Database
WordPress Vulnerability Database (page 103)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Payments for Hubtel
≤1.0.1Update to 1.0.2
- Medium5.3Unauthenticated Information Exposure
Request a Quote – Quote Forms for Any WordPress Site
≤2.5.6No patch available
- Medium5.3Unauthenticated Insecure Direct Object Reference
Payments for Hubtel
≤1.0.1Update to 1.0.2
- Medium4.3Missing Authorization
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
≤3.47.0Update to 3.48.0
- Medium6.11.10.1 - Reflected Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
1.8 – 1.10.1Update to 1.10.2
- Medium4.3Missing Authorization
Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More
<1.4.6Update to 1.4.6
- Medium5.3Coming Soon & Maintenance <= 4.1.19 - Unauthenticated Maintenance Mode Bypass
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
≤4.1.19Update to 4.1.20
- Medium5.3Unauthenticated Payment Bypass
Paytm Payment Gateway
≤2.8.8Update to 2.8.9
- High7.2Unauthenticated Stored Cross-Site Scripting
Paytm Payment Gateway
≤2.8.8Update to 2.8.9
- Critical9.1Unauthenticated Arbitrary File and Directory Deletion
Cache Enabler
≤1.8.16Update to 1.8.17
- Critical9.1Unauthenticated Arbitrary File Deletion
BackupSheep WordPress Backup Plugin
≤1.8No patch available
- Medium5.3Missing Authorization
Hostinger Migrator
≤1.0Update to 1.1.0
- Medium4.31.4.5 - Missing Authorization
Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More
1.2.2.1 – 1.4.5Update to 1.4.7
- Medium6.1Reflected Cross-Site Scripting
Five Star Restaurant Reviews
≤2.3.13Update to 2.3.14
- High7.5Denial of Service to Unauthenticated Site Availability Exhaustion
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤6.3.10Update to 6.3.11
- High7.5Unauthenticated SQL Injection
Pro Like Button
≤1.0Update to 2.0
- Medium4.41.10.1 - Authenticated (Editor+) Stored Cross-Site Scripting
If-So Dynamic Content – Elementor & All Page Builders Personalization
1.9.9 – 1.10.1Update to 1.10.2
- High7.5Unauthenticated SQL Injection
Paytm Payment Gateway
≤2.8.8Update to 2.8.9
- Medium4.4Authenticated (Shop Manager+) Stored Cross-Site Scripting
Tabs Responsive – With WooCommerce Product Tabs Extension
≤2.5No patch available
- High8.8Cross-Site Request Forgery
Featured Image from URL (FIFU)
≤6.0.7Update to 6.0.8
- High7.2HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field
HT Contact Form – Drag & Drop Form Builder for WordPress
≤2.10.2Update to 2.10.3
- High8.8Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter
ConvertPlus
≤3.6.3Update to 3.6.4
- Medium5.3Missing Authorization
WebToffee WP Backup and Migration
≤1.6.0Update to 1.6.1
- Medium4.7Unauthenticated Open Redirect
Safe Redirect Manager
≤2.2.0Update to 2.3.0
- High7.5Authenticated (Author+) PHP Object Injection
Minimum and Maximum Quantity for WooCommerce
≤2.1.2Update to 2.1.3
- Medium5.3Unauthenticated Unauthorized Subscription Activation
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤3.0.9Update to 3.1.0
- High8.1Unauthenticated PHP Object Injection
Booking Activities
≤1.18.7.1Update to 1.18.8
- Medium6.6Authenticated (Shop Manager+) PHP Object Injection
Content Egg – Affiliate Product Importer & Price Comparison
≤6.3.1Update to 11.9.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Trusted Shops Easy Integration for WooCommerce
≤2.0.6Update to 2.0.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Classified Listing – AI-Powered Classified ads & Business Directory
≤6.1.3Update to 6.1.5