Database
WordPress Vulnerability Database (page 1066)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Editor+) Stored Cross-Site Scripting Vulnerability
Mediabay – Media Library Folders
≤1.6No patch available
- Medium6.5Information Exposure
Social Media Share Buttons & Social Sharing Icons
≤2.8.5Update to 2.8.6
- Medium6.1Reflected Cross-Site Scripting
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.1.4Update to 6.1.5
- Medium6.1Reflected Cross-Site Scripting
Contact Form Builder, Contact Widget
≤2.1.7No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via New Listing
Lava Directory Manager
≤1.1.34No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Custom post types, Custom Fields & more
≤5.0.2Update to 5.0.3
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
Simple Table Manager
≤1.5.6Update to 1.6.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Super Testimonial – Testimonial & Customer Review Slider Plugin for WordPress
≤2.9Update to 3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Minimum Purchase for WooCommerce
≤2.0.0.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Theme Switcha – Easily Switch Themes for Development and Testing
≤3.3Update to 3.3.1
- Medium6.1Reflected Cross-Site Scripting
Add Shortcodes Actions And Filters
≤2.0.9Update to 2.10
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤3.0.4.1Update to 3.0.4.2
- Medium4.3Missing Authorization
ApplyOnline – Application Form Builder and Manager
≤2.5.3Update to 2.5.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Maileon for WordPress
≤2.16.0Update to 2.16.1
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.1.4Update to 6.1.5
- Critical9.8Unauthenticated Arbitrary File Upload
WooCommerce Ninja Forms Product Add-ons
≤1.7.0Update to 1.7.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Ajax Archive Calendar
≤2.6.7Update to 2.6.8
- Medium4.3Cross-Site Request Forgery to Plugin Settings Reset
Widgets for Google Reviews
≤10.9Update to 10.9.1
- Medium4.3Cross-Site Request Forgery via add_to_base
DX Delete Attached Media
≤2.0.5.1Update to 2.0.6
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Responsive Pricing Table
≤5.1.7Update to 5.1.8
- High8.8Authenticated (Subscriber+) SQL Injection
Icons Font Loader – use web icons anywhere on your site, fast
≤1.1.2Update to 1.1.3
- Medium4.3Cross-Site Request Forgery
Serial Numbers – Ultimate License Manager for Selling, Licensing & Securely Delivering Digital Content with WooCommerce
≤1.6.3Update to 1.6.4
- Medium4.3Cross-Site Request Forgery via update_option_check_match_default
Rocket Font – 한글
≤1.2.3Update to 2.1.2
- Medium6.1Reflected Cross-Site Scripting
PDF Builder for WooCommerce. Create invoices,packing slips and more
≤1.2.103Update to 1.2.104
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
WP Discord Invite
≤2.5.1Update to 2.5.2
- Medium4.3Cross-Site Request Forgery
Who Hit The Page – Hit Counter
≤1.4.14.3No patch available
- Medium5.3Sensitive Information Exposure
404 Solution: Redirection and Page Suggestions
≤2.33.0Update to 2.33.1
- Medium6.1Reflected Cross-Site Scripting
The Awesome Feed – Custom Feed
≤2.2.5No patch available
- High8.1Authenticated (Submitter+) Arbitrary File Deletion
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.1.4Update to 6.1.5
- Critical9.8Unauthenticated Arbitrary File Upload in uploadImage.php
Recip.ly Plugin
≤1.1.7Update to 1.1.8