Database
WordPress Vulnerability Database (page 1052)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Plainview Protect Passwords
≤1.4No patch available
- Medium4.3Cross-Site Request Forgery via gen_set_page
WP Category Post List Widget
≤2.0.3No patch available
- Medium4.3Cross-Site Request Forgery
Plainview Protect Passwords
≤1.4No patch available
- Medium4.3Cross-Site Request Forgery
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
≤7.0.17Update to 7.0.18
- Medium6.5Missing Authorization to Arbitrary Attachment Read
Elementor Website Builder – more than just a page builder
≤3.16.4Update to 3.16.5
- Medium4.3Cross-Site Request Forgery via ic_system_status
Product Catalog Simple
≤1.7.5Update to 1.7.6
- Medium4.3Cross-Site Request Forgery via kon_tergos_options
Korea SNS
≤1.6.4Update to 1.6.5
- Medium6.1Reflected Cross-Site Scripting
Post Pay Counter
≤2.789Update to 2.790
- Medium4.3Cross-Site Request Forgery via vsrp_admin_options
Vertical scroll recent post
≤14.0No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting via edit_doc_one_page
EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder
≤2.3.5Update to 2.3.6
- Medium6.1Unauthenticated Cross-Site Scripting
Under Construction / Maintenance Mode from Acurax
≤2.6No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
ANAC XML Bandi di Gara
≤7.5Update to 7.6
- Medium4.3Cross-Site Request Forgery to Amazon Tracking ID Update
Amazonify
≤0.8.1No patch available
- Medium6.1Unauthenticated Cross-Site Scripting
Edit WooCommerce Templates
≤1.1.1Update to 1.1.2
- Medium4.3Cross-Site Request Forgery via settings.php
ANAC XML Bandi di Gara
≤7.5Update to 7.6
- Medium5.5Authenticated (Shop manager+) Stored Cross-Site Scripting via plugin settings
Extra Product Options for WooCommerce
≤4.1Update to 4.2
- Medium6.1Cross-Site Request Forgery via get_cplw_settings
Category Post List Widget
≤2.0No patch available
- Medium5.4Cross-Site Request Forgery via manage_avatar_cache
Add Local Avatar
≤12.1No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting via custom_css
Category Post List Widget
≤2.0No patch available
- Medium4.3Cross-Site Request Forgery via menu_page
Great Restaurant Menu WP
≤1.3.1Update to 1.4.0
- Medium6.5Missing Authorization via doc_one_page and edit_doc_one_page
EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder
≤2.3.5Update to 2.3.6
- Medium6.1Reflected Cross-Site Scripting
SendPress Newsletters
≤1.23.11.6Update to 1.24.8.19
- Medium6.1Reflected Cross-Site Scripting
WPDBSpringClean
≤1.6No patch available
- Medium4.3Missing Authorization via cnss_save_ajax_order
Easy Social Icons
≤3.2.4Update to 3.2.5
- Medium4.3Content Injection via Improper Access Control
Foyer – Digital Signage for WordPress
≤1.7.5No patch available
- Medium5.3Sensitive Information Exposure
Email Marketing for WooCommerce by Omnisend
≤1.13.8Update to 1.13.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
OneClick Chat to Order
≤1.0.4.2Update to 1.0.5
- High8.8Authenticated (Contributor+) Remote Code Execution
Rename Media Files
≤1.0.1No patch available
- High7.1Cross-Site Request Forgery via pms-cross-promotion.php
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.10.3Update to 3.10.4
- Medium4.3Missing Authorization via update_settings
코드엠샵 마이사이트 – MSHOP MY SITE
≤1.1.7Update to 1.1.8