Database
WordPress Vulnerability Database (page 103)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.6Authenticated (Editor+) PHP Object Injection
Responsive Slider Gallery – Responsive Image Photo Slider
≤1.5.5Update to 1.5.6
- High7.5Unauthenticated SQL Injection
Books Gallery – Book Showcase, Library & Affiliate Plugin
≤4.8.3Update to 4.8.4
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
oik
≤4.15.4Update to 4.16.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Download Manager
≤3.3.70Update to 3.3.71
- Medium5.33.47.14 - Missing Authorization
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
3.37.14 – 3.47.14Update to 3.48.0
- High8.1Authenticated (Author+) Arbitrary File Deletion
WEBO MCP
≤3.0.18Update to 3.0.22
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Pixfort Core
<4.3.3Update to 4.3.3
- Medium5.3Unauthenticated Information Exposure
Payments for Hubtel
≤1.0.1Update to 1.0.2
- Medium5.3Missing Authorization
Payments for Hubtel
≤1.0.1Update to 1.0.2
- Medium5.3Unauthenticated Information Exposure
Request a Quote – Quote Forms for Any WordPress Site
≤2.5.6No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Payments for Hubtel
≤1.0.1Update to 1.0.2
- Medium4.3Missing Authorization
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
≤3.47.0Update to 3.48.0
- Medium6.11.10.1 - Reflected Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
1.8 – 1.10.1Update to 1.10.2
- Medium4.3Missing Authorization
Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More
<1.4.6Update to 1.4.6
- Medium5.3Coming Soon & Maintenance <= 4.1.19 - Unauthenticated Maintenance Mode Bypass
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
≤4.1.19Update to 4.1.20
- Medium5.3Unauthenticated Payment Bypass
Paytm Payment Gateway
≤2.8.8Update to 2.8.9
- High7.2Unauthenticated Stored Cross-Site Scripting
Paytm Payment Gateway
≤2.8.8Update to 2.8.9
- Critical9.1Unauthenticated Arbitrary File and Directory Deletion
Cache Enabler
≤1.8.16Update to 1.8.17
- Critical9.1Unauthenticated Arbitrary File Deletion
BackupSheep WordPress Backup Plugin
≤1.8No patch available
- Medium5.3Missing Authorization
Hostinger Migrator
≤1.0Update to 1.1.0
- Medium4.31.4.5 - Missing Authorization
Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More
1.2.2.1 – 1.4.5Update to 1.4.7
- Medium6.1Reflected Cross-Site Scripting
Five Star Restaurant Reviews
≤2.3.13Update to 2.3.14
- High7.5Denial of Service to Unauthenticated Site Availability Exhaustion
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤6.3.10Update to 6.3.11
- High7.5Unauthenticated SQL Injection
Pro Like Button
≤1.0Update to 2.0
- Medium4.41.10.1 - Authenticated (Editor+) Stored Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
1.9.9 – 1.10.1Update to 1.10.2
- High7.5Unauthenticated SQL Injection
Paytm Payment Gateway
≤2.8.8Update to 2.8.9
- Medium4.4Authenticated (Shop Manager+) Stored Cross-Site Scripting
Tabs Responsive – With WooCommerce Product Tabs Extension
≤2.5No patch available
- High8.8Cross-Site Request Forgery
Featured Image from URL (FIFU)
≤6.0.7Update to 6.0.8
- High7.2HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field
HT Contact Form – Drag & Drop Form Builder for WordPress
≤2.10.2Update to 2.10.3
- High8.8Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter
ConvertPlus
≤3.6.3Update to 3.6.4