Database
WordPress Vulnerability Database (page 1370)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | Full Path Disclosure | CVE-2009-2432 | — | |
| High7.5 | Forced Password Reset | CVE-2009-2762 | — | |
| High7.3 | Missing Authorization | CVE-2009-2854 | — | |
| High7.3 | Authorization Bypass | CVE-2009-2853 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2009-5158 | — | |
| High7.2 | Cross-Site Scripting | CVE-2009-2851 | — | |
| Medium6.4 | SQL Injection | CVE-2009-4748 | — | |
| Medium5.3 | Username Enumeration | CVE-2009-2336 | — | |
| Medium6.1 | Sensitive Information Disclosure | CVE-2009-2334 | — | |
| Medium5.3 | Username Enumeration | CVE-2009-2335 | — | |
| Critical9.8 | SQL Injection | CVE-2009-2383 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2009-2396 | — | |
| Critical10.0 | SQL Injection | CVE-2009-2144 | — | |
| Critical9.8 | SQL Injection | CVE-2009-2122 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2009-2143 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2009-2431 | — | |
| Critical9.8 | Local File Inclusion | CVE-2009-4672 | — | |
| Critical9.8 | Remote Code Execution | CVE-2009-2852 | — | |
| Critical9.8 | SQL Injection | CVE-2009-0968 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2009-1030 | — | |
| High7.2 | Cross-Site Scripting | CVE-2008-5278 | — | |
| Medium5.3 | Denial of Service | CVE-2008-6767 | — | |
| High7.5 | Directory Traversal | CVE-2008-5752 | — | |
| Medium6.1 | Open Redirect | CVE-2008-6762 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2008-6811 | — | |
| Critical9.8 | SQL Injection | CVE-2008-4625 | — | |
| High7.2 | SQL Injection | CVE-2008-4733 | — | |
| Critical9.8 | SQL Injection | CVE-2008-4732 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2008-4734 | — | |
| High8.1 | Arbitrary User Password Reset | CVE-2008-4106 | — |
- Medium5.3Full Path Disclosure
WordPress
≤2.8Update to 2.8.1
- High7.5Forced Password Reset
WordPress
≤2.8.3Update to 2.8.4
- High7.3Missing Authorization
WordPress
≤2.8.2Update to 2.8.3
- High7.3Authorization Bypass
WordPress
≤2.8.2Update to 2.8.3
- Medium6.1Cross-Site Scripting
Analyticator
<5.2.1Update to 5.2.1
- High7.2Cross-Site Scripting
WordPress
≤2.8.1Update to 2.8.2
- Medium6.4SQL Injection
my-category-order
≤2.8.7Update to 3.0.1
- Medium5.3Username Enumeration
WordPress
≤2.8Update to 2.8.1
- Medium6.1Sensitive Information Disclosure
WordPress
≤2.8Update to 2.8.1
- Medium5.3Username Enumeration
WordPress
≤2.8Update to 2.8.1
- Critical9.8SQL Injection
Related Sites
≤2.2Update to 2.2.1
- Critical9.8Remote File Inclusion
dm-albums
≤1.9.2Update to 1.9.3
- Critical10.0SQL Injection
firestats
<1.6.2Update to 1.6.2
- Critical9.8SQL Injection
Photoracer Plugin
≤1.0No patch available
- Critical9.8Remote File Inclusion
firestats
<1.6.2Update to 1.6.2
- Medium5.3Sensitive Information Disclosure
WordPress
≤2.7.1Update to 2.8
- Critical9.8Local File Inclusion
wp-lytebox
≤1.3No patch available
- Critical9.8Remote Code Execution
WP-Syntax
≤0.9.9Update to 0.9.10
- Critical9.8SQL Injection
fmoblog
≤2.1No patch available
- Medium6.4Cross-Site Scripting
WordPress MU
<2.7Update to 2.7
- High7.2Cross-Site Scripting
WordPress
≤2.6.4Update to 2.6.5
- Medium5.3Denial of Service
WordPress
≤2.6.1Update to 2.7
- High7.5Directory Traversal
page-flip-image-gallery
≤0.2.2No patch available
- Medium6.1Open Redirect
WordPress
<2.8.1Update to 2.8.1
- Critical9.8Arbitrary File Upload
WP e-Commerce
≤3.4Update to 3.6.8 RC1
- Critical9.8SQL Injection
ShiftThis
≤2.3.1No patch available
- High7.2SQL Injection
WP Comment Remix
≤1.4.3Update to 1.4.4
- Critical9.8SQL Injection
WP Comment Remix
<1.4.4Update to 1.4.4
- High8.8Cross-Site Request Forgery
WP Comment Remix
<1.4.4Update to 1.4.4
- High8.1Arbitrary User Password Reset
WordPress
≤2.6.1Update to 2.6.2