Database
WordPress Vulnerability Database (page 1050)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization via AJAX actions
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤4.2.0Update to 4.2.1
- Medium5.4Cross-Site Request Forgery
eCommerce Product Catalog
<3.3.26Update to 3.3.26
- Medium4.3Cross-Site Request Forgery to Settings Update
WP Blogs' Planetarium
≤1.0No patch available
- High7.2iLoveIMG <= 1.0.5 - Authenticated (Administrator+) PHP Object Injection
iLoveIMG
<1.0.6Update to 1.0.6
- Medium4.3Cross-Site Request Forgery to Plugin Settings Update
TwitterPosts
≤1.0.2No patch available
- Medium5.3Missing Authorization via ajax_handler
Swift SMTP (formerly Welcome Email Editor)
≤5.0.5Update to 5.0.6
- Medium4.3Cross-Site Request Forgery
Word Balloon
≤4.20.2Update to 4.20.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
<3.8.7Update to 3.8.7
- Critical9.8Unauthenticated SQL Injection
WP Fastest Cache – WordPress Cache Plugin
≤1.2.1Update to 1.2.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Ultimate Dashboard – Custom WordPress Dashboard
≤3.7.7Update to 3.7.8
- Medium4.3Missing Authorization via wpcai_pro_notice_disable
WP Custom Admin Interface
≤7.31Update to 7.32
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Simply Excerpts
≤1.4Update to 1.6
- Medium4.3Missing Authorization via clicked
Simple 301 Redirects by BetterLinks – Easy Redirect Manager
≤2.0.7Update to 2.0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
WooCommerce Product Carousel Slider
≤3.3.5No patch available
- High7.2Unauthenticated Cross-Site Scripting
Bus Ticket Booking with Seat Reservation
≤5.2.5Update to 5.2.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG
Uploading SVG, WEBP and ICO files
≤1.2.1No patch available
- Medium5.4Missing Authorization via AJAX Actions
Delete Duplicate Posts
<4.9Update to 4.9
- High8.8Authenticated (Author+) Arbitrary File Upload
Filr – Secure document library
<1.2.3.6Update to 1.2.3.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
<3.8.7Update to 3.8.7
- Medium6.3Missing Authorization via AJAX actions
AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth
≤7.3.9Update to 7.3.10
- Medium6.1Reflected Cross Site Scripting
AMP+ Plus
≤3.0No patch available
- Medium4.3Cross-Site Request Forgery
Multi Step Form
≤1.7.12Update to 1.7.13
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
≤3.1.2Update to 3.1.3
- Medium6.1Reflected Cross-Site Scripting
Star CloudPRNT for WooCommerce
≤2.0.3Update to 2.0.4
- High7.2Authenticated (Admin+) SQL Injection
Easy Newsletter Signups
≤1.0.4No patch available
- Medium5.3Missing Authorization via save_ditty_permissions_check
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.1.24Update to 3.1.25
- Medium5.3Race Condition to Vote Manipulation
YOP Poll
≤6.5.26Update to 6.5.27
- Medium4.3Missing Authorization via AJAX actions
BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot
≤2.5.2Update to 2.5.3
- Medium6.1Reflected Cross-Site Scripting
BSK Contact Form 7 Blacklist
≤1.0.1No patch available
- Medium4.3Sensitive Information Exposure
Sprout Invoices – Client Invoicing & Estimates
<20.5.4Update to 20.5.4