Database
WordPress Vulnerability Database (page 1036)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
Flexible Woocommerce Checkout Field Editor
≤2.0.1No patch available
- Medium6.1Cross-Site Scripting
WP Photo Album Plus
≤8.5.02.005Update to 8.6.01.005
- Medium4.3Cross-Site Request Forgery
File Manager for Google Drive – Integrate Google Drive
≤1.3.4Update to 1.3.5
- Medium6.1Reflected Cross-Site Scripting
Email Subscription Popup — Newsletter & GDPR Consent
≤1.2.18Update to 1.2.19
- Critical9.8Unauthenticated PHP Object Injection
Genesis Simple Love
≤2.0No patch available
- Medium5.3Login Page Disclosure on Multi-site
Ultimate Dashboard – Custom WordPress Dashboard
≤3.7.10Update to 3.7.11
- Medium6.5Authenticated(Contributor+) Denial of Service
Code Embed
≤2.3.6Update to 2.3.7
- Critical9.8Unauthenticated PHP Object Injection
Soledad
≤8.4.1Update to 8.4.2
- High7.2Authenticated (Shop Manager+) Arbitrary File Upload
Symbiostock – Sell Photos Online For Free!
≤6.0.0No patch available
- Medium4.3Cross-Site Request Forgery
CSV Importer
≤0.3.8Update to 0.3.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WooPayments: Integrated WooCommerce Payments
≤6.4.2Update to 6.5.0
- Medium5.3Missing Authorization
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤5.2.3.0Update to 5.2.3.1
- Medium5.4Cross-Site Request Forgery via delete_profiles_data
FOX – Currency Switcher Professional for WooCommerce
≤1.4.1.4Update to 1.4.1.5
- Medium5.3IP Spoofing
WP Photo Album Plus
≤8.5.02.005Update to 8.6.01.005
- High8.8Authenticated (Contributor+) PHP Object Injection
Structured Content (JSON-LD) #wpsc
≤1.5.3Update to 1.6.0
- Medium4.3Cross-Site Request Forgery
LiveChat – Live Chat Plugin for WP Websites
≤4.5.15Update to 4.5.16
- Medium4.3Cross-Site Request Forgery
Product Catalog Feed by PixelYourSite
≤2.1.1Update to 2.2.0
- Critical9.8Unauthenticated Arbitrary File Upload
WappPress – Convert Site to App Fast – WordPress to Mobile App Builder
≤5.0.3Update to 6.0.0
- Medium6.1Reflected Cross-Site Scripting
Soledad
≤8.4.1Update to 8.4.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Spectra Legacy – Gutenberg Blocks
≤2.7.9Update to 2.7.10
- Medium4.3Cross-Site Request Forgery
Fix My Feed RSS Repair
≤1.4No patch available
- Medium4.3Cross-Site Request Forgery
CSprite
≤1.1No patch available
- Medium5.4Missing Authorization
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.1.10Update to 6.1.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Video Popup – Video Lightbox for YouTube, Vimeo & MP4
≤1.1.3Update to 1.1.4
- Medium6.1Reflected Cross-Site Scripting
Ultra Addons for Contact Form 7
≤3.2.0Update to 3.2.1
- Medium4.3Cross-Site Request Forgery
OttoKit: All-in-One Automation Platform
≤1.0.23Update to 1.0.24
- Medium4.3Cross-Site Request Forgery
Block for Font Awesome Icons – Searchable Icon Picker, SVG, FA 7
≤1.4.0Update to 1.4.1
- High7.2Authenticated (Administrator+) SQL Injection
Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance
≤3.1.2Update to 3.1.3
- Medium5.3Cross-Site Request Forgery via consume_post
Gift Up Gift Cards for WordPress and WooCommerce
≤2.21.3Update to 2.22
- Critical9.8Unauthenticated SQL Injection
Couponis Demo
<2.2Update to 2.2