Database
WordPress Vulnerability Database (page 1046)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Low2.2Authenticated (Admin+) Arbitrary OS File Access via Path Traversal
File Manager
≤6.2Update to 6.3
- Medium6.1Reflected Cross-Site Scripting
Tainacan
≤0.20.4Update to 0.20.5
- Medium5.3Missing Authorization
PayTR Taksit Tablosu – WooCommerce
≤1.3.1Update to 1.3.2
- Medium6.5Authenticated (Editor+) Arbitrary File Deletion
CataBlog
≤1.7.0No patch available
- High7.2Authenticated (Contributor+) SQL Injection via id
WP Mail Log
≤1.1.2Update to 1.1.3
- Medium4.3Cross-Site Request Forgery via logout()
wpForo Forum
≤2.2.8Update to 2.2.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bootstrap Shortcodes Ultimate
≤4.3.1No patch available
- Medium4.3Cross-Site Request Forgery
Auto Affiliate Links
≤6.4.2.5Update to 6.4.2.6
- High8.8Authenticated (Subscriber+) SQL Injection
EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder
<2.3.4Update to 2.3.4
- High7.2Authenticated (Editor+) Arbitrary File Upload
CataBlog
≤1.7.0No patch available
- Medium5.3Missing Authorization
BlossomThemes Email Newsletter
≤2.2.4Update to 2.2.5
- Medium6.1Reflected Cross-Site Scripting
Grab & Save
≤1.0.4No patch available
- Medium4.3Cross-Site Request Forgery
Floating Action Button
≤1.2.1Update to 1.2.2
- Medium4.3Missing Authorization via manual review reminders
Customer Reviews for WooCommerce
<5.38.2Update to 5.38.2
- Medium4.3Cross-Site Request Forgery via manual review reminders
Customer Reviews for WooCommerce
<5.38.2Update to 5.38.2
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Embed Privacy
≤1.8.0Update to 1.8.1
- Medium6.1Reflected Cross-Site Scripting
EmbedPress
≤3.9.1Update to 3.9.2
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Audio Merchant
≤5.0.4No patch available
- Medium6.1Reflected Cross-Site Scripting
EmbedPress
≤3.9.1Update to 3.9.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Comments – wpDiscuz
≤7.6.12Update to 7.6.13
- Medium5.4Cross-Site Request Forgery to Settings Modifcation and Stored Cross-Site Scripting
Audio Merchant
≤5.0.4No patch available
- Medium5.3Cross-Site Request Forgery via updateSettings
WP Meta and Date Remover
≤2.3.0Update to 2.3.1
- Medium4.3Improper Authorization via WPCom External Media REST endpoints
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<12.7Update to 12.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
DrawIt (draw.io)
≤1.1.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ARI Stream Quiz – WordPress Quizzes Builder
≤1.2.32Update to 1.3.0
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
URL Shortify – Simple and Easy URL Shortener
≤1.7.9Update to 1.7.9.1
- Medium4.3Authenticated (Subscriber+) Membership Plan Bypass
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤4.0.10Update to 4.0.11
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Theater for WordPress
≤0.18.3Update to 0.18.4
- Medium4.3Cross-Site Request Forgery via settings_page
Easy Call Now by ThikShare
≤1.1.0No patch available
- Medium4.3Missing Authorization via getAjaxStats
wpMandrill
≤1.33No patch available