Database
WordPress Vulnerability Database (page 1048)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Email Encoder – Protect Email Addresses and Phone Numbers
≤2.1.8Update to 2.1.9
- Critical9.8Unauthenticated Local File Inclusion
Shortcodes and extra features for Phlox theme
≤2.14.0Update to 2.15.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Daily Prayer Time
≤2023.10.13Update to 2023.10.21
- Medium4.3Cross-Site Request Forgery
Disable User Login
≤1.3.8Update to 1.3.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Better RSS Widget
≤2.8.1No patch available
- Critical9.8Unauthenticated Local File Inclusion
Premium Portfolio Features for Phlox theme
≤2.3.1Update to 2.3.2
- Critical9.8Unauthenticated Local File Inclusion
Phlox Shop
≤2.0.0No patch available
- Medium5.3Missing Authorization via acme_fix_images_ajax_callback
Acme Fix Images – Regenerate Thumbnails
≤1.0.0Update to 2.0.0
- Low3.1Missing Authorization via crublabFBLBAjax
WP Like Button
≤1.7.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Addon Elements for Elementor (formerly Elementor Addon Elements)
≤1.12.7Update to 1.12.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Anywhere Flash Embed
≤1.0.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute
WooCommerce
≤8.1.1Update to 8.2.0
- Medium4.3Cross-Site Request Forgery
Comments – wpDiscuz
≤7.6.11Update to 7.6.12
- Medium4.3Cross-Site Request Forgery
Events Addon for Elementor
≤2.1.2Update to 2.1.3
- Medium4.7Open Redirect
Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms
≤1.1.4Update to 1.1.5
- Medium4.3Missing Authorization
LuckyWP Scripts Control
≤1.2.1Update to 1.2.2
- Medium5.3Missing Authorization
Restaurant & Cafe Addon for Elementor
≤1.5.2Update to 1.5.3
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Welcart e-Commerce
≤2.9.4Update to 2.9.5
- High8.8Cross-Site Request Forgery
Welcart e-Commerce
≤2.9.4Update to 2.9.5
- Medium4.3Missing Authorization
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
≤3.2.3Update to 3.2.4
- Medium6.1Reflected Cross-Site Scripting
Interactive World Map
≤3.2.0Update to 3.4.4
- Medium4.3Cross-Site Request Forgery
Woocommerce Shipping Canada Post
≤2.8.3Update to 2.8.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic
≤9.7.8Update to 9.7.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Slider Revolution
≤6.6.14Update to 6.6.15
- Medium6.1Reflected Cross-Site Scripting
Footer Putter
≤1.17No patch available
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
WP Not Login Hide (WPNLH)
≤1.0No patch available
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
≤3.2.3Update to 3.2.4
- Medium6.3Missing Authorization
Betheme
≤27.1.1Update to 27.1.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Contact Form Email
≤1.3.43Update to 1.3.44
- Medium6.1Reflected Cross-Site Scripting
Permalinks Customizer
≤2.8.2No patch available