VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

Database

WordPress Vulnerability Database (page 1452)

Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.

Severity
Signals
Software

44,153 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Vulnerability Database (page 1452)
SeverityVulnerabilityCVEInstallsPublished
Medium6.1Cross-Site Scripting
Scarletall versionsNo patch available
——
Medium6.1Cross-Site Scripting
Allure Real Estate Theme for Placester≤0.1.1No patch available
——
Medium6.1Cross-Site Scripting
WP-TopBar<3.0.5Update to 3.0.5
——
Medium6.1Reflected Cross-Site Scripting
Allure Real Estate Theme≤0.1.1No patch available
——
Critical9.1SQL Injection
WP Easy Gallery – WordPress Gallery Plugin≤2.7Update to 2.7.1
——
Medium6.1Cross-Site Scripting
Responsive Logo Slideshow<1.2Update to 1.2
CVE-2013-1759—
Medium6.1Cross-Site Scripting
Zendesk Chat<1.2.6Update to 1.2.6
CVE-2013-1808—
Medium6.1Cross-Site Scripting
Marekkis Watermark-Plugin≤0.9.4No patch available
CVE-2013-1758—
High7.51.9.11 - Full Path Disclosure
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery1.9.10 – 1.9.11Update to 2.0.0
CVE-2013-0291—
Medium5.4Cross-Site Scripting
Pinboard≤1.1.11Update to 1.1.12
CVE-2013-0286—
High7.2Authenticated (Admin+) SQL Injection
Editorial Calendar≤2.6Update to 2.7
CVE-2013-10023—
Critical9.8Remote File Inclusion
WP eCommerce Shop Styling<1.8Update to 1.8
CVE-2013-0724—
Medium6.1Reflected Cross-Site Scripting
CommentLuv<2.92.4Update to 2.92.4
CVE-2013-1409—
High7.2Multiple SQL Injections
MailPoet Newsletters (Previous)≤2.2Update to 2.2.1
CVE-2013-1408—
Medium4.7Open Redirect
Chocolate WP – Responsive Photography Theme | Photography≤1.0No patch available
——
Critical9.8Multiple Vulnerabilities
Flash Newsall versionsNo patch available
——
Medium6.1Reflected Cross-Site Scripting
yolink Search for WordPress<2.6Update to 2.6
——
Critical9.8SQL Injection
RLSWordPressSearchall versionsNo patch available
——
Critical9.8Unauthenticated Remote File Inclusion
WordPress Gallery Plugin≤1.4No patch available
CVE-2012-4919—
Critical9.8SQL Injection
WordPress Shout Box Widget≤2.0.2No patch available
——
Critical9.8SQL Injection
Portfolio Slideshow Proall versionsNo patch available
——
Critical9.8Arbitrary File Upload
Accordionall versionsNo patch available
——
High8.3Arbitrary File Upload
Homepage SlideShow≤2.3No patch available
——
Medium6.1Cross-Site Scripting via playerID Parameter
audio-player<2.0.4.6Update to 2.0.4.6
CVE-2013-1464—
Critical9.8Arbitrary File Upload
Power Zoomer≤1.2No patch available
——
High8.8Arbitrary File Upload
Levo Slideshow≤2.3No patch available
——
Critical9.8SQL Injection
Dynamic Font Replacement DFR4WP EN≤1.3 ENNo patch available
——
Critical9.8Arbitrary File Upload
Sandbox≤1.6.1No patch available
——
Medium5.3Full Path Disclosure
Sandbox≤1.6.1No patch available
——
High7.5Denial of Service and Abuse of Functionality
Chocolate WP – Responsive Photography Theme | Photographyall versionsNo patch available
——
  • Medium6.1
    Cross-Site Scripting

