Database
WordPress Vulnerability Database (page 1041)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
360 Javascript Viewer
≤1.7.11Update to 1.7.12
- Medium5.4Missing Authorization via Multiple AJAX Actions
Export WordPress Pages to Static HTML & PDF — Static Site Export
≤2.1.9Update to 2.2.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress
≤4.6.19Update to 4.6.20
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Chartify – WordPress Chart Plugin
≤1.9.6Update to 1.9.7
- Medium6.5Cross-Site Request Forgery via cbb_submit_settings_data
Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back
≤2.3No patch available
- Medium6.5Cross-Site Request Forgery via adminpage.php
Prevent Landscape Rotation
≤2.0Update to 2.1
- Medium4.3Cross-Site Request Forgery via delete_database()
teachPress
≤9.0.5Update to 9.0.6
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
WP Forms Puzzle Captcha
≤4.1No patch available
- Medium4.3Cross-Site Request Forgery
JetSmartFilters
≤3.2.2Update to 3.2.2.1
- Medium5.3WCMultiShipping <= 2.3.7 - Incorrect Authorization
WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce
≤2.3.7Update to 2.3.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
WP Catalogue
≤1.7.6No patch available
- Medium5.3Sensitive Information Exposure
Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF
≤6.4.5Update to 6.4.6
- Medium4.3Cross-Site Request Forgery
WooCommerce Login Redirect
≤2.2.4No patch available
- Medium6.1Reflected Cross-Site Scripting via addplaylistid
MyTube PlayList
≤2.0.3No patch available
- Medium4.3Missing Authorization
IdeaPush
≤8.57Update to 8.58
- High7.1Missing Authorization via register
WP CleanFix
≤5.6.2Update to 5.7.0
- Medium5.3Captcha Bypass
WP Forms Puzzle Captcha
≤4.1No patch available
- Medium5.4Missing Authorization via multiple AJAX functions
Abandoned Cart Lite for WooCommerce
≤5.16.1Update to 5.16.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Email Address Encoder
1.0.22 – 1.0.22Update to 1.0.23
- High7.2Authenticated (Shop Manager+) Arbitrary File Upload
Mollie Payments for WooCommerce
≤7.3.11Update to 7.3.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Shortcodes Ultimate – Content Elements
≤5.13.3Update to 7.0.0
- Medium5.3Missing Authorization to Unauthenticated Settings Export
Swift Performance Lite
≤2.3.6.14Update to 2.3.6.15
- Medium5.3IP Spoofing to Protection Mechanism Bypass
Restricted Site Access
≤7.4.1Update to 7.5.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Simple Long Form
≤2.2.2No patch available
- High7.2Authenticated (Administrator+) Arbitrary File Upload
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress
≤1.0.76Update to 1.0.77
- Medium4.3Cross-Site Request Forgery
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤5.2.2.6Update to 5.2.3.0
- Medium5.3Cross-Site Request Forgery
teachPress
≤9.0.4Update to 9.0.5
- Medium5.3IP Address Spoofing via get_client_ip
Antispam Bee
≤2.11.3Update to 2.11.4
- Medium6.1Reflected Cross-Site Scripting
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms
≤1.25.9Update to 1.25.10
- Medium4.3Cross-Site Request Forgery
Delete Post Revisions In WordPress
≤4.6No patch available