Database
WordPress Vulnerability Database (page 1065)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
Product Category Tree
≤2.5No patch available
- High7.2Unauthenticated Cross-Site Scripting
UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
≤1.0.9Update to 1.0.10
- Medium4.3Cross-Site Request Forgery
WP Radio – Worldwide Online Radio Stations Directory for WordPress
≤3.1.9No patch available
- Medium5.4Cross-Site Request Forgery
WooCommerce Stripe Payment Gateway
<7.6.1Update to 7.6.1
- Medium6.1Reflected Cross-Site Scripting
WDSocialWidgets
≤1.0.15No patch available
- Medium5.4Missing Authorization
Themify Ultra
≤7.3.5Update to 7.3.6
- Medium4.3Cross-Site Request Forgery
WOLF – WordPress Posts Bulk Editor and Manager Professional
≤1.0.7.1Update to 1.0.7.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Skype Legacy Buttons
≤3.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
≤7.0.5Update to 7.0.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Category SEO Meta Tags
≤2.5No patch available
- Medium5.4Missing Authorization
Themify Ultra
≤7.3.5Update to 7.3.6
- Medium4.3Cross-Site Request Forgery vin lionscripts_plg_f
Webmaster Tools
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Conversios – GA4, Google Ads & Meta Conversion Tracking with Product Feed for WooCommerce
≤6.5.3Update to 6.5.4
- Medium4.3Cross-Site Request Forgery
Smooth Scroll Links [SSL]
≤1.1.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Image Title
Thumbnail Slider With Lightbox
≤1.0Update to 1.0.1
- High7.2Unauthenticated Stored Cross-Site Scripting
mpOperationLogs
≤1.0.1No patch available
- Medium4.3Cross-Site Request Forgery
Envo Extra
<1.8.4Update to 1.8.4
- High8.8Privilege Escalation
Themify Ultra
≤7.3.5Update to 7.3.6
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Themify Ultra
≤7.3.5Update to 7.3.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Webmaster Tools
≤2.0No patch available
- Medium4.3Cross-Site Request Forgery via eos_dp_pro_delete_transient
Freesoul Deactivate Plugins – Disable plugins on individual WordPress pages
<2.1.4Update to 2.1.4
- High7.2Authenticated (Administrator+) PHP Object Injection
E2Pdf – Export Pdf Tool for WordPress
≤1.20.18Update to 1.20.19
- Medium5.3Sensitive Information Exposure
404 Solution: Redirection and Page Suggestions
≤2.33.0Update to 2.33.1
- Medium6.1Reflected Cross-Site Scripting
Protección de Datos RGPD
≤3.1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.1.4Update to 6.1.5
- Medium6.1Reflected Cross-Site Scripting
PDF Builder for WooCommerce. Create invoices,packing slips and more
≤1.2.103Update to 1.2.104
- High8.1Authenticated (Submitter+) Arbitrary File Deletion
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.1.4Update to 6.1.5
- Medium5.3Kali Forms <= 2.3.27 - Missing Authorization via Contact Form
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.3.27Update to 2.3.28
- Medium5.3Missing Authorization via moblc_auth_save_settings
Broken Link Checker | Finder
≤2.4.2Update to 2.5.0
- Medium4.3Cross-Site Request Forgery
Social Media Share Buttons & Social Sharing Icons
≤2.8.5Update to 2.8.6