Database

WordPress Vulnerability Database (page 1445)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1445)
Severity	Vulnerability	CVE	Installs	Published
Critical9.8	Arbitrary File Upload MoneyThemeall versionsNo patch available	—	—	Oct 29, 2013
Medium6.1	Reflected Cross-Site Scripting Gallery Bank – WordPress Photo Gallery Plugin<2.0.20Update to 2.0.20	—	—	Oct 28, 2013
Medium6.1	Cross-Site Scripting MoneyThemeall versionsNo patch available	—	—	Oct 28, 2013
Critical9.8	Cross-Site Request Forgery and Arbitrary File Upload curvoall versionsNo patch available	—	—	Oct 27, 2013
Medium6.1	Cross-Site Scripting MobileChief≤1.5.7No patch available	—	—	Oct 26, 2013
Critical9.8	Arbitrary File Upload Geo Places 4 Theme beta≤4betaUpdate to 5	—	—	Oct 24, 2013
Critical9.8	Arbitrary File Upload saico≤1.0.2No patch available	—	—	Oct 24, 2013
Critical9.1	Authentication Bypass Portable phpMyAdmin≤1.5.0No patch available	CVE-2013-4462	—	Oct 24, 2013
Critical9.8	Arbitrary File Upload Daily Deal by Templatic≤2.2.4No patch available	—	—	Oct 23, 2013
High8.8	Cross-Site Request Forgery to Arbitrary File Upload Daily Deal by Templatic≤3.0.10No patch available	—	—	Oct 23, 2013
High7.1	Cross-Site Request Forgery and to Cross-Site Scripting Blue Wrench Video Widget≤1.0.5Update to 2.0.0	CVE-2013-6797	—	Oct 23, 2013
Critical9.8	Local File Inclusion Payment Gateways Caller for WP e-Commerce<0.1.1Update to 0.1.1	—	—	Oct 23, 2013
Critical9.8	Arbitrary File Upload WPLocalPlacesall versionsNo patch available	—	—	Oct 20, 2013
Medium6.1	Reflected Cross-Site Scripting videowallall versionsNo patch available	—	—	Oct 19, 2013
Critical9.8	Arbitrary File Upload AREA53≤1.0.5No patch available	—	—	Oct 19, 2013
Medium6.1	Cross-Site Scripting dhtmlxspreadsheet≤2.0No patch available	CVE-2013-6281	—	Oct 18, 2013
Medium6.1	Cross-Site Scripting Quick PayPal Payments: Payment Button & Form<3.1Update to 3.1	—	—	Oct 18, 2013
High8.8	Cross-Site Request Forgery Social Sharing Toolkit≤2.1.1Update to 2.1.2	CVE-2013-2701	—	Oct 17, 2013
Medium6.1	Cross-Site Scripting WooCommerce≤2.0.17Update to 2.0.18	—	—	Oct 17, 2013
Medium6.1	Cross-Site Scripting WP Image Resizerall versionsNo patch available	—	—	Oct 16, 2013
High7.2	Stored Cross Site Scripting Video Metabox≤1.1Update to 1.1.1	—	—	Oct 15, 2013
Medium6.4	Authenticated (Subscriber+) Stored Cross-Site Scripting Dexs PM System≤1.0.1No patch available	—	—	Oct 15, 2013
Medium6.1	Cross-Site Scripting Finalistall versionsNo patch available	—	—	Oct 14, 2013
Medium6.1	Cross-Site Scripting Cart66 Lite :: WordPress Ecommerce<1.5.1.15Update to 1.5.1.15	CVE-2013-5978	—	Oct 11, 2013
Medium4.3	Information Disclosure SL User Create<0.2.5Update to 0.2.5	—	—	Oct 11, 2013
Critical9.8	SQL Injection WordPress Landing Pages<1.2.3Update to 1.2.3	CVE-2013-6243	—	Oct 10, 2013
Critical9.8	SQL Injection Wp-ImageZoom≤1.0.7Update to 1.1.0	—	—	Oct 9, 2013
Medium4.3	Cross-Site Request Forgery Blogger Importer≤0.5Update to 0.6	CVE-2013-10027	—	Oct 8, 2013
Critical9.8	Time-Based Blind SQL Injection WPRealty≤2.9.1No patch available	—	—	Oct 8, 2013
Critical9.8	Remote Code Execution Woopra Analytics Plugin<1.4.3.2Update to 1.4.3.2	—	—	Oct 7, 2013

Critical9.8
Arbitrary File Upload
MoneyTheme
all versionsNo patch available
ba1004c7-52f4-4fea-b820-dd11b2264e15Oct 29, 2013
Medium6.1
Reflected Cross-Site Scripting
Gallery Bank – WordPress Photo Gallery Plugin
<2.0.20Update to 2.0.20
f4d41f7f-f0c6-4e50-bf5f-37ee25415f43Oct 28, 2013
Medium6.1
