Database
WordPress Vulnerability Database (page 1040)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Email Address Encoder
1.0.22 – 1.0.22Update to 1.0.23
- High7.1Cross-Site Request Forgery
SVGator
≤1.2.4Update to 1.2.5
- Medium4.3Cross-Site Request Forgery
Button Generator – Easily Create Custom Buttons with Icons and Analytics
≤2.3.8Update to 2.3.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Credit Tracker
≤1.1.17No patch available
- Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
Ocean Extra
≤2.2.2Update to 2.2.3
- Medium4.3Cross-Site Request Forgery
Ecwid by Lightspeed Ecommerce Shopping Cart
≤6.12.4Update to 6.12.5
- Medium4.3Cross-Site Request Forgery via process_bulk_action
AffiliatePages – Pros & Cons, Notice, and CTA Blocks for Affiliates
≤3.0.5Update to 3.0.6
- Medium4.3Insufficient Authorization to Authenticated (Contributor+) Arbitrary Post Modifications
SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher
≤5.0.4Update to 5.0.5
- Medium4.3Missing Authorization
GoDaddy Email Marketing
≤1.4.3No patch available
- Medium4.3Cross-Site Request Forgery via wactc_text_form
Add to Cart Text Changer and Customize Button, Add Custom Icon
≤2.0Update to 2.1
- Medium4.3Cross-Site Request Forgery
AdFoxly – Ad Manager, AdSense Ads & Ads.txt
≤1.8.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Crypto Converter ⚡ Widget
≤1.8.3Update to 1.8.4
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Attachment Download
JetElements
≤2.6.13Update to 2.6.13.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Simple Calendar – Google Calendar, Events, & ICS Feeds
≤3.2.7Update to 3.2.8
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
WP Crowdfunding
≤2.1.7Update to 2.1.8
- Medium6.4Incorrect Authorization to Authenticated (Contributor+) Data Viewing and Deletion
WP Mail Log
≤1.1.2Update to 1.1.3
- High8.8Authenticated (Contributor+) Privilege Escalation
JetEngine
≤3.2.4Update to 3.2.5
- Medium6.5Authenticated (Contributor+) Arbitrary File Read
WP Mail Log
≤1.1.2Update to 1.1.3
- Medium5.3Sensitive Information Exposure
Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF
≤6.4.5Update to 6.4.6
- Medium6.1Reflected Cross-Site Scripting via addplaylistid
MyTube PlayList
≤2.0.3No patch available
- High7.1Missing Authorization via register
WP CleanFix
≤5.6.2Update to 5.7.0
- Medium5.3Captcha Bypass
WP Forms Puzzle Captcha
≤4.1No patch available
- Medium4.3Cross-Site Request Forgery
WooCommerce Login Redirect
≤2.2.4No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
WP Catalogue
≤1.7.6No patch available
- Medium4.3Missing Authorization
IdeaPush
≤8.57Update to 8.58
- Medium5.3WCMultiShipping <= 2.3.7 - Incorrect Authorization
WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce
≤2.3.7Update to 2.3.8
- Medium5.4Missing Authorization via multiple AJAX functions
Abandoned Cart Lite for WooCommerce
≤5.16.1Update to 5.16.2
- Medium6.5Cross-Site Request Forgery via cbb_submit_settings_data
Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back
≤2.3No patch available
- Medium4.3Cross-Site Request Forgery
JetSmartFilters
≤3.2.2Update to 3.2.2.1
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
WP Forms Puzzle Captcha
≤4.1No patch available