Cross-Site Scripting
Video Lead Form
<0.6Update to 0.6
CVE-2012-6312Nov 26, 2012
Medium5.3
Sensitive Information Disclosure
Simple Gmail Login
<1.1.4Update to 1.1.4
CVE-2012-6313Nov 24, 2012
Medium6.1
Cross-Site Scripting
Advanced Text Widget
≤2.0.1Update to 2.0.2
CVE-2011-4618Nov 21, 2012
Medium6.1
Cross-Site Scripting
Uk Cookie
≤1.1No patch available
CVE-2012-5856Nov 13, 2012
Medium6.1
Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤1.9.6Update to 1.9.7
CVE-2012-3414Nov 9, 2012
Critical9.8
Unauthenticated SQL Injection
Cardoza AJAX Search
<1.3Update to 1.3
CVE-2012-5853Nov 6, 2012
High7.3
SQL Injection
All Video Gallery Plugin for WordPress
<1.2Update to 1.2
CVE-2012-6653Nov 2, 2012
Medium6.1
Cross Site Scripting via post_title parameter
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤2.1.1Update to 2.2
CVE-2012-6692Oct 31, 2012
High7.1
Reflected Cross-Site Scripting
White Label CMS
<1.5.1Update to 1.5.1
CVE-2012-5387Oct 21, 2012
High7.1
Cross-Site Scripting
White Label CMS
<1.5.1Update to 1.5.1
CVE-2012-5388Oct 21, 2012
Medium6.1
Cross-Site Scripting
WHOIS
≤1.4.2.4No patch available
CVE-2011-5193Sep 23, 2012
Medium6.1
Cross-Site Scripting
MF Gig Calendar
≤0.9.4.1Update to 0.9.5
CVE-2012-4242Sep 23, 2012
High7.5
Information Disclosure via Arbitrary File Downloads
simple-download-button-shortcode
1.0 – 1.0Update to 1.1
CVE-2012-10016Sep 17, 2012
High8.8
Cross-Site Request Forgery
DVS Custom Notification
≤1.0.1No patch available
CVE-2012-4921Sep 14, 2012
Medium6.3
Missing Authorization Checks on create_post
WordPress
<3.4.2Update to 3.4.2
CVE-2012-4421Sep 6, 2012
Low3.8
Missing Authorization Checks
WordPress
≤3.4.1Update to 3.4.2
CVE-2012-4422Sep 6, 2012
Medium6.4
Cross-Site Scripting
WordPress
≤3.4.1Update to 3.4.2
CVE-2012-3383Sep 6, 2012