Database
WordPress Vulnerability Database (page 1038)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Unauthenticated Sensitive Information Exposure
Importify – AI Dropshipping for WooCommerce
≤1.0.4Update to 1.0.5
- Medium6.1Reflected Cross-Site Scripting via rt
Seraphinite Accelerator
≤2.20.28Update to 2.20.29
- Medium6.6Authenticated (Editor+) Arbitrary File Upload
Contact Form 7
≤5.8.3Update to 5.8.4
- Medium4.3Missing Authorization
Quotes for WooCommerce
≤2.0.1Update to 2.0.2
- Medium6.1Reflected Cross-Site Scripting
Quiz Maker by AYS
≤6.4.9.4Update to 6.4.9.5
- Medium4.3Cross-Site Request Forgery
Quotes for WooCommerce
≤2.0.1Update to 2.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
UserPro - Community and User Profile WordPress Plugin
5.1.5 – 5.1.5Update to 5.1.6
- High7.5Unauthenticated Sensitive Information Exposure via Debug Log
GSheetConnector – CF7 Google Sheets Connector & Save CF7 Entries to Database
≤5.0.5Update to 5.0.6
- High7.5Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure
Backup Migration
≤1.3.6Update to 1.3.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Related Posts By PickPlugins
≤2.0.53Update to 2.0.54
- High8.8Authenticated (Author+) PHP Object Injection
Slider Revolution
<6.6.19Update to 6.6.19
- Medium5.3Missing Authorization to Email Disclosure
Quiz Maker by AYS
≤6.4.9.4Update to 6.4.9.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Sign In Scheduling Online Appointment Booking System
≤1.0.9Update to 1.1.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Site Offline Or Coming Soon Or Maintenance Mode
≤1.5.6Update to 1.5.7
- Medium6.1Reflected Cross-Site Scripting via code
NextScripts: Social Networks Auto-Poster
≤4.4.2Update to 4.4.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
GDPR Cookie Consent by Supsystic
≤2.1.2No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via name
Responsive Lightbox & Gallery
≤2.4.5Update to 2.4.6
- Medium6.1Reflected Cross-Site Scripting
adifier
<3.1.4Update to 3.1.4
- Medium6.5Missing Authorization via wpcf7db_delete AJAX action
Database for CF7
≤1.2.4Update to 1.2.5
- High7.2Authenticated (Administrator+) SQL Injection
MSync
≤1.0.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.4.0Update to 2.4.1
- Medium6.1Unauthenticated Cross-Site Scripting
which template file
≤5.0.0Update to 5.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Parallax Slider Block
≤1.2.5Update to 1.2.6
- High7.2Authenticated (Admin+) Arbitrary File Upload
rtMedia for WordPress, BuddyPress and bbPress
≤4.6.15Update to 4.6.16
- Medium6.1Cross-Site Scripting
List all posts by Authors, nested Categories and Titles
≤2.8.2Update to 2.8.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Event Post
≤5.9.0Update to 5.9.1
- Medium6.1Reflected Cross-Site Scripting
BrainCert Virtual Classroom
≤2.1Update to 2.2
- Medium5.3Unauthenticated Password Leak
Download Manager
≤3.2.82Update to 3.2.83
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Client Dash
≤2.2.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ads by datafeedr.com
≤1.2.0No patch available