Database
WordPress Vulnerability Database (page 1058)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Missing Authorization to Arbitrary Options Update
Delivery Date Time & Pickup for WooCommerce
≤2.4.6Update to 2.4.7
- High7.5Missing Authorization to Content Deletion
Finale Lite – Sales Countdown Timer & Discount for WooCommerce
≤2.16.0Update to 2.17.0
- Medium5.3Unauthenticated Login Page Disclosure
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
≤9.0.0Update to 9.0.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
IdeaPush
≤8.52Update to 8.53
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Linker – URL shortener & track outbound link clicks
≤1.2.1Update to 1.2.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via settings
WP Meta and Date Remover
<2.2.0Update to 2.2.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Admin Bar & Dashboard Access Control
<1.2.9Update to 1.2.9
- Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure
WP Customer Reviews
≤3.6.6Update to 3.6.7
- Medium6.1Cross-Site Request Forgery
Login Screen Manager
≤3.5.2No patch available
- Medium5.3Missing Authorization via handleBeforeGateway
GiveWP – Donation Plugin and Fundraising Platform
≤2.33.1Update to 2.33.2
- Critical9.8Unauthenticated Local File Inclusion
The Plus Addons for Elementor Page Builder Pro
≤5.2.8Update to 5.2.9
- Medium5.4Cross-Site Request Forgery to Stripe Integration Deletion
GiveWP – Donation Plugin and Fundraising Platform
≤2.33.3Update to 2.33.4
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Jquery news ticker
≤3.0Update to 3.1
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Information Reel
≤10.0Update to 10.1
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Wp photo text slider 50
≤8.0Update to 8.1
- Critical9.0Unauthenticated (Limited) Remote Code Execution
Ads by datafeedr.com
≤1.1.3Update to 1.2.0
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Superb slideshow gallery
≤13.1Update to 13.2
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Wp anything slider
≤9.1Update to 9.2
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Up down image slideshow gallery
≤12.0Update to 12.1
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Image horizontal reel scroll slideshow
≤13.2Update to 13.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
HTML filter and csv-file search
≤2.7Update to 2.8
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Jquery accordion slideshow
≤8.1Update to 8.2
- High8.8Authenticated (Contributor+) Local File Inclusion via Shortcode
HTML filter and csv-file search
≤2.7Update to 2.8
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Image vertical reel scroll slideshow
≤9.0Update to 9.1
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
idbbee
≤1.0No patch available
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Vertical marquee plugin
≤7.1Update to 7.2
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Message ticker
≤9.2Update to 9.3
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
WP fade in text news
≤12.0Update to 12.1
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Popup with fancybox
≤3.5Update to 3.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Live updates from Excel
≤2.3.2Update to 2.3.3