Database

WordPress Vulnerability Database (page 1450)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1450)
Severity	Vulnerability	CVE	Installs	Published
High7.2	XML External Entity Injection Advanced XML Reader≤0.3.4No patch available	—	—	May 2, 2013
Critical9.1	External Entity Injection Advanced XML Reader≤0.3.4No patch available	—	—	May 2, 2013
Medium6.3	Cross-Site Request Forgery Easy Plugin for AdSense<6.10Update to 6.10	CVE-2013-2702	—	Apr 30, 2013
Critical10.0	Multiple Vulnerabilities Feather12all versionsNo patch available	—	—	Apr 24, 2013
Medium6.1	Multiple Vulnerabilities Studio Zen \| Photography Theme for WordPress≤1.6No patch available	—	—	Apr 24, 2013
Critical10.0	Multiple Vulnerabilities Imperial Themes Fairytaleall versionsNo patch available	—	—	Apr 24, 2013
Medium6.1	Cross-Site Scripting Studio Zen \| Photography Theme for WordPressall versionsNo patch available	—	—	Apr 24, 2013
Critical10.0	Multiple Vulnerabilities Photocratiall versionsNo patch available	—	—	Apr 24, 2013
Critical10.0	Multiple Vulnerabilities Music≤1.5No patch available	—	—	Apr 24, 2013
High7.6	Cross-Site Request Forgery Facebook Members<5.0.5Update to 5.0.5	CVE-2013-2703	—	Apr 22, 2013
High7.1	Cross-Site Request Forgery WP Webmaster<8.2.4Update to 8.2.4	CVE-2013-2696	—	Apr 19, 2013
High8.8	Cross-Site Request Forgery to Cross-Site Scripting FourSquare Checkins<1.3Update to 1.3	CVE-2013-2709	—	Apr 19, 2013
Critical9.1	Multiple Vulnerabilities Colormixall versionsNo patch available	—	—	Apr 18, 2013
Medium6.1	Reflected Cross-Site Scripting EELV Newsletter≤3.3.0Update to 3.3.1	CVE-2013-10028	—	Apr 17, 2013
Critical9.8	SQL Injection SpiderVPlayer≤2.1No patch available	CVE-2013-3532	—	Apr 11, 2013
Critical9.8	SQL Injection Spiffy XSPF Player≤0.1No patch available	CVE-2013-3530	—	Apr 10, 2013
High8.8	Cross-Site Request Forgery GA Universal<1.0.1Update to 1.0.1	—	—	Apr 10, 2013
Medium5.3	Spam Link Injection Social Media Widget4.0 – 4.0Update to 4.0.1	—	—	Apr 9, 2013
Medium6.1	Cross-Site Scripting Traffic Analyzer≤3.4.1Update to 3.4.2	CVE-2013-3526	—	Apr 9, 2013
Medium6.1	Cross-Site Scripting wp-download-manager<1.61Update to 1.61	CVE-2013-2697	—	Apr 8, 2013
Critical9.8	Arbitrary File Upload Social Media Widget≤4.0Update to 4.0.1	CVE-2013-1949	—	Apr 8, 2013
High7.1	Cross-Site Request Forgery WP-Print<2.52Update to 2.52	CVE-2013-2693	—	Apr 5, 2013
Medium5.3	Cross-Site Scripting Toolset Types – Custom Post Types, Custom Fields and Taxonomies≤1.2.1.1Update to 1.2.1.2	—	—	Apr 4, 2013
Medium5.5	Authenticated (Admin+) Stored Cross-Site Scripting Feedweb<1.9Update to 1.9	CVE-2013-3720	—	Apr 3, 2013
High8.8	Cross-Site Request Forgery DrawBlog<0.81Update to 0.81	—	—	Apr 3, 2013
Medium6.1	Cross-Site Scripting Kioskproxall versionsNo patch available	—	—	Apr 3, 2013
High8.8	Cross-Site Request Forgery Simple Fields<1.2Update to 1.2	CVE-2013-7476	—	Apr 1, 2013
High7.2	Cross-Site Scripting WP FuneralPress≤1.1.6Update to 1.1.7	CVE-2013-3529	—	Mar 31, 2013
High8.8	Cross-Site Request Forgery WP125≤1.4.9Update to 1.5.0	CVE-2013-2700	—	Mar 26, 2013
High7.2	SQL Injection Album and Image Gallery with Lightbox – Flagallery Photo Portfolio≤2.55Update to 2.56	—	—	Mar 25, 2013

High7.2
XML External Entity Injection
Advanced XML Reader
≤0.3.4No patch available
80d976f3-cf78-498e-a3c3-a88624426414May 2, 2013
Critical9.1
