Database
WordPress Vulnerability Database (page 1044)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
Frontier Post
≤6.1No patch available
- Medium4.3Cross-Site Request Forgery
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤3.37Update to 3.39
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Roadmap – Product Feedback Board
≤1.0.8Update to 1.0.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Easy Social Icons
≤3.2.4Update to 3.2.5
- Medium4.3Missing Authorization via tetxme_update_option_page()
TextMe SMS
≤1.9.0Update to 1.9.1
- Medium6.1Reflected Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤6.4.5Update to 6.4.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
TriPay Payment Gateway
≤3.2.7Update to 3.2.8
- Medium5.3Login Page Disclosure
Hide login page, Hide wp admin – stop attack on login page
≤1.1.7No patch available
- Medium4.3Missing Authorization via hide_free_sidebar()
Easy Social Feed – All In One Social Feed Plugin for WordPress
≤6.5.1Update to 6.5.2
- Medium4.3Cross-Site Request Forgery via plugin_settings_page()
Broken Link Checker for YouTube
≤1.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Team Members – Team Showcase, Team Slider, Grid, Table & Staff Directory
≤2.2.3Update to 2.2.4
- High8.7Authenticated (Administrator+) Directory Traversal
BackWPup – WordPress Backup & Restore Plugin
≤4.0.1Update to 4.0.2
- Medium5.3Missing Authorization
Super Progressive Web Apps
≤2.2.21Update to 2.2.22
- Medium4.3Cross-Site Request Forgery
Parcel Pro
≤1.6.11Update to 1.6.12
- Medium6.6Multiple Plugins by Trustindex.io <= (Various Versions)- Authenticated (Editor+) Arbitrary File Upload
Widgets for Google Reviews
≤11.0.2Update to 11.1
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
EventPrime – Events Calendar, Bookings, Tickets & AI
≤3.3.2Update to 3.3.3
- Low3.1Improper Authorization via wcal_delete_expired_used_coupon_code
Abandoned Cart Lite for WooCommerce
<5.16.1Update to 5.16.1
- Medium4.3Missing Authorization via _update_shortcode
GS Pinterest Portfolio – Pinterest Feed, Pinterest Board & Pin Widgets
<1.8.1Update to 1.8.1
- Medium4.3Missing Authorization to Log Export
WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce
≤2.3.5Update to 2.3.6
- Low3.7Improper Authorization via wcal_preview_emails
Abandoned Cart Lite for WooCommerce
<5.16.1Update to 5.16.1
- High7.2Unauthenticated Stored Cross-Site Scripting
CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce
≤5.0.2Update to 5.0.3
- Medium6.5Sensitive Information Disclosure via Shortcode
UserPro - Community and User Profile WordPress Plugin
≤5.1.1Update to 5.1.2
- Medium5.3Sensitive Data Exposure
Quttera ThreatSign – Web Malware Scanner for WordPress
≤3.4.1.48Update to 3.4.2.1
- Medium5.3Missing Authorization via plwao_register_settings()
Preloader for Website
≤1.2.2Update to 1.3
- High7.3Missing Authorization via multiple functions
UserPro - Community and User Profile WordPress Plugin
≤5.1.1Update to 5.1.2
- Medium4.3Cross-Site Request Forgery
Perfmatters
≤2.1.6Update to 2.1.7
- Medium6.8Authenticated (Administrator+) Directory Traversal via ShowFile
Quttera ThreatSign – Web Malware Scanner for WordPress
≤3.4.1.48Update to 3.4.2.1
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via userpro_save_userdata
UserPro - Community and User Profile WordPress Plugin
≤5.1.0Update to 5.1.1
- High8.8Cross-Site Request Forgery to Privilege Escalation
UserPro - Community and User Profile WordPress Plugin
≤5.1.1Update to 5.1.2
- Medium6.5Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template
UserPro - Community and User Profile WordPress Plugin
≤5.1.4Update to 5.1.5