Database
WordPress Vulnerability Database (page 1436)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Cross-Site Scripting | CVE-2014-4541 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4513 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4554 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4527 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4514 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4574 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4547 | — | |
| Medium6.1 | Multiple Cross-Site Scripting | CVE-2014-4526 | — | |
| High7.5 | Server-Side Request Forgery | CVE-2014-9292 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | — | — | |
| High7.2 | Authenticated SQL Injection | CVE-2014-5186 | — | |
| Medium5.3 | Directory Traversal | CVE-2014-5181 | — | |
| Critical9.1 | Authenticated (Admin+) SQL Injection | CVE-2014-5180 | — | |
| High8.3 | Server-Side Request Forgery | — | — | |
| High8.8 | SQL Injection | CVE-2014-5185 | — | |
| High7.1 | Cross-Site Scripting | CVE-2014-4538 | — | |
| Medium6.1 | Unauthenticated Cross-Site Scripting | CVE-2014-4523 | — | |
| Medium6.1 | Cross-Site Scripting | — | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4544 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4605 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4528 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2014-4942 | — | |
| High8.8 | Authenticated SQL Injection | CVE-2014-5182 | — | |
| High7.5 | Directory Traversal | CVE-2014-4940 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4524 | — | |
| High7.5 | Path Traversal | CVE-2014-4937 | — | |
| High7.2 | SQL Injection | CVE-2014-5184 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2014-4597 | — | |
| High7.2 | Authenticated (Admin+) SQL Injection | CVE-2014-4939 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2014-4520 | — |
- Medium6.1Cross-Site Scripting
OMFG Mobile Pro
≤1.1.26No patch available
- Medium6.1Reflected Cross-Site Scripting
ActiveHelper LiveHelp Live Chat
<3.1.5Update to 3.1.5
- Medium6.1Cross-Site Scripting
SS Downloads
≤1.4.4.1Update to 1.5
- Medium6.1Cross-Site Scripting
EnvíaloSimple: Email Marketing y Newsletters
≤1.97Update to 1.98
- Medium6.1Cross-Site Scripting
WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
<3.7.0Update to 3.7.0
- Medium6.1Cross-Site Scripting
WebEngage Feedback, Survey and Notification
<2.0.1Update to 2.0.1
- Medium6.1Cross-Site Scripting
Rezgo Online Booking
<1.8.2Update to 1.8.2
- Medium6.1Multiple Cross-Site Scripting
efence
≤1.3.2No patch available
- High7.5Server-Side Request Forgery
jRSS Widget
≤1.2No patch available
- High7.2Authenticated (Admin+) SQL Injection
Ultimate Product Catalog
≤2.1Update to 2.1.1
- High7.2Authenticated SQL Injection
All Video Gallery Plugin for WordPress
≤1.2No patch available
- Medium5.3Directory Traversal
lastfm-rotation
≤1.0No patch available
- Critical9.1Authenticated (Admin+) SQL Injection
HDW Player Plugin (Video Player & Video Gallery)
≤2.4.2Update to 3.0
- High8.3Server-Side Request Forgery
All in One Social Lite
≤1.0No patch available
- High8.8SQL Injection
quartz
≤1.01.1No patch available
- High7.1Cross-Site Scripting
Malware Finder
≤1.1No patch available
- Medium6.1Unauthenticated Cross-Site Scripting
Easy Career Openings
≤0.4No patch available
- Medium6.1Cross-Site Scripting
zeList
≤0.5.11.07No patch available
- Medium6.1Cross-Site Scripting
Podcast Channels
<0.21Update to 0.21
- Medium6.1Cross-Site Scripting
ZdStatistics
≤2.0.1No patch available
- Medium6.1Cross-Site Scripting
Bugs Go Viral : Facebook Promotion Generator
≤1.3.4No patch available
- Medium5.3Sensitive Information Disclosure
WP EasyCart: Shopping Cart and eCommerce Store
≤2.0.5Update to 2.0.6
- High8.8Authenticated SQL Injection
YAWPP (Yet Another WordPress Petition Plugin)
≤1.2.1Update to 1.2.2
- High7.5Directory Traversal
Tera Charts
≤0.1Update to 1.0
- Medium6.1Cross-Site Scripting
WP Easy Post Types
<1.4.4Update to 1.4.4
- High7.5Path Traversal
BookX
≤1.7No patch available
- High7.2SQL Injection
stripshow
≤2.5.2No patch available
- Medium6.1Reflected Cross-Site Scripting
WordPress Social Invitations – Lite
≤1.4.4.2Update to 1.4.4.3
- High7.2Authenticated (Admin+) SQL Injection
ENL Newsletter
≤1.0.1No patch available
- Medium6.1Cross-Site Scripting
DMCA WaterMarker
<1.1Update to 1.1