External Entity Injection
Advanced XML Reader
≤0.3.4No patch available
120e6a19-fae3-4083-a72e-36867e7eb18aMay 2, 2013
Medium6.3
Cross-Site Request Forgery
Easy Plugin for AdSense
<6.10Update to 6.10
CVE-2013-2702Apr 30, 2013
Critical10.0
Multiple Vulnerabilities
Feather12
all versionsNo patch available
1261ad29-e4c1-4385-9f41-d3f3eecbb7dcApr 24, 2013
Medium6.1
Multiple Vulnerabilities
Studio Zen | Photography Theme for WordPress
≤1.6No patch available
2d9bf916-cdbf-410b-95bb-ca7ce6658e1bApr 24, 2013
Critical10.0
Multiple Vulnerabilities
Imperial Themes Fairytale
all versionsNo patch available
9b41efbd-bd47-415f-8de7-f30b3a7cf326Apr 24, 2013
Medium6.1
Cross-Site Scripting
Studio Zen | Photography Theme for WordPress
all versionsNo patch available
849d0d4a-bc4c-4a45-a2db-0ad12ddcf5e4Apr 24, 2013
Critical10.0
Multiple Vulnerabilities
Photocrati
all versionsNo patch available
99746867-597b-49df-aa9e-548456a58542Apr 24, 2013
Critical10.0
Multiple Vulnerabilities
Music
≤1.5No patch available
712887d9-25fd-4d8f-a2e6-e6f2855f5ddbApr 24, 2013
High7.6
Cross-Site Request Forgery
Facebook Members
<5.0.5Update to 5.0.5
CVE-2013-2703Apr 22, 2013
High7.1
Cross-Site Request Forgery
WP Webmaster
<8.2.4Update to 8.2.4
CVE-2013-2696Apr 19, 2013
High8.8
Cross-Site Request Forgery to Cross-Site Scripting
FourSquare Checkins
<1.3Update to 1.3
CVE-2013-2709Apr 19, 2013
Critical9.1
Multiple Vulnerabilities
Colormix
all versionsNo patch available
b50f98ca-6a51-4de8-9e89-004532ba8f96Apr 18, 2013
Medium6.1
Reflected Cross-Site Scripting
EELV Newsletter
≤3.3.0Update to 3.3.1
CVE-2013-10028Apr 17, 2013
Critical9.8
SQL Injection
SpiderVPlayer
≤2.1No patch available
CVE-2013-3532Apr 11, 2013
Critical9.8
SQL Injection
Spiffy XSPF Player
≤0.1No patch available
CVE-2013-3530Apr 10, 2013
High8.8
Cross-Site Request Forgery
GA Universal
<1.0.1Update to 1.0.1
6e953bc0-a934-43fc-8147-4555dde069ccApr 10, 2013
Medium5.3
Spam Link Injection
Social Media Widget
4.0 – 4.0Update to 4.0.1
85290224-a051-4913-83c7-f54f2b67621eApr 9, 2013
Medium6.1
Cross-Site Scripting
Traffic Analyzer
≤3.4.1Update to 3.4.2
CVE-2013-3526Apr 9, 2013
Medium6.1
Cross-Site Scripting
wp-download-manager
<1.61Update to 1.61
CVE-2013-2697Apr 8, 2013
Critical9.8
Arbitrary File Upload
Social Media Widget
≤4.0Update to 4.0.1
CVE-2013-1949Apr 8, 2013
High7.1
Cross-Site Request Forgery
WP-Print
<2.52Update to 2.52
CVE-2013-2693Apr 5, 2013
Medium5.3
Cross-Site Scripting
Toolset Types – Custom Post Types, Custom Fields and Taxonomies
≤1.2.1.1Update to 1.2.1.2
d7d8d1e9-04d6-43f0-86a1-386cc1255802Apr 4, 2013
Medium5.5
Authenticated (Admin+) Stored Cross-Site Scripting
Feedweb
<1.9Update to 1.9
CVE-2013-3720Apr 3, 2013
High8.8
Cross-Site Request Forgery
DrawBlog
<0.81Update to 0.81
05448e64-6179-4409-a197-7cdc3c4f1563Apr 3, 2013
Medium6.1
Cross-Site Scripting
Kioskprox
all versionsNo patch available
71bf0ae5-7c32-42ac-a9bc-96cb1269a458Apr 3, 2013
High8.8
Cross-Site Request Forgery
Simple Fields
<1.2Update to 1.2
CVE-2013-7476Apr 1, 2013
High7.2
Cross-Site Scripting
WP FuneralPress
≤1.1.6Update to 1.1.7
CVE-2013-3529Mar 31, 2013
High8.8
Cross-Site Request Forgery
WP125
≤1.4.9Update to 1.5.0
CVE-2013-2700Mar 26, 2013
High7.2
SQL Injection
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤2.55Update to 2.56
928b4c4f-0614-410a-857b-90037770cfbfMar 25, 2013