Database
WordPress Vulnerability Database (page 1059)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
HTML filter and csv-file search
≤2.7Update to 2.8
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Up down image slideshow gallery
≤12.0Update to 12.1
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Jquery accordion slideshow
≤8.1Update to 8.2
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Image horizontal reel scroll slideshow
≤13.2Update to 13.3
- High8.8Authenticated (Contributor+) PHP Object Injection
WP Simple Galleries
≤1.34No patch available
- High7.2WP Mail Catcher <= 2.1.3 - Authenticated (Admin+) SQL Injection
Mail logging & Catcher
≤2.1.3Update to 2.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Weather Atlas Widget
≤1.2.1Update to 2.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Buzzsprout Podcasting
≤1.8.4Update to 1.8.5
- Medium6.5Unauthenticated Arbitrary Option Deletion
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.24.14Update to 2.24.18
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Accordions – Responsive Accordion & FAQ Plugin for WordPress
≤2.6Update to 2.7
- Medium4.3Cross-Site Request Forgery
Seraphinite Accelerator
≤2.20.31Update to 2.20.32
- High7.2Authenticated (Admin+) SQL Injection
GD Security Headers
≤1.7Update to 1.7.1
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Grid Layout Add/Update/Delete
Grid Plus – Unlimited grid layout
≤1.3.2Update to 1.3.3
- High7.2Authenticated (Admin+) SQL Injection
Booking calendar, Appointment Booking System
≤3.2.11Update to 3.2.12
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Related Products for WooCommerce
≤3.3.15Update to 3.3.16
- Critical9.9Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcode
PHP to Page
≤0.3No patch available
- Medium6.1Store Exporter <= 2.7.2 - Reflected Cross-Site Scripting via 'filter'
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
≤2.7.2Update to 2.7.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Simple Shortcodes
≤1.0.20No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers
≤1.12.0Update to 1.12.2
- High8.8Authenticated (Subscriber+) Local File Inclusion via Shortcode
Grid Plus – Unlimited grid layout
≤1.3.3Update to 1.3.4
- High7.2Authenticated (Admin+) SQL Injection
ImageLinks – Interactive Image Builder with Hotspots
≤1.5.4Update to 1.6.0
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Slick Popup: Contact Form 7 Popup Plugin
<1.7.15Update to 1.7.15
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Google Maps made Simple
≤0.6No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Bellows Accordion Menu
≤1.4.2Update to 1.4.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Shortcode Menu
≤3.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
FareHarbor for WordPress
≤3.6.7Update to 3.6.8
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
WP Post Popup
≤3.7.3No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update
WooHoo Newspaper Magazine Theme
≤2.5.3No patch available
- Medium6.1Reflected Cross-Site Scripting
Bonus for Woo
≤5.8.2Update to 5.8.3
- Medium4.3Cross-Site Request Forgery
Auto Excerpt everywhere
≤1.5No patch available