Database
WordPress Vulnerability Database (page 1064)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery to Settings Modification
Auto Login New User After Registration
≤1.9.6No patch available
- Medium6.1Reflected Cross-Site Scripting via grid_id
Grid Plus – Unlimited grid layout
≤1.3.4Update to 1.3.5
- Medium5.3Missing Authorization
MW WP Form
≤4.4.5Update to 5.0.0
- Medium4.3Cross-Site Request Forgery on AJAX Actions
Just Custom Fields
≤3.3.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Eonet Manual User Approve
≤2.1.3No patch available
- Medium4.3Cross-Site Request Forgery
Delete Usermetas
≤1.1.2Update to 1.2.0
- High7.2Server Side Request Forgery
Motors – Car Dealership & Classified Listings Plugin
≤1.4.6Update to 1.4.7
- High7.1Authenticated(Contributor+) Local File Inclusion
Ultimate Addons for WPBakery
≤3.19.14Update to 3.19.15
- Medium6.1Reflected Cross-Site Scripting
Motors – Car Dealership & Classified Listings Plugin
≤1.4.6Update to 1.4.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WC Captcha
≤1.5No patch available
- High7.2Authenticated (Administrator+) SQL Injection via orderby
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.3.28Update to 2.3.29
- High8.8Authenticated (Contributor+) SQL Injection via Shortcode
iPanorama 360 – Advanced Virtual Tour Builder
≤1.8.0Update to 1.8.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Smart App Banner
≤1.1.3Update to 1.1.4
- Medium4.3Cross-Site Request Forgery via bulk_actions
Simple Calendar – Google Calendar, Events, & ICS Feeds
≤3.2.5Update to 3.2.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤7.1.2Update to 7.1.3
- Medium5.4Cross-Site Request Forgery
Appointment Calendar
≤2.9.6No patch available
- Medium4.3Missing Authorization to Sensitive Information Exposure
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.10.19Update to 1.10.20
- Medium4.3Cross-Site Request Forgery
Novo-Map : your WP posts on custom google maps
≤1.1.2No patch available
- Medium4.3Missing Authorization
Reviews Widgets for Google & 45+ platforms by Repuso
≤4.97Update to 5.00
- Medium6.1Reflected Cross-Site Scripting
Archivist – Custom Archive Templates
≤1.7.5No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Internal Link Building
≤1.2.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Team Showcase – Responsive Team Members Grid, Slider & Carousel Plugin
≤2.1Update to 2.2
- Medium6.5Missing Authorization via REST APIs
Headline Analyzer
≤1.3.1Update to 1.3.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WhatsApp Share Button
≤1.0.1No patch available
- Medium6.5Improper Authorization to Data Import and Export
BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP
≤1.6.0Update to 1.6.1
- Medium4.3Cross-Site Request Forgery
Open Graph Metabox
≤1.4.4No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Triberr
≤4.1.1Update to 4.1.2
- Medium4.3Cross-Site Request Forgery
Internal Link Building
≤1.2.3No patch available
- Medium4.3Cross-Site Request Forgery
WP Radio – Worldwide Online Radio Stations Directory for WordPress
≤3.1.9No patch available
- Medium4.3Cross-Site Request Forgery
WOLF – WordPress Posts Bulk Editor and Manager Professional
≤1.0.7.1Update to 1.0.7.2