Database
WordPress Vulnerability Database (page 1432)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | — | — | |
| High7.1 | Cross-Site Scripting | — | — | |
| Medium5.3 | Information Disclosure | CVE-2013-4454 | — | |
| Medium5.3 | Cross-Site Scripting | CVE-2011-4562 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2014-4725 | — | |
| Medium5.3 | Captcha Bypass | — | — | |
| Critical9.8 | SQL Injection | — | — | |
| Medium6.1 | Cross-Site scripting | CVE-2014-4588 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2013-6342 | — | |
| Critical9.8 | SQL Injection | — | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2013-2287 | — | |
| Medium6.1 | Unauthenticated Stored Cross-Site Scripting | CVE-2013-10026 | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-3870 | — | |
| Critical9.8 | Remote Code Execution | CVE-2013-2011 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-2550 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2699 | — | |
| Medium6.1 | Cross-Site Scripting | — | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2011-5329 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4855 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4578 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2012-20003 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2013-2706 | — | |
| Medium6.1 | Cross-Site Scripting | — | — | |
| High7.2 | Cross-Site Scripting | CVE-2014-4664 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-9100 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2014-9099 | — | |
| Critical9.8 | SQL Injection | CVE-2014-5189 | — | |
| Critical9.8 | SQL Injection | CVE-2014-5200 | — | |
| Critical9.8 | SQL Injection | CVE-2014-9097 | — |
- Medium6.1Cross-Site Scripting
simple-flash-video
≤1.7No patch available
- High7.1Cross-Site Scripting
Newsletter Meenews
≤5.1.0Update to 5.2.0
- Medium5.3Information Disclosure
Portable phpMyAdmin
≤1.4.1No patch available
- Medium5.3Cross-Site Scripting
Redirection
<2.2.10Update to 2.2.10
- Critical9.8Arbitrary File Upload
MailPoet Newsletters (Previous)
≤2.6.6Update to 2.6.7
- Medium5.3Captcha Bypass
Captcha
≤3.8.1Update to 3.8.2
- Critical9.8SQL Injection
Axact Author List Widget
<3.0.0Update to 3.0.0
- Medium6.1Cross-Site scripting
Hot Files: File Sharing and Download Manager Plugin
≤1.0.0No patch available
- Medium6.1Cross-Site Scripting
Tweet Blender
≤4.0.1Update to 4.0.2
- Critical9.8SQL Injection
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤0.59Update to 0.60
- Medium6.1Multiple Cross-Site Scripting
Uploader
≤1.0.4No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Mail Subscribe List
≤2.0.9Update to 2.1
- Critical9.8Arbitrary File Upload
Contact Form 7
≤3.5.2Update to 3.5.3
- Medium6.1Cross-Site Scripting
bib2html
≤0.9.3No patch available
- Critical9.8Remote Code Execution
WP Super Cache
<1.3.2Update to 1.3.2
- High8.8Cross-Site Request Forgery
Disable Comments
<1.0.4Update to 1.0.4
- High8.8Cross-Site Request Forgery
underConstruction
<1.09Update to 1.09
- Medium6.1Cross-Site Scripting
1-flash-gallery
≤1.9.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Redirection
<2.2.9Update to 2.2.9
- High7.1Cross-Site Scripting
Polylang
<1.5.2Update to 1.5.2
- Medium6.1Reflected Cross-Site Scripting
WP App Maker
≤1.0.16.4No patch available
- Medium6.1Reflected Cross-Site Scripting
custom-tables
≤3.4.4No patch available
- High8.8Cross-Site Request Forgery
Stream Video Player
≤1.4.1No patch available
- Medium6.1Cross-Site Scripting
WP Post to PDF
≤2.3.1No patch available
- High7.2Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
≤5.1.3Update to 5.1.4
- Medium6.1Reflected Cross-Site Scripting
WhyDoWork AdSense
≤1.2No patch available
- High8.8Cross-Site Request Forgery
WhyDoWork AdSense
≤1.2No patch available
- Critical9.8SQL Injection
Lead-Octopus-Power
<1.1.1Update to 1.1.1
- Critical9.8SQL Injection
fbgorilla
all versionsNo patch available
- Critical9.8SQL Injection
WORDPRESS VIDEO GALLERY
<2.6Update to 2.6