Database
WordPress Vulnerability Database (page 1055)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Cross-Site Request Forgery via manage_avatar_cache
Add Local Avatar
≤12.1No patch available
- Medium6.1Reflected Cross-Site Scripting
SendPress Newsletters
≤1.23.11.6Update to 1.24.8.19
- Medium5.4Cross-Site Request Forgery via load
Code Snippets
<3.6.0Update to 3.6.0
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Arbitrary Page/Post Deletion via imgmap_delete_area_ajax
ImageMapper
≤1.2.6No patch available
- Medium5.3IP Spoofing to Protection Mechanism Bypass
Security Plugin, Firewall & Malware Scanner with Auto Removal
≤2.120Update to 2.121
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Bitly's WordPress Plugin
≤2.7.1Update to 2.7.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Online Scheduling and Appointment Booking System – Bookly
≤22.4.1Update to 22.5
- Medium6.4Cross-Site Scripting
Brizy – Page Builder
≤2.4.29Update to 2.4.30
- High7.2Unauthenticated Stored Cross-Site Scripting
Vietnam Checkout for WooCommerce
≤2.0.5Update to 2.0.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
SendPress Newsletters
≤1.22.3.31Update to 1.23.11.6
- High7.2Unauthenticated Stored Cross-Site Scripting
WP-UserOnline
≤2.88.2Update to 2.88.3
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via imgmap_save_area_title
ImageMapper
≤1.2.6No patch available
- High8.8Authenticated (Subscriber+) Directory Traversal
Mmm Simple File List
≤2.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
QR Code Tag
≤1.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Simple Like Page – Fast & Privacy-Friendly Page Embeds
≤1.5.1Update to 1.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
≤2.7.0Update to 2.7.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Mmm Simple File List
≤2.3No patch available
- Low3.7Sensitive Information Exposure
Job Manager & Career – Manage job board listings, and recruitments
≤1.4.3Update to 1.4.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via ziteboard Shortcode
Ziteboard Online Whiteboard
≤2.9.9Update to 3.0.0
- Medium6.5Unauthenticated Server Side Request Forgery
WPB Show Core
≤2.2No patch available
- High7.2Missing Authorization to Unauthenticated Stored Cross-Site Scripting
Web Push Notifications – Webpushr
≤4.34.0Update to 4.35.0
- Medium6.4Social Warfare <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Social Sharing Plugin – Social Warfare
≤4.4.3Update to 4.4.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Garden Gnome Package
≤2.2.8Update to 2.2.9
- High7.2Unauthenticated Stored Cross-Site Scripting via IP
WassUp Real Time Analytics
≤1.9.4.5No patch available
- Medium4.3Missing Authorization to Settings Update
WebToffee WP Backup and Migration
≤1.4.3Update to 1.4.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via Shortcode
Social Feed | All social media in one place
≤1.5.4.6No patch available
- Critical9.8Unauthenticated Local File Inlclusion
WPB Show Core
≤2.2No patch available
- Medium4.3Cross-Site Request Forgery to Plugin Settings Change via ajax
ImageMapper
≤1.2.6No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
ImageMapper
≤1.2.6No patch available
- High8.8Authenticated (Contributor+) SQL Injection via Shortcode
WD WidgetTwitter
≤1.0.9No patch available