Database
WordPress Vulnerability Database (page 1037)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Unauthenticated Arbitrary File Upload
Piotnet Forms
≤1.0.28Update to 1.0.29
- Medium4.3Missing Authorization
Bulk Edit Post Titles
≤5.0.0No patch available
- Medium5.5Authenticated (Shop manager+) Stored Cross-Site Scripting
Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship
≤2.2.27Update to 2.2.28
- Medium5.3Unauthenticated Information Disclsoure
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)
≤3.11.0Update to 3.11.1
- Medium4.3Cross-Site Request Forgery
WPsoonOnlinePage
≤1.9No patch available
- Critical9.8Unauthenticated Sensitive Information Exposure
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.5.7Update to 1.5.7.1
- Critical9.8Unauthenticated SQL Injection
Adifier - Classified Ads WordPress Theme
<3.1.4Update to 3.1.4
- Medium5.4Authenticated (Subscriber+) Server-Side Request Forgery
SpeedyCache – Cache, Optimization, Performance
≤1.1.2Update to 1.1.3
- Critical9.8Unauthenticated Arbitrary File Upload
MW WP Form
≤5.0.1Update to 5.0.2
- High7.2Authenticated (Administrator+) SQL Injection
Advanced Database Cleaner – Optimize & Clean Database to Speed Up Site Performance
≤3.1.2Update to 3.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Video Popup – Video Lightbox for YouTube, Vimeo & MP4
≤1.1.3Update to 1.1.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Guest Author
≤2.3Update to 2.4
- Medium4.3Cross-Site Request Forgery
OttoKit: All-in-One Automation Platform
≤1.0.23Update to 1.0.24
- Medium4.3Missing Authorization
WP Booking System – Booking Calendar
≤2.0.19.2Update to 2.0.19.3
- Medium4.3Missing Authorization to Notice Dismissal
Vertical Timeline Widget for Elementor
≤2.2Update to 2.3
- Medium6.1Reflected Cross-Site Scripting
Get Use APIs – JSON Content Importer
≤1.5.3Update to 1.5.4
- Critical9.8Unauthenticated SQL Injection
Couponis Demo
<2.2Update to 2.2
- Medium4.3Cross-Site Request Forgery
Block for Font Awesome Icons – Searchable Icon Picker, SVG, FA 7
≤1.4.0Update to 1.4.1
- Medium5.3Unauthenticated Sensitive Information Exposure
Importify – AI Dropshipping for WooCommerce
≤1.0.4Update to 1.0.5
- Medium6.1Reflected Cross-Site Scripting via rt
Seraphinite Accelerator
≤2.20.28Update to 2.20.29
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Nested Pages
≤3.2.6Update to 3.2.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Spiffy Calendar
≤4.9.5Update to 4.9.6
- Medium6.4Authenticated Stored Cross-Site Scripting
Guest Author
≤2.3Update to 2.4
- Medium5.3Cross-Site Request Forgery
Abandoned Cart Lite for WooCommerce
≤5.16.1Update to 5.16.2
- Medium5.3Cross-Site Request Forgery via pagelayer_load_plugin
Page Builder: Pagelayer – Drag and Drop website builder
≤1.7.7Update to 1.7.8
- Medium5.3Missing Authorization via multiple admin_init actions
Hubbub Lite – Fast, free social sharing and follow buttons
≤1.30.0Update to 1.30.1
- Medium5.3Missing Authorization via etw_hide_admin_notification_callback
Enhanced Text Widget
≤1.6.3Update to 1.6.4
- Medium6.1Reflected Cross-Site Scripting
PowerPack Pro for Elementor
≤2.9.23Update to 2.9.24
- Medium4.3Missing Authorization via speedycache_create_test_cache
SpeedyCache – Cache, Optimization, Performance
≤1.1.2Update to 1.1.3
- Medium5.3IP Address Spoofing via get_real_ip
Coming soon and Maintenance mode
≤3.7.3Update to 3.7.4