Cross-Site Scripting
MoneyTheme
all versionsNo patch available
83fd4f00-e8a8-4a33-af6b-20ff539fbfebOct 28, 2013
Critical9.8
Cross-Site Request Forgery and Arbitrary File Upload
curvo
all versionsNo patch available
e8021ef2-e1ce-442a-965a-b2628fe48964Oct 27, 2013
Medium6.1
Cross-Site Scripting
MobileChief
≤1.5.7No patch available
e43482e1-7e11-49a6-bb44-0db421b51ed1Oct 26, 2013
Critical9.8
Arbitrary File Upload
Geo Places 4 Theme beta
≤4betaUpdate to 5
02fe4a33-d059-461c-a03f-b7306ce6193fOct 24, 2013
Critical9.8
Arbitrary File Upload
saico
≤1.0.2No patch available
056d26da-6e43-4cc6-b2fd-13a5947a814eOct 24, 2013
Critical9.1
Authentication Bypass
Portable phpMyAdmin
≤1.5.0No patch available
CVE-2013-4462Oct 24, 2013
Critical9.8
Arbitrary File Upload
Daily Deal by Templatic
≤2.2.4No patch available
ea9ee672-76d3-4d6a-b309-cd0023ca6c0dOct 23, 2013
High8.8
Cross-Site Request Forgery to Arbitrary File Upload
Daily Deal by Templatic
≤3.0.10No patch available
37f704bf-82bc-44f7-8b3c-cbf117732aafOct 23, 2013
High7.1
Cross-Site Request Forgery and to Cross-Site Scripting
Blue Wrench Video Widget
≤1.0.5Update to 2.0.0
CVE-2013-6797Oct 23, 2013
Critical9.8
Local File Inclusion
Payment Gateways Caller for WP e-Commerce
<0.1.1Update to 0.1.1
9766a657-1cf2-448a-bd66-a27c0ebd8261Oct 23, 2013
Critical9.8
Arbitrary File Upload
WPLocalPlaces
all versionsNo patch available
73115c27-86f1-4421-9fe5-bf5d8cf54d9fOct 20, 2013
Medium6.1
Reflected Cross-Site Scripting
videowall
all versionsNo patch available
dd112c38-e6c1-435c-b62d-8fab06e90eb6Oct 19, 2013
Critical9.8
Arbitrary File Upload
AREA53
≤1.0.5No patch available
b8652b40-480c-4d53-b1c8-e1dcfbd8a4a4Oct 19, 2013
Medium6.1
Cross-Site Scripting
dhtmlxspreadsheet
≤2.0No patch available
CVE-2013-6281Oct 18, 2013
Medium6.1
Cross-Site Scripting
Quick PayPal Payments: Payment Button & Form
<3.1Update to 3.1
6e3524a6-4f12-4640-96a0-da60afa0b770Oct 18, 2013
High8.8
Cross-Site Request Forgery
Social Sharing Toolkit
≤2.1.1Update to 2.1.2
CVE-2013-2701Oct 17, 2013
Medium6.1
Cross-Site Scripting
WooCommerce
≤2.0.17Update to 2.0.18
e1eeabdb-f1c0-49c5-9234-8ff4eaa38087Oct 17, 2013
Medium6.1
Cross-Site Scripting
WP Image Resizer
all versionsNo patch available
ee5af42d-71d8-4e65-bd74-55456480da8bOct 16, 2013
High7.2
Stored Cross Site Scripting
Video Metabox
≤1.1Update to 1.1.1
5e49afbd-9038-4d1d-b545-4dc86bb1be61Oct 15, 2013
Medium6.4
Authenticated (Subscriber+) Stored Cross-Site Scripting
Dexs PM System
≤1.0.1No patch available
b9985992-e64c-4292-9738-cd38fb44a6f0Oct 15, 2013
Medium6.1
Cross-Site Scripting
Finalist
all versionsNo patch available
30b4b98e-c566-4249-85a4-bfb0b5d5ac5dOct 14, 2013
Medium6.1
Cross-Site Scripting
Cart66 Lite :: WordPress Ecommerce
<1.5.1.15Update to 1.5.1.15
CVE-2013-5978Oct 11, 2013
Medium4.3
Information Disclosure
SL User Create
<0.2.5Update to 0.2.5
d0f5b9b7-2482-4f25-b50e-e2d9b3ef4902Oct 11, 2013
Critical9.8
SQL Injection
WordPress Landing Pages
<1.2.3Update to 1.2.3
CVE-2013-6243Oct 10, 2013
Critical9.8
SQL Injection
Wp-ImageZoom
≤1.0.7Update to 1.1.0
e57f7912-4af3-4dcb-b267-afec1c373b00Oct 9, 2013
Medium4.3
Cross-Site Request Forgery
Blogger Importer
≤0.5Update to 0.6
CVE-2013-10027Oct 8, 2013
Critical9.8
Time-Based Blind SQL Injection
WPRealty
≤2.9.1No patch available
81354461-70a9-4a5d-9a75-1f2445f7e8aaOct 8, 2013
Critical9.8
Remote Code Execution
Woopra Analytics Plugin
<1.4.3.2Update to 1.4.3.2
a22932d8-14d4-43a1-86ba-7afadc0bec1aOct 7, 2013