    Scarlet

    all versionsNo patch available

    f6d24786-676b-478a-ad9a-5c3f5ca3e85b

  • Medium6.1
    Cross-Site Scripting

    Allure Real Estate Theme for Placester

    ≤0.1.1No patch available

    1bce11fa-428d-4f44-9ce4-e12e79c43ff1

  • Medium6.1
    Cross-Site Scripting

    WP-TopBar

    <3.0.5Update to 3.0.5

    b42c0e51-676f-4f06-9e5c-b6b74bea89b5

  • Medium6.1
    Reflected Cross-Site Scripting

    Allure Real Estate Theme

    ≤0.1.1No patch available

    88290419-2086-4b43-b2b9-5d8128b208e2

  • Critical9.1
    SQL Injection

    WP Easy Gallery – WordPress Gallery Plugin

    ≤2.7Update to 2.7.1

    35e2f081-41ca-4465-933a-db5c30b058da

  • Medium6.1
    Cross-Site Scripting

    Responsive Logo Slideshow

    <1.2Update to 1.2

    CVE-2013-1759

  • Medium6.1
    Cross-Site Scripting

    Zendesk Chat

    <1.2.6Update to 1.2.6

    CVE-2013-1808

  • Medium6.1
    Cross-Site Scripting

    Marekkis Watermark-Plugin

    ≤0.9.4No patch available

    CVE-2013-1758

  • High7.5
    1.9.11 - Full Path Disclosure

    Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery

    1.9.10 – 1.9.11Update to 2.0.0

    CVE-2013-0291

  • Medium5.4
    Cross-Site Scripting

    Pinboard

    ≤1.1.11Update to 1.1.12

    CVE-2013-0286

  • High7.2
    Authenticated (Admin+) SQL Injection

    Editorial Calendar

    ≤2.6Update to 2.7

    CVE-2013-10023

  • Critical9.8
    Remote File Inclusion

    WP eCommerce Shop Styling

    <1.8Update to 1.8

    CVE-2013-0724

  • Medium6.1
    Reflected Cross-Site Scripting

    CommentLuv

    <2.92.4Update to 2.92.4

    CVE-2013-1409

  • High7.2
    Multiple SQL Injections

    MailPoet Newsletters (Previous)

    ≤2.2Update to 2.2.1

    CVE-2013-1408

  • Medium4.7
    Open Redirect

    Chocolate WP – Responsive Photography Theme | Photography

    ≤1.0No patch available

    3f937290-fa45-4ce0-84f0-a42c83cd3bdf

  • Critical9.8
    Multiple Vulnerabilities

    Flash News

    all versionsNo patch available

    58ea0c9c-f63d-4c31-b02e-a86d5fe732aa

  • Medium6.1
    Reflected Cross-Site Scripting

    yolink Search for WordPress

    <2.6Update to 2.6

    41219c9d-a10d-4006-9edc-1387dfdc8b8d

  • Critical9.8
    SQL Injection

    RLSWordPressSearch

    all versionsNo patch available

    5c79d861-e2e8-4fca-883f-79401544b0b1

  • Critical9.8
    Unauthenticated Remote File Inclusion

    WordPress Gallery Plugin

    ≤1.4No patch available

    CVE-2012-4919

  • Critical9.8
    SQL Injection

    WordPress Shout Box Widget

    ≤2.0.2No patch available

    2d10f043-df2c-4e81-bd99-e478a2dca0cf

  • Critical9.8
    SQL Injection

    Portfolio Slideshow Pro

    all versionsNo patch available

    b6cab377-0a8a-45d2-a966-4c7f100b9409

  • Critical9.8
    Arbitrary File Upload

    Accordion

    all versionsNo patch available

    8f5fa529-4c6e-465e-a281-78ba74e5a718

  • High8.3
    Arbitrary File Upload

    Homepage SlideShow

    ≤2.3No patch available

    ebcbeb7c-eadb-4541-94f0-6e85f7f3e6a1

  • Medium6.1
    Cross-Site Scripting via playerID Parameter

    audio-player

    <2.0.4.6Update to 2.0.4.6

    CVE-2013-1464

  • Critical9.8
    Arbitrary File Upload

    Power Zoomer

    ≤1.2No patch available

    c6a0811e-f02b-49d1-915e-cf7ac4b5e1f5

  • High8.8
    Arbitrary File Upload

    Levo Slideshow

    ≤2.3No patch available

    9acdbd48-8d38-4d75-b2b1-c993e25cf92a

  • Critical9.8
    SQL Injection

    Dynamic Font Replacement DFR4WP EN

    ≤1.3 ENNo patch available

    c978a252-1f77-4c8d-b51a-04ed3493ee34

  • Critical9.8
    Arbitrary File Upload

    Sandbox

    ≤1.6.1No patch available

    a3160602-6522-478d-8a99-d097472d10ac

  • Medium5.3
    Full Path Disclosure

    Sandbox

    ≤1.6.1No patch available

    ad12941f-8cbf-41c6-a261-b47075198d26

  • High7.5
    Denial of Service and Abuse of Functionality

    Chocolate WP – Responsive Photography Theme | Photography

    all versionsNo patch available

    a644ac90-6cc4-495c-b880-4ebbc237bb57

Search VulnCrest Radar

Jump to

Are you sure?