Database
WordPress Vulnerability Database (page 1060)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated PHP Object Injection
Five Star Restaurant Menu and Food Ordering
≤2.4.10Update to 2.4.11
- High7.5Missing Authorization to User, Term, and Post Meta Deletion
Post Meta Data Manager
≤1.2.0Update to 1.2.1
- High8.8Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Post Meta Data Manager
≤1.2.0Update to 1.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Magic Embeds
≤3.1.1Update to 3.1.2
- Medium5.4Arbitrary Redirect via 'redir'
Seraphinite Accelerator
≤2.20.28Update to 2.20.29
- Medium6.1Reflected Cross-Site Scripting via 'rt'
Seraphinite Accelerator
≤2.20.28Update to 2.20.29
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
≤3.7.8Update to 3.7.9
- Medium4.3Cross-Site Request Forgery to Settings Update
WooHoo Newspaper Magazine Theme
≤2.5.3No patch available
- Medium6.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Lead Deletion
My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu)
≤2.6.4Update to 2.6.5
- Medium4.3Cross-Site Request Forgery
Auto Excerpt everywhere
≤1.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Bonus for Woo
≤5.8.2Update to 5.8.3
- High8.1Unauthenticated Remote Code Execution via Local File Inclusion
Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News
≤3.4.1Update to 3.4.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Animated Counters
≤1.7Update to 1.8
- Critical9.8Unauthenticated SQL Injection
WP Hotel Booking
≤2.0.7Update to 2.0.8
- Medium5.4Cross-Site Request Forgery
Alter
≤1.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Neon text
≤1.1Update to 1.2
- Medium4.3Cross-Site Request Forgery
Current Menu Item for Custom Post Types
≤1.5Update to 1.6
- High8.3Cross-Site Request Forgery to Arbitrary File Upload
Thumbnail Slider With Lightbox
1.0 – 1.0Update to 1.0.1
- Medium4.3Cross-Site Request Forgery to Mass Slider Deletion
Responsive Thumbnail Slider
1.0 – 1.0Update to 1.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Pre-Orders for WooCommerce
≤1.2.13Update to 1.2.14
- High8.8Authenticated (Contributor+) Arbitrary File Read and Server-Side Request Forgery
ICS Calendar
≤10.12.0.2Update to 10.12.0.3
- Medium4.3Cross-Site Request Forgery
Auto Limit Posts Reloaded
≤2.5No patch available
- Medium4.3Insufficient Authorization to Unauthorized Post Deletion
WP Hotel Booking
≤2.0.8Update to 2.0.9
- Medium4.3Cross-Site Request Forgery
EasyRecipe
≤3.5.3251No patch available
- Critical9.8Unauthenticated SQL Injection
LogDash Activity Log
≤1.1.3Update to 1.1.4
- Medium4.3Cross-Site Request Forgery
Login | Login Page | Login Logo | Rename Login Page | Custom Login Page | Temporary Users | Rebrand Login | Login Captcha
≤1.1.3Update to 1.1.4
- Medium4.3Cross-Site Request Forgery
Original texts Yandex WebMaster
≤1.18No patch available
- Medium4.3Cross-Site Request Forgery
WordPress Knowledge base & Documentation Plugin – WP Knowledgebase
≤1.3.4No patch available
- Medium4.3Cross-Site Request Forgery via wpdeepl_prune_logs
Translation with DeepL API
≤2.4.1.1Update to 2.4.1.2
- Medium5.4Missing Authorization via Multiple AJAX Actions
My Shortcodes
≤2.3No patch available