Database
WordPress Vulnerability Database (page 1467)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium5.3 | Full Path Disclosure | CVE-2009-2432 | — | |
| High7.5 | Forced Password Reset | CVE-2009-2762 | — | |
| High7.3 | Authorization Bypass | CVE-2009-2853 | — | |
| High7.3 | Missing Authorization | CVE-2009-2854 | — | |
| Medium6.1 | Cross-Site Scripting | CVE-2009-5158 | — | |
| High7.2 | Cross-Site Scripting | CVE-2009-2851 | — | |
| Medium6.4 | SQL Injection | CVE-2009-4748 | — | |
| Medium6.1 | Sensitive Information Disclosure | CVE-2009-2334 | — | |
| Medium5.3 | Username Enumeration | CVE-2009-2335 | — | |
| Medium5.3 | Username Enumeration | CVE-2009-2336 | — | |
| Critical9.8 | SQL Injection | CVE-2009-2383 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2009-2396 | — | |
| Critical10.0 | SQL Injection | CVE-2009-2144 | — | |
| Critical9.8 | SQL Injection | CVE-2009-2122 | — | |
| Critical9.8 | Remote File Inclusion | CVE-2009-2143 | — | |
| Medium5.3 | Sensitive Information Disclosure | CVE-2009-2431 | — | |
| Critical9.8 | Local File Inclusion | CVE-2009-4672 | — | |
| Critical9.8 | Remote Code Execution | CVE-2009-2852 | — | |
| Critical9.8 | SQL Injection | CVE-2009-0968 | — | |
| Medium6.4 | Cross-Site Scripting | CVE-2009-1030 | — | |
| High7.2 | Cross-Site Scripting | CVE-2008-5278 | — | |
| Medium6.1 | Open Redirect | CVE-2008-6762 | — | |
| High7.5 | Directory Traversal | CVE-2008-5752 | — | |
| Medium5.3 | Denial of Service | CVE-2008-6767 | — | |
| Critical9.8 | Arbitrary File Upload | CVE-2008-6811 | — | |
| Critical9.8 | SQL Injection | CVE-2008-4625 | — | |
| Critical9.8 | Backdoor | — | — | |
| Critical9.8 | SQL Injection | CVE-2008-4732 | — | |
| High7.2 | SQL Injection | CVE-2008-4733 | — | |
| High8.8 | Cross-Site Request Forgery | CVE-2008-4734 | — |
- Medium5.3Full Path Disclosure
WordPress
≤2.8Update to 2.8.1
- High7.5Forced Password Reset
WordPress
≤2.8.3Update to 2.8.4
- High7.3Authorization Bypass
WordPress
≤2.8.2Update to 2.8.3
- High7.3Missing Authorization
WordPress
≤2.8.2Update to 2.8.3
- Medium6.1Cross-Site Scripting
Analyticator
<5.2.1Update to 5.2.1
- High7.2Cross-Site Scripting
WordPress
≤2.8.1Update to 2.8.2
- Medium6.4SQL Injection
my-category-order
≤2.8.7Update to 3.0.1
- Medium6.1Sensitive Information Disclosure
WordPress
≤2.8Update to 2.8.1
- Medium5.3Username Enumeration
WordPress
≤2.8Update to 2.8.1
- Medium5.3Username Enumeration
WordPress
≤2.8Update to 2.8.1
- Critical9.8SQL Injection
Related Sites
≤2.2Update to 2.2.1
- Critical9.8Remote File Inclusion
dm-albums
≤1.9.2Update to 1.9.3
- Critical10.0SQL Injection
firestats
<1.6.2Update to 1.6.2
- Critical9.8SQL Injection
Photoracer Plugin
≤1.0No patch available
- Critical9.8Remote File Inclusion
firestats
<1.6.2Update to 1.6.2
- Medium5.3Sensitive Information Disclosure
WordPress
≤2.7.1Update to 2.8
- Critical9.8Local File Inclusion
wp-lytebox
≤1.3No patch available
- Critical9.8Remote Code Execution
WP-Syntax
≤0.9.9Update to 0.9.10
- Critical9.8SQL Injection
fmoblog
≤2.1No patch available
- Medium6.4Cross-Site Scripting
WordPress MU
<2.7Update to 2.7
- High7.2Cross-Site Scripting
WordPress
≤2.6.4Update to 2.6.5
- Medium6.1Open Redirect
WordPress
<2.8.1Update to 2.8.1
- High7.5Directory Traversal
page-flip-image-gallery
≤0.2.2No patch available
- Medium5.3Denial of Service
WordPress
≤2.6.1Update to 2.7
- Critical9.8Arbitrary File Upload
WP e-Commerce
≤3.4Update to 3.6.8 RC1
- Critical9.8SQL Injection
ShiftThis
≤2.3.1No patch available
- Critical9.8Backdoor
php-shell
all versionsNo patch available
- Critical9.8SQL Injection
WP Comment Remix
<1.4.4Update to 1.4.4
- High7.2SQL Injection
WP Comment Remix
≤1.4.3Update to 1.4.4
- High8.8Cross-Site Request Forgery
WP Comment Remix
<1.4.4Update to 1.4.4