Database
WordPress Vulnerability Database (page 1039)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting via REQUEST_URI
Forms by CaptainForm – Form Builder for WordPress
≤2.5.3No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
KP Fastest Tawk.to Chat
≤1.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Innovs HR – Complete Human Resource Management System for Your Business
≤1.0.3.6Update to 1.0.3.7
- High7.2Authenticated (Admin+) Arbitrary File Upload
rtMedia for WordPress, BuddyPress and bbPress
≤4.6.15Update to 4.6.16
- Medium6.1Reflected Cross-Site Scripting via tab
DOOFINDER Search and Discovery for WP & WooCommerce
≤2.1.7Update to 2.1.8
- Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
≤3.1.41Update to 3.1.42
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
rtMedia for WordPress, BuddyPress and bbPress
≤4.6.15Update to 4.6.16
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Site Offline Or Coming Soon Or Maintenance Mode
≤1.5.6Update to 1.5.7
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Parallax Slider Block
≤1.2.5Update to 1.2.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Sign In Scheduling Online Appointment Booking System
≤1.0.9Update to 1.1.0
- Medium6.1Unauthenticated Cross-Site Scripting
which template file
≤5.0.0Update to 5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
≤2.4.0Update to 2.4.1
- Medium6.1Reflected Cross-Site Scripting
WP Pocket URLs
≤1.0.2Update to 1.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Simple Calendar – Google Calendar, Events, & ICS Feeds
≤3.2.7Update to 3.2.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
AMP for WP – Accelerated Mobile Pages
≤1.0.88.1Update to 1.0.89
- Medium4.3Missing Authorization
GoDaddy Email Marketing
≤1.4.3No patch available
- High8.8Authenticated (Contributor+) Privilege Escalation
JetEngine
≤3.2.4Update to 3.2.5
- Medium6.4Incorrect Authorization to Authenticated (Contributor+) Data Viewing and Deletion
WP Mail Log
≤1.1.2Update to 1.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Credit Tracker
≤1.1.17No patch available
- Medium4.3Cross-Site Request Forgery
Business Directory Plugin – Easy Listing & Member Directories for WordPress
≤6.3.10Update to 6.3.11
- Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
Ocean Extra
≤2.2.2Update to 2.2.3
- Medium4.3Cross-Site Request Forgery
Button Generator – Easily Create Custom Buttons with Icons and Analytics
≤2.3.8Update to 2.3.9
- Medium6.5Authenticated (Contributor+) Arbitrary File Read
WP Mail Log
≤1.1.2Update to 1.1.3
- Medium6.3Missing Authorization
JetSmartFilters
≤3.2.2Update to 3.2.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Currency Converter Calculator
≤1.3.1Update to 1.3.2
- Medium4.3Missing Authorization
LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing…
≤4.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Email Address Encoder
1.0.22 – 1.0.22Update to 1.0.23
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Multiple Post Passwords
≤1.1.1Update to 1.1.2
- Medium4.3Cross-Site Request Forgery via wactc_text_form
Add to Cart Text Changer and Customize Button, Add Custom Icon
≤2.0Update to 2.1
- Medium6.6Authenticated (Administrator+) SQL Injection via orderby
WordPress Brute Force Protection – Stop Brute Force Attacks
≤2.2.5Update to 2.2.6