Database
WordPress Vulnerability Database (page 1049)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Namaste! LMS
≤2.6.1.1Update to 2.6.1.2
- Medium4.3Cross-Site Request Forgery
Hreflang Manager – Hreflang Implementation for International SEO
≤1.06Update to 1.07
- High8.8Cross-Site Request Forgery
Welcart e-Commerce
≤2.9.4Update to 2.9.5
- High7.2Authenticated (Author+) Arbitrary File Upload
Slider Revolution
≤6.6.15Update to 6.6.16
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Website Optimization – Plerdy
≤1.3.2Update to 1.3.3
- Medium4.3Missing Authorization
Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator
≤1.3.8Update to 1.3.9
- Medium5.3Missing Authorization
Restaurant & Cafe Addon for Elementor
≤1.5.2Update to 1.5.3
- High8.8Cross-Site Request Forgery
Thrive Themes Builder
<3.24.2Update to 3.24.2
- Medium4.3Missing Authorization
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
≤3.2.3Update to 3.2.4
- High8.3Missing Authorization
Essential Grid Gallery WordPress Plugin
≤3.0.18Update to 3.0.19
- Medium6.6Authenticated (Administrator+) Arbitrary File Upload
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.27.0Update to 1.28.0
- Medium6.1Reflected Cross-Site Scripting
Interactive World Map
≤3.2.0Update to 3.4.4
- High8.3Missing Authorization
Thrive Themes Builder
<3.24.0Update to 3.24.0
- Medium4.3Cross-Site Request Forgery
Events Addon for Elementor
≤2.1.2Update to 2.1.3
- High8.8Privilege Escalation
Thrive Themes Builder
<3.24.0Update to 3.24.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
LayerSlider
≤7.7.9Update to 7.7.10
- Medium4.3Missing Authorization
LuckyWP Scripts Control
≤1.2.1Update to 1.2.2
- Medium5.3Missing Authorization
avalex – Automatisch sichere Rechtstexte
≤3.0.8Update to 3.0.9
- Medium6.3Missing Authorization
Betheme
≤27.1.1Update to 27.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Slider Revolution
≤6.6.14Update to 6.6.15
- Medium6.1Reflected Cross-Site Scripting
Footer Putter
≤1.17No patch available
- Medium4.3Cross-Site Request Forgery
Comments – wpDiscuz
≤7.6.11Update to 7.6.12
- Medium4.3Cross-Site Request Forgery
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
≤3.2.3Update to 3.2.4
- Medium6.1Reflected Cross-Site Scripting
Post Status Notifier Lite
≤1.11.0Update to 1.11.1
- Medium4.7Open Redirect
Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms
≤1.1.4Update to 1.1.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
eCommerce Product Catalog
≤3.3.26Update to 3.3.27
- Medium4.3Missing Authorization via dismiss_notice
miniOrange OTP Login, Verification and SMS Notifications
≤4.2.1Update to 4.2.2
- Medium6.1Reflected Cross-Site Scripting
Permalinks Customizer
≤2.8.2No patch available
- High7.2iLoveIMG <= 1.0.5 - Authenticated (Administrator+) PHP Object Injection
iLoveIMG
<1.0.6Update to 1.0.6
- Medium4.3Cross-Site Request Forgery to Plugin Settings Update
TwitterPosts
≤1.0.2No patch available