Database
WordPress Vulnerability Database (page 1045)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
Perfmatters
≤2.1.6Update to 2.1.7
- Medium6.1Reflected Cross-Site Scripting
Perfmatters
≤2.1.6Update to 2.1.7
- High7.3Missing Authorization via multiple functions
UserPro - Community and User Profile WordPress Plugin
≤5.1.1Update to 5.1.2
- Medium6.5Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_template
UserPro - Community and User Profile WordPress Plugin
≤5.1.4Update to 5.1.5
- High7.2Unauthenticated Stored Cross-Site Scripting
CatalogX Product Catalog, Product Enquiry & Quotes for WooCommerce
≤5.0.2Update to 5.0.3
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
EventPrime – Events Calendar, Bookings, Tickets & AI
≤3.3.2Update to 3.3.3
- Low3.7Improper Authorization via wcal_preview_emails
Abandoned Cart Lite for WooCommerce
<5.16.1Update to 5.16.1
- Medium5.3Sensitive Data Exposure
Quttera ThreatSign – Web Malware Scanner for WordPress
≤3.4.1.48Update to 3.4.2.1
- Medium6.5Sensitive Information Disclosure via Shortcode
UserPro - Community and User Profile WordPress Plugin
≤5.1.1Update to 5.1.2
- Medium4.3Missing Authorization via _update_shortcode
GS Pinterest Portfolio – Pinterest Feed, Pinterest Board & Pin Widgets
<1.8.1Update to 1.8.1
- Medium5.3Missing Authorization via plwao_register_settings()
Preloader for Website
≤1.2.2Update to 1.3
- Medium4.3Missing Authorization to Log Export
WCMultiShipping — Mondial Relay, Inpost & Chronopost for WooCommerce
≤2.3.5Update to 2.3.6
- Low3.1Improper Authorization via wcal_delete_expired_used_coupon_code
Abandoned Cart Lite for WooCommerce
<5.16.1Update to 5.16.1
- High8.8Authenticated (Subscriber+) SQL Injection
EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder
<2.3.4Update to 2.3.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Parallax Image
≤1.7.1Update to 1.8
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
wpForo Forum
≤2.2.3Update to 2.2.4
- Medium4.3Cross-Site Request Forgery via logout()
wpForo Forum
≤2.2.8Update to 2.2.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bootstrap Shortcodes Ultimate
≤4.3.1No patch available
- Critical9.1Authenticated (Administrator+) Arbitrary File Upload
WP Child Theme Generator
≤1.1.2Update to 1.1.3
- Medium6.1Reflected Cross-Site Scripting
Grab & Save
≤1.0.4No patch available
- Medium4.3Cross-Site Request Forgery
Floating Action Button
≤1.2.1Update to 1.2.2
- Medium5.3Missing Authorization
BlossomThemes Email Newsletter
≤2.2.4Update to 2.2.5
- High7.2Authenticated (Contributor+) SQL Injection via id
WP Mail Log
≤1.1.2Update to 1.1.3
- Medium4.3Cross-Site Request Forgery
Auto Affiliate Links
≤6.4.2.5Update to 6.4.2.6
- Critical9.8Unauthenticated Privilege Escalation
wpForo Forum
≤2.2.3Update to 2.2.4
- High7.2Authenticated (Editor+) Arbitrary File Upload
CataBlog
≤1.7.0No patch available
- Medium4.3Cross-Site Request Forgery
Analytify – Google Analytics 4 Tracking and Reporting in WordPress
≤5.1.1Update to 5.2.0
- Medium6.5Missing Authorization via delete_cf7_records()
Contact Form to Any API
≤1.1.6Update to 1.1.7
- High8.8Authenticated (Contributor+) SQL Injection
Link Whisper Free
≤0.6.5Update to 0.6.6
- Medium4.3Cross-Site Request Forgery to Post, Term, and User Meta Deletion
Post Meta Data Manager
≤1.2.1Update to 1.2.2