Database
WordPress Vulnerability Database (page 1051)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Welcart e-Commerce
≤2.9.4Update to 2.9.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
EasyRotator for WordPress – Slider Plugin
≤1.0.14No patch available
- Critical9.8Unauthenticated PHP Object Injection
Welcart e-Commerce
≤2.9.4Update to 2.9.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Custom Form Builder, Contact Forms, Payment Forms, Surveys, Polls
≤2.1.0Update to 2.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Sponsors
≤3.5.0Update to 3.5.1
- High8.8Authenticated (Subscriber+) Privilege Escalation
Social Login, Social Sharing by miniOrange
≤7.6.6Update to 7.6.7
- Medium4.3Cross-Site Request Forgery
Arigato Autoresponder and Newsletter
≤2.7.2.2Update to 2.7.2.3
- Medium6.5Missing Authorization
Japanized for WooCommerce
≤2.6.4Update to 2.6.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Product Enquiry for WooCommerce
≤3.0Update to 3.1
- Medium6.1Reflected Cross-Site Scripting
Essential Grid Gallery WordPress Plugin
≤3.1.0Update to 3.1.1
- Medium4.3Missing Authorization via flo_send_test_email
Flo Forms – Easy Drag & Drop Form Builder
≤1.0.41Update to 1.0.42
- Medium6.1Reflected Cross-Site Scripting
Shortcodes Finder
≤1.5.3Update to 1.5.4
- High8.8Authenticated (Author+) Privilege Escalation
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤3.6.5Update to 3.6.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Advanced iFrame
≤2023.8Update to 2023.9
- Medium5.3Missing Authorization to Plugin Settings Update
Animator – Scroll Triggered Animations
≤3.0.10Update to 3.0.11
- Medium6.5Missing Authorization
Checkout Field Manager (Checkout Manager) for WooCommerce
≤7.3.0Update to 7.3.1
- High7.2Cross-Site Scripting
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
≤3.1.42Update to 3.1.43
- Medium5.3Missing Authorization
Ultra Addons for Contact Form 7
≤3.2.10Update to 3.2.11
- Medium4.3Cross-Site Request Forgery
Woo Custom and Sequential Order Number
≤2.6.0No patch available
- High7.2Authenticated (Administrator+) SQL Injection
MainWP Dashboard: Self-hosted WordPress Management for Agencies
≤4.4.3.3Update to 4.4.3.4
- Low3.0Authenticated (Admin+) HTML Injection
EventON – Events Calendar
≤2.1.7Update to 2.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Qi Addons For Elementor
≤1.6.4Update to 1.6.5
- High8.8Authenticated (Contributor+) Local File Inclusion
Qi Addons For Elementor
≤1.6.3Update to 1.6.4
- Medium6.1Reflected Cross-Site Scripting
Additional Order Filters for WooCommerce
≤1.11Update to 1.12
- Medium4.3Missing Authorization via AJAX
Mini Cart Drawer for WooCommerce
≤4.0.0Update to 4.0.1
- Medium4.3Cross-Site Request Forgery
Youtube SpeedLoad
≤0.6.3No patch available
- Medium4.3Cross-Site Request Forgery
Preloader Matrix
≤2.0.1No patch available
- Medium4.3Cross-Site Request Forgery
Plainview Protect Passwords
≤1.4No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()
Elementor Website Builder – more than just a page builder
≤3.16.4Update to 3.16.5
- Medium4.3Cross-Site Request Forgery via gen_set_page
WP Category Post List Widget
≤2.0.3No patch available