Database
WordPress Vulnerability Database (page 1047)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Authenticated (Subscriber+) Membership Plan Bypass
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤4.0.10Update to 4.0.11
- Medium4.3Cross-Site Request Forgery via settings_page
Easy Call Now by ThikShare
≤1.1.0No patch available
- Medium4.3Missing Authorization
Conditional Fields for Contact Form 7
≤2.4.1Update to 2.4.2
- Medium5.3Missing Authorization via formcraft_nag_update
FormCraft – Form Builder
≤1.2.7Update to 1.2.8
- High8.1Insecure Password Reset Mechanism
AppPresser – Mobile App Framework
≤4.2.5Update to 4.3.0
- Medium5.3Missing Authorization via getSIQPluginSettings
SearchIQ – The Search Solution
≤4.4Update to 4.5
- Medium4.3Cross-Site Request Forgery via leadster_script_code_action
Leadster
≤1.1.2Update to 1.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤8.1.13Update to 8.1.14
- Medium4.3Missing Authorization via update_option
Live Preview for Contact Form 7
≤1.2.0No patch available
- High7.5Authenticated (Subscriber+) Arbitrary File Upload
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
≤2.12.3Update to 2.12.4
- Medium5.4Cross-Site Request Forgery via moveToTrash and fetch_and_insert_template_data
Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator
≤1.3.8Update to 1.3.9
- Medium4.3Cross-Site Request Forgery ToolImport
WP EXtra – One Click Optimize
≤6.4Update to 6.5
- Medium4.3Missing Authorization via AJAX action
Ultimate Responsive Image Slider
≤3.5.11Update to 3.5.12
- Medium5.3Protection Mechanism Bypass
LWS Hide Login
≤2.1.8Update to 2.1.9
- Medium4.3Missing Authorization via gawd_wd_bp_install_notice_status
10WebAnalytics
≤1.2.12No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Quick Call Button
≤1.2.9No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤12.8-a.1Update to 12.8-a.3
- Medium5.0Authenticated(Contributor+) Clickjacking via Iframe Injection
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<12.7Update to 12.7
- Medium5.4Missing Authorization to Template Import
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
≤4.10Update to 4.10.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ajax Domain Checker
≤1.3.0No patch available
- High7.2Authenticated (Administrator+) PHP Object Injection
Welcart e-Commerce
<2.9.6Update to 2.9.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
BMI Calculator Plugin
≤1.0.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Bamboo Columns
≤1.6.1No patch available
- Medium5.3Missing Authorization to Sensitive Information Exposure
Addon Elements for Elementor (formerly Elementor Addon Elements)
≤1.12.7Update to 1.12.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute
WooCommerce
≤8.1.1Update to 8.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Add Widgets to Page
≤1.3.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Daily Prayer Time
≤2023.10.13Update to 2023.10.21
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
BP Profile Shortcodes Extra
≤2.5.2Update to 2.5.3
- Medium4.3Cross-Site Request Forgery
Disable User Login
≤1.3.8Update to 1.3.9
- Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting via accordion settings
Accordions – Responsive Accordion & FAQ Plugin for WordPress
≤2.6Update to 2.7