Database
WordPress Vulnerability Database (page 1366)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
- Medium6.1Cross-Site Scripting
Easy Appointments
<1.12.0Update to 1.12.0
- Medium6.1Reflected Cross-Site Scripting
External Media without Import
<1.0.0Update to 1.0.0
- Medium5.4Reflected Cross-Site Scripting
pootle button
≤1.1.1Update to 1.2.0
- Critical9.8PHP Object Injection
Invite Anyone
≤1.3.18Update to 1.3.19
- Medium6.1Reflected Cross-Site Scripting
PopCash Code Integration Tool
<1.1Update to 1.1
- Medium6.1Stored Cross-Site Scripting
Quards
all versionsNo patch available
- High7.2Stored Cross-Site Scripting
Quards
all versionsNo patch available
- Medium6.1Authenticated Cross-Site Scripting
Max Mega Menu
≤2.3.8Update to 2.4
- Medium4.7Cross-domain Flash injection
WordPress
≤4.9.1Update to 3.7.25 or 3.8.25 or 3.9.24 or 4.0.22 or 4.1.22 or 4.2.19 or 4.3.15 or 4.4.14 or 4.5.13 or 4.6.10 or 4.7.9 or 4.8.5 or 4.9.2
- Critical9.8SQL Injection
Simple Login Log
<1.1.2Update to 1.1.2
- Medium6.1Reflected Cross-Site Scripting
My WP Translate
≤1.0.3Update to 1.0.4
- Critical9.8SQL Injection
Simple Login Log
<1.1.2Update to 1.1.2
- Medium5.3All Known Versions - Cleartext Storage of wp_signups.activation_key
WordPress
all versionsNo patch available
- High8.0Unprotected AJAX Actions
My WP Translate
<1.0.4Update to 1.0.4
- Medium6.1Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.4.6Update to 3.4.6
- Medium6.1Cross-Site Scripting
Raygun
≤1.8.2Update to 1.8.3
- High8.8Cross-Site Request Forgery
Custom Sidebars – Dynamic Sidebar Classic Widget Area Manager
≤3.0.9Update to 3.1.0
- High8.8Authorization Bypass and Cross-Site Request Forgery
Ultimate Product Catalog
≤4.2.21Update to 4.2.22
- Medium6.1Cross-Site Scripting
PDF Invoices & Packing Slips for WooCommerce
<2.0.13Update to 2.0.13
- Critical9.8Unauthenticated PHP Object Injection
Appointments
<2.2.2Update to 2.2.2
- Critical9.8Unauthenticated PHP Object Injection
Flickr Gallery
<1.5.3Update to 1.5.3
- Critical9.8Custom Registration Forms <= 3.7.9.2 - PHP Object Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<3.7.9.3Update to 3.7.9.3
- Critical9.8Unauthenticated PHP Object Injection
MarketPress – WordPress eCommerce
≤3.2.6Update to 3.2.7
- Medium6.5Authenticated Directory Traversal
Insert Pages
<3.2.4Update to 3.2.4
- High8.8Authenticated (Student+) SQL Injection
School Management System for Wordpress
all versionsNo patch available
- Medium6.1Cross-Site Scripting
WP Jobs
<1.7Update to 1.7
- High8.8Authenticated SQL Injection
SMSmaster – Multipurpose SMS Gateway for Wordpress
all versionsNo patch available
- High8.8Church Management System for Wordpress Theme < 13-07-2019 - SQL Injection
WPCHURCH - Church Management System for Wordpress
<13-07-2019Update to 13-07-2019
- High8.8Apartment Management System for wordpress Theme < 17-07-2019 - SQL Injection
WPAMS - Apartment Management System for wordpress
<17-07-2019Update to 17-07-2019
- High8.8Wordpress Gym Management System (Unknown Version) - SQL Injection
WPGYM - Wordpress Gym Management System
all versionsNo patch available