Database
WordPress Vulnerability Database (page 1366)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Critical9.8 | Arbitrary File Upload | CVE-2012-1010 | — | |
| Medium5.4 | Cross-Site Scripting | CVE-2012-5325 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-6527 | — | |
| Medium5.3 | Directory Traversal | CVE-2012-0898 | — | |
| High7.5 | Arbitrary File Download | CVE-2012-0896 | — | |
| Medium6.1 | Open Redirect | CVE-2012-6499 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-0901 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2012-5350 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5192 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-5349 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2012-0287 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2012-5346 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5207 | — | |
| Medium6.1 | Authorization Bypass | CVE-2011-5254 | — | |
| High8.8 | Arbitrary File Upload | CVE-2011-5051 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2011-5226 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5225 | — | |
| Critical9.8 | SQL Injection | CVE-2011-5224 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5191 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-5264 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-4595 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-4624 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-5180 | — | |
| High7.1 | Cross-Site Scripting | CVE-2011-5179 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5265 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5181 | — | |
| Medium5.3 | Stored Cross-Site Scripting | CVE-2011-5104 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5107 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2011-5106 | — | |
| Critical9.8 | SQL Injection | CVE-2011-4671 | — |
- Critical9.8Arbitrary File Upload
AllWebMenus WordPress Menu Plugin
<1.1.9Update to 1.1.9
- Medium5.4Cross-Site Scripting
Shortcode Redirect
≤1.0.01Update to 1.0.02
- Medium6.1Cross-Site Scripting
My Calendar – Accessible Event Manager
<1.10.5Update to 1.10.5
- Medium5.3Directory Traversal
myEASYbackup
<1.0.9Update to 1.0.9
- High7.5Arbitrary File Download
Count per Day
≤3.1Update to 3.1.1
- Medium6.1Open Redirect
Age Verification
≤0.4Update to 0.5
- Medium6.1Cross-Site Scripting
YouSayToo auto-publishing plugin
≤1.0No patch available
- High8.8Authenticated SQL Injection
Pay With Tweet
≤1.1Update to 1.2
- Medium6.1Cross-Site Scripting
Pretty Link Lite
<1.5.6Update to 1.5.6
- Medium6.1Cross-Site Scripting
Pay With Tweet
≤1.1Update to 1.2
- Medium6.4Cross-Site Scripting
WordPress
≤3.3Update to 3.3.1
- Medium6.1Cross-Site Scripting
WP Live.php
≤1.2.1Update to 1.3
- Medium6.1Cross-Site Scripting
TheCartPress eCommerce Shopping Cart
≤1.1.5Update to 1.1.6
- Medium6.1Authorization Bypass
Connections Business Directory
≤0.7.1.5Update to 0.7.1.6
- High8.8Arbitrary File Upload
WP Symposium
<11.12.24Update to 11.12.24
- High8.8Cross-Site Request Forgery
WordPress Sentinel
≤1.0.0Update to 1.0.1
- Medium6.1Cross-Site Scripting
WordPress Sentinel
≤1.0.0Update to 1.0.1
- Critical9.8SQL Injection
WordPress Sentinel
≤1.0.0Update to 1.0.1
- Medium6.1Cross-Site Scripting
Pretty Link Lite
<1.5.4Update to 1.5.4
- Medium6.1Reflected Cross-Site Scripting
Lazyest Backup
<0.2.2Update to 0.2.2
- Medium6.1Reflected Cross-Site Scripting
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
<1.5.6Update to 1.5.6
- Medium6.1Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
<1.57Update to 1.57
- Medium6.1Reflected Cross-Site Scripting
ZooEffect Plugin for Video player, Photo Gallery Slideshow jQuery and audio / music / podcast – HTML5
≤1.11No patch available
- High7.1Cross-Site Scripting
Skysa App Bar Integration
≤1.03Update to 1.04
- Medium6.1Cross-Site Scripting
Featurific For WordPress
≤1.6.2No patch available
- Medium6.1Cross-Site Scripting
Live Chat from ClickDesk – Live Chat – Help Desk Plugin for Websites
≤2.0Update to 3.0
- Medium5.3Stored Cross-Site Scripting
WP eCommerce
<3.8.7.2Update to 3.8.7.2
- Medium6.1Cross-Site Scripting
Alert Before Your Post
≤0.1.1No patch available
- Medium6.1Cross-Site Scripting
Flexible Custom Post Type
<0.1.7Update to 0.1.7
- Critical9.8SQL Injection
AdRotate Banner Manager
<3.6.8Update to 3.6.8