Database
WordPress Vulnerability Database (page 1061)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization via ajax_sales_order
Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard
≤3.7.3Update to 3.7.4
- Medium5.3Missing Authorization
Generate Dummy Posts
≤1.0.0No patch available
- Medium4.3Cross-Site Request Forgery via accua_forms_list_page_table
Contact Forms by Cimatti
≤1.6.0Update to 1.6.1
- Medium4.3Missing Authorization to Arbitrary Email Sending
WP EXtra – One Click Optimize
≤6.2Update to 6.3
- Medium5.4Missing Authorization via Multiple AJAX Actions
My Shortcodes
≤2.3No patch available
- Medium4.7Open Redirect via 'redirect'
Parcel Pro
≤1.6.11Update to 1.6.12
- Medium6.5Missing Authorization via Multiple AJAX Actions
WP CTA – Call Now Button, Sticky Button & Call to Action Builder
≤1.5.8Update to 1.5.9
- Medium5.4Cross-Site Request Forgery
WDSocialWidgets
≤1.0.15No patch available
- Medium4.3Cross-Site Request Forgery via wpdeepl_prune_logs
Translation with DeepL API
≤2.4.1.1Update to 2.4.1.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Task Data
Groundhogg — CRM, Newsletters, and Marketing Automation
≤2.7.11.10Update to 2.7.11.11
- Medium6.1Reflected Cross-Site Scripting
WPPizza – A Restaurant Plugin
≤3.18.2Update to 3.18.3
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
Fathom Analytics for WP
<3.1.0Update to 3.1.0
- Medium6.1Reflected Cross-Site Scripting via as
Simple User Listing
≤1.9.2Update to 1.9.3
- Medium6.5Missing Authorization in prq_set_token
Quiz Builder for WooCommerce – Product Recommendations
≤2.1.0Update to 2.1.2
- Medium4.3Cross-Site Request Forgery via csmt_admin_options
Category SEO Meta Tags
≤2.5No patch available
- Medium4.3Cross-Site Request Forgery
WCP OpenWeather
≤2.5.0No patch available
- Medium6.1Reflected Cross-Site Scripting
FLOWFACT WP Connector
≤2.1.8No patch available
- High8.8Missing Authorization to Authenticated(Subscriber+) Arbitrary Options Update
Deeper Comments
≤2.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
User Avatar
≤1.4.11Update to 1.4.12
- Medium5.3Protection Bypass of Renamed Login Page via URL Encoding
All-In-One Security (AIOS) – Security and Firewall
<5.2.5Update to 5.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
VK Filter Search
≤2.3.1Update to 2.3.2
- High7.5Password Protection Mode Security Feature Bypass
Admin and Site Enhancements (ASE)
≤5.7.1Update to 5.8.0
- Medium5.3Missing Authorization
WP Glossary
≤3.1.2No patch available
- Medium4.3Cross-Site Request Forgery
Custom My Account for Woocommerce
≤2.1No patch available
- Medium4.3Cross-Site Request Forgery
Custom Header Images
≤1.2.1No patch available
- Medium5.3Missing Authorization
kk Star Ratings – Rate Post & Collect User Feedbacks
≤5.4.5Update to 5.4.6
- Medium4.3Missing Authorization via calculate_statistics
WP Word Count
≤3.2.4No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
SAHU TikTok Pixel for E-Commerce
≤1.2.2No patch available
- Medium6.1Reflected Cross-Site Scripting
CloudNet360
≤3.2.0No patch available
- Medium4.3Cross-Site Request Forgery to Settings Modification
Remove Add to Cart WooCommerce
≤1.4.4Update to 1.4.5