Database
WordPress Vulnerability Database (page 1063)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated (Author+) Stored Cross-Site Scripting via Shortcode
Reusable Text Blocks
≤1.5.3No patch available
- High7.2Authenticated (Administrator+) SQL Injection via orderby
404 Solution: Redirection and Page Suggestions
<2.34.0Update to 2.34.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
LiteSpeed Cache
≤5.6Update to 5.7
- Low2.7Authenticated(Author+) Insecure Direct Object Reference
Comments – wpDiscuz
≤7.6.3Update to 7.6.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Tab Ultimate – Responsive Tabs Plugin with Block, Shortcode & Widget
≤1.3Update to 1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
CPO Shortcodes
≤1.5.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
TCD Google Maps
≤1.8No patch available
- Medium4.3Unauthenticated Content Injection
Comments – wpDiscuz
≤7.6.10Update to 7.6.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Theme Blvd Shortcodes
≤1.6.8No patch available
- Medium6.1Reflected Cross-Site Scripting
Smart Online Order for Clover
≤1.5.4Update to 1.5.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WP Post Columns
≤2.2No patch available
- High7.2Authenticated (Administrator+) SQL Injection
Advanced Local Pickup for WooCommerce – Click & Collect, In-Store Pickup
≤1.5.5Update to 1.6.0
- Medium6.5Missing Authorization to (Subscriber+) Arbitrary Post Deletion
WP Hotel Booking
≤2.0.7Update to 2.0.8
- Medium6.1Reflected Cross-Site Scripting
EventON – Events Calendar
≤2.2.2Update to 2.2.3
- Medium4.3Cross-Site Request Forgery via duplicate_feed
Simple Calendar – Google Calendar, Events, & ICS Feeds
<3.2.5Update to 3.2.5
- Medium5.3Missing Authorization to Post, Term, and User Meta Deletion
Post Meta Data Manager
≤1.2.0Update to 1.2.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Add Custom Body Class
≤1.4.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Carousel, Recent Post Slider and Banner Slider
≤2.0Update to 2.1
- High7.5Missing Authorization to Sensitive Information Exposure
Soisy Pagamento Rateale
≤6.0.1Update to 6.0.2
- Medium5.3Insufficient Authorization to Comment Submission on Deleted Posts
Comments – wpDiscuz
≤7.6.10Update to 7.6.11
- Medium5.3Log Injection via Weak Authentication Token
Manago AI & Leadoo AI
≤3.2.4Update to 3.2.5
- Low2.2Authenticated(Administrator+) CSS Injection
MainWP Dashboard: Self-hosted WordPress Management for Agencies
≤4.5.1.2Update to 4.5.1.3
- Medium4.3Cross-Site Request Forgery on AJAX Actions
Just Custom Fields
≤3.3.2No patch available
- Medium5.3Missing Authorization
MW WP Form
≤4.4.5Update to 5.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate Addons for WPBakery
≤3.19.14Update to 3.19.15
- Medium4.3Cross-Site Request Forgery to Settings Modification
Auto Login New User After Registration
≤1.9.6No patch available
- Medium6.1Reflected Cross-Site Scripting via grid_id
Grid Plus – Unlimited grid layout
≤1.3.4Update to 1.3.5
- High7.1Authenticated(Contributor+) Local File Inclusion
Ultimate Addons for WPBakery
≤3.19.14Update to 3.19.15
- Medium6.1Reflected Cross-Site Scripting
Motors – Car Dealership & Classified Listings Plugin
≤1.4.6Update to 1.4.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via alnuar_auto_login_new_user_after_registration_redirect
Auto Login New User After Registration
≤1.9.6No patch available