Database
WordPress Vulnerability Database (page 1369)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.3 | Access Control Bypass | CVE-2010-5106 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2010-4747 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2010-4518 | — | |
| High7.1 | Reflected Cross-Site Scripting | CVE-2010-4825 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2010-4779 | — | |
| Medium5.3 | Spam Protection Bypass | CVE-2010-5293 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2010-5294 | — | |
| High8.8 | SQL Injection | CVE-2010-4257 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2010-5295 | — | |
| High7.2 | Stored Cross-Site Scripting | CVE-2010-4402 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2010-4403 | — | |
| Critical9.8 | SQL Injection | CVE-2010-4839 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2010-4630 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2010-4875 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2010-4637 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2010-3977 | — | |
| Medium4.7 | Missing Authorization | CVE-2010-5297 | — | |
| Critical9.8 | SQL Injection | CVE-2010-2924 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2010-1186 | — | |
| Medium4.3 | Authorization Bypass | CVE-2010-0682 | — | |
| Critical9.8 | Copperleaf Photolog <= 0.16- SQL injection | CVE-2010-0673 | — | |
| Critical9.8 | SQL Injection | CVE-2009-4424 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2009-3891 | — | |
| High8.8 | Arbitrary File Upload | CVE-2009-3890 | — | |
| Medium6.1 | Cross-Site Scripting via tagcloud | CVE-2009-4168 | — | |
| Medium5.3 | Sensitive Information Exposure | CVE-2009-4170 | — | |
| High8.8 | Arbitrary File Upload | CVE-2009-4140 | — | |
| Medium6.5 | Denial of Service | CVE-2009-3622 | — | |
| Critical9.8 | Multiple SQL Injections | CVE-2009-3703 | — | |
| High7.1 | Cross-Site Scripting | CVE-2009-4169 | — |
- Medium6.3Access Control Bypass
WordPress
≤3.0.2Update to 3.0.3
- Medium6.1Cross-Site Scripting
WordPress Processing Embed
≤0.5.1No patch available
- Medium6.1Cross-Site Scripting
WP Safe Search
≤0.7No patch available
- High7.1Reflected Cross-Site Scripting
Peadig's Twitter Feed: Embedded Timeline WordPress Plugin
≤2.2No patch available
- Medium6.1Cross-Site Scripting
WPtouch – Make your WordPress Website Mobile-Friendly
<1.9.20Update to 1.9.20
- Medium5.3Spam Protection Bypass
WordPress
<3.0.2Update to 3.0.2
- Medium6.4Cross-Site Scripting
WordPress
<3.0.2Update to 3.0.2
- High8.8SQL Injection
WordPress
≤3.0.1Update to 3.0.2
- Medium6.4Cross-Site Scripting
WordPress
<3.0.2Update to 3.0.2
- High7.2Stored Cross-Site Scripting
Register Plus
≤3.5.11No patch available
- Medium5.3Sensitive Information Disclosure
Register Plus
≤3.5.11No patch available
- Critical9.8SQL Injection
Event Registration
<6.00.03Update to 6.00.03
- Medium6.1Cross-Site Scripting
WP Survey And Quiz Tool
<1.3Update to 1.3
- Medium6.1Reflected Cross-Site Scripting
vodpod-video-gallery
≤3.1.7No patch available
- Medium6.1Reflected Cross-Site Scripting
FeedList
≤2.61.03Update to 2.70.00
- Medium6.1Cross-Site Scripting
cformsII
≤11.5Update to 11.6.1
- Medium4.7Missing Authorization
WordPress
<3.0.1Update to 3.0.1
- Critical9.8SQL Injection
myLinksDump
≤1.2No patch available
- Medium6.1Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<1.5.2Update to 1.5.2
- Medium4.3Authorization Bypass
WordPress
<2.9.2Update to 2.9.2
- Critical9.8Copperleaf Photolog <= 0.16- SQL injection
Copperleaf Photolog
≤0.16No patch available
- Critical9.8SQL Injection
Pyrmont V2
≤2.0.7No patch available
- Medium6.4Cross-Site Scripting
WordPress
≤2.8.5Update to 2.8.6
- High8.8Arbitrary File Upload
WordPress
≤2.8.5Update to 2.8.6
- Medium6.1Cross-Site Scripting via tagcloud
WP Cumulus
≤1.22Update to 1.23
- Medium5.3Sensitive Information Exposure
WP Cumulus
≤1.20Update to 1.23
- High8.8Arbitrary File Upload
Piwik PRO
0.2.35 – 0.4.3Update to 0.4.4
- Medium6.5Denial of Service
WordPress
≤2.8.4Update to 2.8.5
- Critical9.8Multiple SQL Injections
wp-forum
<2.4Update to 2.4
- High7.1Cross-Site Scripting
WP Cumulus
<1.22Update to 1.22