Database
WordPress Vulnerability Database (page 1379)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
- Critical9.8Unauthenticated PHP Object injection
Google Forms
<0.91Update to 0.91
- Medium5.3Username Enumeration Bypasses
Stop User Enumeration
≤1.3.4Update to 1.3.5
- Medium5.3Unauthenticated Username Enumeration
Stop User Enumeration
≤1.3.8Update to 1.3.9
- Critical9.9Local File Inclusion
Ad Widget for WordPress
<2.12.0Update to 2.12.0
- Medium4.3Path Disclosure
WordPress
≤4.7.1Update to 3.7.18 or 3.8.18 or 3.9.16 or 4.0.15 or 4.1.15 or 4.2.12 or 4.3.8 or 4.4.7 or 4.5.6 or 4.6.3 or 4.7.2
- Medium4.3Path Traversal to Sensitive Information Disclosure
Backup, Restore and Migrate your sites with XCloner
≤3.1.4Update to 3.1.5
- High7.2Server-Side Request Forgery
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
<4.5.11Update to 4.5.11
- Critical10.02.7.3 - Unauthenticated Arbitrary File Deletion
BuddyPress
2.0 – 2.7.3Update to 2.7.4
- High8.1Arbitrary File Deletion
Image Slider
<1.1.90Update to 1.1.90
- Medium6.4Cross-Site Scripting
Chained Quiz
≤0.9.8Update to 0.9.9
- Critical9.8Arbitary File Upload
rtMedia for WordPress, BuddyPress and bbPress
<4.2.1Update to 4.2.1
- Medium5.4Missing Authorization & Cross-Site Request Forgery
copy-me
≤1.0.0No patch available
- Medium6.3Authenticated SQL Injection
WP Private Messages
≤1.0.1No patch available
- High7.2Authenticated (Admin+) SQL Injection
ZM Gallery
≤1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
Xtreme Locator
≤3.0.1No patch available
- High7.2Authenticated (Admin+) SQL Injection
ZX_CSV Upload
≤1No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
<4.7.9Update to 4.7.9
- High8.8SQL Injection
Podlove Podcast Publisher
<2.3.16Update to 2.3.16
- Medium6.1Reflected Cross-Site Scripting
MC4WP: Mailchimp for WordPress
<4.0.11Update to 4.0.11
- High8.8SQL Injection
WP Support Plus Responsive Ticket System
≤7.1.4Update to 8.0.0
- Critical9.8Unauthenticated PHP Object Injection
Google Analytics Counter Tracker
<3.5.0Update to 3.5.0
- Critical9.8Arbitrary File Upload
Delete All Comments
≤2.0No patch available
- Critical9.0PHP Object Injection
BP Profile Search
≤4.5.3Update to 4.6
- High8.8Cross-Site Request Forgery
Multisite Post Duplicator
≤1.7.6No patch available
- Medium6.1Reflected Cross-Site Scripting
Hubbub Lite – Fast, free social sharing and follow buttons
≤1.2.5Update to 1.2.6
- Medium5.3Sensitive Data Exposure
WooCommerce Email Test
≤1.5Update to 1.6
- High8.3Server Side Request Forgery
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization
≤4.5.8Update to 4.5.9
- Medium5.5Authenticated Stored Cross-Site Scripting
WooCommerce
<2.6.9Update to 2.6.9
- High8.8Authenticated SQL Injection
Simple Personal Message
<2.0.0Update to 2.0.0
- Critical9.8Missing Authorization to Password Reset
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤1.3.75Update to 1.3.76