Database
WordPress Vulnerability Database (page 1054)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
ANAC XML Bandi di Gara
≤7.5Update to 7.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
TWB Woocommerce Reviews
≤1.7.5Update to 1.7.6
- Medium6.1Unauthenticated Stored Cross-Site Scripting via custom_css
Category Post List Widget
≤2.0No patch available
- Medium4.3Cross-Site Request Forgery
ProfileGrid – User Profiles, Groups and Communities
≤5.7.1Update to 5.7.2
- Medium6.3Missing Authorization via multiple AJAX functions
NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization
<1.10.0Update to 1.10.0
- Medium4.3Cross-Site Request Forgery
Image Hover Effects – WordPress Plugin
≤5.5Update to 5.6
- Medium6.5Missing Authorization via doc_one_page and edit_doc_one_page
EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder
≤2.3.5Update to 2.3.6
- Medium6.1Cross-Site Request Forgery via get_cplw_settings
Category Post List Widget
≤2.0No patch available
- Medium4.3Missing Authorization via multiple AJAX actions
Visitor Traffic Real Time Statistics
≤7.2Update to 7.3
- Medium4.3Authenticated(Contributor+) Content Injection
ARI Stream Quiz – WordPress Quizzes Builder
≤1.3.2Update to 1.3.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
ANAC XML Viewer
≤1.7Update to 1.7.1
- Medium5.3Sensitive Information Exposure via Directory Listing
Front End PM
<11.4.3Update to 11.4.3
- Medium4.3Cross-Site Request Forgery via wplf_ajax_update_screenshots
WP Links Page
≤4.9.4Update to 4.9.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
OneClick Chat to Order
≤1.0.4.2Update to 1.0.5
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Auto Affiliate Links
≤6.4.2.4Update to 6.4.2.5
- Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
Forms for Mailchimp by Optin Cat – Grow Your MailChimp List
≤2.5.4Update to 2.5.5
- Medium4.3Cross-Site Request Forgery
Donations Made Easy – Smart Donations
≤4.0.12No patch available
- Medium4.3Missing Authorization via save_settings
Dragfy Addons for Elementor
≤1.0.2No patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Responsive Pricing Table
<5.1.8Update to 5.1.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Donations Made Easy – Smart Donations
≤4.0.12No patch available
- Medium6.1Reflected Cross-Site Scripting via cb_p6_tab
CodeBard’s Patron Button and Widgets for Patreon
≤2.1.9Update to 2.2.0
- Medium6.1Reflected Cross-Site Scripting via pf-gid
Photo Feed
≤2.2.1No patch available
- High7.2Authenticated (Editor+) SQL Injection
Master Slider Pro
≤3.6.5No patch available
- Medium6.1Reflected Cross-Site Scripting via postid
WP Crowdfunding
≤2.1.6Update to 2.1.7
- Medium6.1Reflected Cross-Site Scripting
Master Slider Pro
≤3.6.5No patch available
- Medium4.3Cross-Site Request Forgery
Plugin Name: Device Theme Switcher
≤3.0.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
CBX Map for Google Map & OpenStreetMap
≤1.1.11Update to 1.1.12
- Medium6.1Reflected Cross-Site Scripting
WPDBSpringClean
≤1.6No patch available
- Medium4.3Content Injection via Improper Access Control
Foyer – Digital Signage for WordPress
≤1.7.5No patch available
- Medium5.3Missing Authorization
CoCart – Headless REST API for WooCommerce
≤3.11.2Update to 3.12.0