Database
WordPress Vulnerability Database (page 1053)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery via wplf_ajax_update_screenshots
WP Links Page
≤4.9.4Update to 4.9.5
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Actueel Financieel Nieuws – Denk Internet Solutions
≤5.2.0Update to 6.0.0
- Medium5.3Sensitive Information Exposure via Directory Listing
Front End PM
<11.4.3Update to 11.4.3
- Medium4.3Missing Authorization
BadgeOS
≤3.7.1.6No patch available
- Medium6.1Reflected Cross-Site Scripting via postid
WP Crowdfunding
≤2.1.6Update to 2.1.7
- Critical9.8Unauthenticated PHP Object Injection
Master Slider Pro
≤3.6.5No patch available
- High7.2Authenticated (Administrator+) SQL Injection
Who Hit The Page – Hit Counter
≤1.4.14.3No patch available
- Medium6.1Reflected Cross-Site Scripting via add_internal_scripts_to_head
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
<4.2.5.4Update to 4.2.5.4
- Medium5.5Authenticated (Shop manager+) Stored Cross-Site Scripting via Custom CSS Code
Direct Checkout – Quick View – Buy Now For WooCommerce
≤1.5.8Update to 1.5.9
- Medium5.5Authenticated (Shop Manager+) Stored Cross-Site Scripting
Recently viewed and most viewed products
≤1.1.1No patch available
- Medium5.4Stored Cross-Site Scripting via packages
Kadence Central – Site Management, Backups, Security, and Reporting
<3.0.1Update to 3.0.1
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Responsive Pricing Table
<5.1.8Update to 5.1.8
- High7.2Authenticated (Administrator+) SQL Injection
Redirect 404 Error Page to Homepage or Custom Page with Logs
≤1.8.7Update to 1.8.8
- Medium4.3Missing Authorization via save_settings
Dragfy Addons for Elementor
≤1.0.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Pinyin Slugs
≤2.3.0Update to 2.3.1
- Medium4.3Cross-Site Request Forgery
Donations Made Easy – Smart Donations
≤4.0.12No patch available
- Medium4.3Cross-Site Request Forgery
Image Hover Effects – WordPress Plugin
≤5.5Update to 5.6
- Medium6.3Missing Authorization via multiple AJAX functions
NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization
<1.10.0Update to 1.10.0
- Medium4.3Missing Authorization via multiple AJAX actions
Visitor Traffic Real Time Statistics
≤7.2Update to 7.3
- Medium4.3Cross-Site Request Forgery
ProfileGrid – User Profiles, Groups and Communities
≤5.7.1Update to 5.7.2
- Medium6.1Reflected Cross-Site Scripting via date parameters
Export Products, Orders & Customers for WooCommerce
≤2.0.10Update to 2.0.11
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Product Visibility by Country for WooCommerce
≤1.4.9No patch available
- Medium4.3Authenticated(Contributor+) Content Injection
ARI Stream Quiz – WordPress Quizzes Builder
≤1.3.2Update to 1.3.3
- Medium5.4Cross-Site Request Forgery to Google Drive Storage Update
UpdraftPlus Premium
≤1.23.10Update to 1.23.11
- Medium6.1Unauthenticated Stored Cross-Site Scripting via custom_css
Category Post List Widget
≤2.0No patch available
- Medium4.3Cross-Site Request Forgery
Droit Dark Mode
≤1.1.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Custom post types, Custom Fields & more
<5.0.0Update to 5.0.0
- Medium6.1Cross-Site Request Forgery via get_cplw_settings
Category Post List Widget
≤2.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
TWB Woocommerce Reviews
≤1.7.5Update to 1.7.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Lava Directory Manager
≤1.1.34No patch available