Database
WordPress Vulnerability Database (page 1062)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery to Settings Modification
Remove Add to Cart WooCommerce
≤1.4.4Update to 1.4.5
- Medium6.1Reflected Cross-Site Scripting
CloudNet360
≤3.2.0No patch available
- Medium4.3Missing Authorization via ajax_sales_order
Ni WooCommerce Sales Report – Orders, Revenue & Sales Analytics Dashboard
≤3.7.3Update to 3.7.4
- Medium5.3Missing Authorization via add_woo_coupon
Convertful – Your Ultimate On-Site Conversion Tool
≤2.5Update to 2.6
- Medium6.3Improper Access Control via register_cpt
Interactive Image Map Plugin – Draw Attention
≤2.0.15Update to 2.0.16
- Medium4.3Missing Authorization to Font Deletion
TK Google Fonts
≤2.2.11Update to 2.2.12
- Medium5.3Missing Authorization via feedfocal_api_setup REST function
FeedFocal
≤1.2.2Update to 1.3.0
- Medium4.3Cross-Site Request Forgery via whp_fields
WP Helper Premium
≤4.5.1Update to 4.5.2
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
Cookie Bar
<2.1Update to 2.1
- Medium4.3Missing Authorization to Font Addition
TK Google Fonts
≤2.2.11Update to 2.2.12
- High8.8Missing Authorization to .htaccess File Modification
WP EXtra – One Click Optimize
≤6.2Update to 6.3
- Medium4.3Missing Authorization
WP iCal Availability
≤1.0.3No patch available
- Medium5.4Missing Authorization
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes
≤3.3.0Update to 3.4.0
- Medium6.5Missing Authorization via REST Endpoints
DoLogin Security
≤3.7.1Update to 3.8
- Medium5.4Cross-Site Request Forgery
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes
≤3.3.0Update to 3.4.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Block
VK Blocks
≤1.63.0.1Update to 1.64.0.0
- High8.1Unauthenticated PHP Object Injection via cetitle
KD Coming Soon
≤1.7No patch available
- Medium4.3Missing Authorization via AJAC actions
Mediabay – Media Library Folders
≤1.6No patch available
- Medium5.3Reusable Captcha via validateImage
YOP Poll
≤6.5.28Update to 6.5.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
CallRail Phone Call Tracking
≤0.5.2Update to 0.5.3
- Medium5.3Missing Authorization via credits REST API Endpoint
Group Chat & Video Chat by AtomChat
≤1.1.4Update to 1.1.5
- High7.2Authenticated (Administrator+) SQL Injection via orderby
404 Solution: Redirection and Page Suggestions
<2.34.0Update to 2.34.0
- Medium5.5Authenticated (Author+) Stored Cross-Site Scripting via Shortcode
Reusable Text Blocks
≤1.5.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
LiteSpeed Cache
≤5.6Update to 5.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
MomentoPress for Momento360
<1.0.2Update to 1.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Very Simple Google Maps
≤2.9Update to 2.9.1
- Medium6.5Authenticated(Contributor+) Directory Traversal via _url_get_contents
ICS Calendar
<10.12.0.2Update to 10.12.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WDContactFormBuilder
≤1.0.72No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Advanced Menu Widget
≤0.4.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
BSK PDF Manager
≤3.4.1Update to 3.4.2