Database
WordPress Vulnerability Database (page 1043)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Authenticated (Administrator+) SQL Injection
License Manager for WooCommerce
≤2.2.10Update to 2.2.11
- Medium4.3Missing Authorization
Debug Log Manager – Conveniently Monitor and Inspect Errors
≤2.2.1Update to 2.2.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Fast Custom Social Share by CodeBard
≤1.1.1No patch available
- Medium5.3Insecure Direct Object Reference
Accept Stripe Payments
≤2.0.79Update to 2.0.80
- Medium4.3Cross-Site Request Forgery via brc_admin()
Bulk Comment Remove
≤2No patch available
- Medium5.3Unauthenticated Content Injection
Accept Stripe Payments
≤2.0.79Update to 2.0.80
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
SpiderVPlayer
≤1.5.22No patch available
- Medium4.3#1 Mail SMTP Plugin for WordPress <= 4.0.14 - Missing Authorization
Mail Bank – #1 Mail SMTP Plugin for WordPress
≤4.0.14No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Display Custom Post
≤2.2.1No patch available
- Medium4.3Cross-Site Request Forgery
Frontier Post
≤6.1No patch available
- Medium6.1Reflected Cross-Site Scripting
enfold
≤5.6.4Update to 5.6.5
- Medium5.3Functionality <= 2.11.1 - Missing Authorization
Porto Theme - Functionality
≤2.11.1Update to 2.12.1
- Medium4.3Cross-Site Request Forgery
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤3.37Update to 3.39
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Roadmap – Product Feedback Board
≤1.0.8Update to 1.0.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Easy Social Icons
≤3.2.4Update to 3.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SpreadsheetConverter Calculator
≤10.1.3Update to 10.1.4
- Medium4.3Missing Authorization via tetxme_update_option_page()
TextMe SMS
≤1.9.0Update to 1.9.1
- Medium5.3Unauthenticated Password Protected Post Disclosure
SmartCrawl SEO checker, analyzer & optimizer
<3.8.3Update to 3.8.3
- Medium4.3Missing Authorization via hide_free_sidebar()
Easy Social Feed – All In One Social Feed Plugin for WordPress
≤6.5.1Update to 6.5.2
- Medium4.3Cross-Site Request Forgery via plugin_settings_page()
Broken Link Checker for YouTube
≤1.3No patch available
- High7.5Sensitive Information Exposure
JobWP – Job Board Plugin for WordPress | Job Listings, Career Page & Applications
≤2.1Update to 2.2
- Medium4.3Cross-Site Request Forgery
Simple Testimonials Showcase
≤1.1.6No patch available
- Medium4.3Open Redirect
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages
≤1.5.1.5Update to 1.5.1.6
- Medium6.1Reflected Cross-Site Scripting
eDoc Employee Job Application – Best WordPress Job Manager for Employees
≤1.13No patch available
- Medium5.3Captcha Bypass
Contact Form Email
≤1.3.41Update to 1.3.42
- Medium4.3Missing Authorization via woof_meta_get_keys()
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard
≤1.3.4.2Update to 1.3.4.3
- Medium4.3Missing Authorization via wpas_edit_reply_ajax()
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.1.4Update to 6.1.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
TriPay Payment Gateway
≤3.2.7Update to 3.2.8
- High7.2Authenticated (Shop manager+) SQL Injection via search dates
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
≤2.4.7Update to 2.4.7.1
- Medium6.1Reflected Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤6.4.5Update to 6.4.6