Database
WordPress Vulnerability Database (page 1057)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery via check_capability
WP Affiliate Disclosure
≤1.2.6Update to 1.2.7
- Medium4.3Cross-Site Request Forgery via edit_count_ajax
WebberZone Top 10 — Popular Posts
≤3.3.2Update to 3.3.3
- Medium6.5Insecure Direct Object Reference
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
≤1.2.2Update to 1.2.3
- Medium6.5Missing Authorization via multiple AJAX functions
Short URL
≤1.6.8No patch available
- Medium4.3Cross-Site Request Forgery
Kadence WooCommerce Email Designer
≤1.5.11Update to 1.5.12
- Medium5.4Cross-Site Request Forgery
Auto Publish for Google My Business
<3.8Update to 3.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
SEO Slider
≤1.1.0Update to 1.1.1
- Medium4.3Cross-Site Request Forgery
Video Gallery – YouTube, Vimeo & Video Slider with Lightbox
1.0 – 1.0Update to 1.0.1
- Medium4.3Cross-Site Request Forgery
Advanced Menu Manager Pro – Built for Content-heavy WordPress Sites to Add, Filter, Lock, and Edit Menus Easily
≤3.0.6Update to 3.0.7
- Medium6.1Reflected Cross-Site Scripting
Digirisk
6.0.0.0 – 6.0.0.0Update to 6.1.0.0
- Medium4.3WooCommerce Email Customizer <= 1.2.7 - Cross-Site Request Forgery
WebToffee eCommerce Marketing Automation – Email marketing, Popups, Email customizer
≤1.2.7Update to 1.2.8
- Medium4.3Missing Authorization
Advanced Menu Manager Pro – Built for Content-heavy WordPress Sites to Add, Filter, Lock, and Edit Menus Easily
≤3.0.6Update to 3.0.7
- High7.2Authenticated (Administrator+) Arbitrary File Upload
Icons Font Loader – use web icons anywhere on your site, fast
≤1.1.2Update to 1.1.3
- Medium4.44.9.6 - Authenticated (Administrator+) Stored Cross-Site Scripting in FAQ Builder
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
4.8.6 – 4.9.6Update to 4.9.7
- High8.1Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Upload
Drag and Drop Multiple File Upload for Contact Form 7
≤1.3.7.3Update to 1.3.7.4
- Medium4.3Missing Authorization to Category Update
Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder
≤3.4Update to 3.4.2
- Medium4.3Cross-Site Request Forgery
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
<1.2.3.23Update to 1.2.3.23
- Medium6.5Missing Authorization to Arbitrary Post Deletion
Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder
≤3.4Update to 3.4.2
- Medium4.3Missing Authorization to Test Email Sending
Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder
≤3.4Update to 3.4.2
- Medium4.3Missing Authorization to Category Deletion
Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder
≤3.4Update to 3.4.2
- Medium6.5Cross-Site Request Forgery to Arbitrary Post Deletion
Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder
≤3.4Update to 3.4.2
- Medium4.3Missing Authorization to Post Modification
Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder
≤3.4Update to 3.4.2
- Medium4.3Missing Authorization to New Category Creation
Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder
≤3.4Update to 3.4.2
- Medium4.3Cross-Site Request Forgery to Arbitrary Post Duplication
Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder
≤3.4Update to 3.4.2
- Medium4.3Missing Authorization to Arbitrary Post Duplication
Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder
≤3.4Update to 3.4.2
- Medium4.3Missing Authorization to Enable/Disable Dark Mode
Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder
≤3.4Update to 3.4.2
- Medium4.3Cross-Site Request Forgery to plugin installation
GiveWP – Donation Plugin and Fundraising Platform
≤2.33.3Update to 2.33.4
- Medium5.4Cross-Site Request Forgery to plugin deactivation
GiveWP – Donation Plugin and Fundraising Platform
≤2.33.3Update to 2.33.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Uploaded Image Filename
Comments – wpDiscuz
≤7.6.11Update to 7.6.12
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via settings
WP Meta and Date Remover
<2.2.0Update to 2.2.0