Database
WordPress Vulnerability Database (page 1067)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery via wur_settings_view
WP Ultimate Review
≤2.2.4Update to 2.3.1
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤3.0.4.1Update to 3.0.4.2
- Medium6.6Authenticated(Administrator+) Time-Based Blind SQL Injection
History Log by click5
≤1.0.12Update to 1.0.13
- Medium4.3Cross-Site Request Forgery via multiple settings pages
AMP WP – Google AMP For WordPress
≤1.5.15Update to 1.5.16
- Medium4.3Cross-Site Request Forgery
Ultimate Taxonomy Manager
≤2.0No patch available
- Medium6.1Unauthenticated Cross-Site Scripting
Libsyn Publisher Hub
≤1.4.4No patch available
- High8.0Google Drive Client Secret Exposure
WPvivid — Backup, Migration & Staging
≤0.9.91Update to 0.9.92
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
WP GoToWebinar
≤14.45Update to 14.46
- High7.6Missing Authorization via handleRequest
RumbleTalk Group Chat for Communities & Live Events
≤6.1.9Update to 6.2.0
- Medium5.3Sensitive Information Exposure
Libsyn Publisher Hub
≤1.4.4No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Newsletter & Bulk Email Sender – Email Newsletter Plugin for WordPress
≤2.0.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
LeadSquared Suite
≤0.7.4No patch available
- Medium6.1Unauthenticated Cross-Site Scripting
Ultimate Taxonomy Manager
≤2.0No patch available
- High8.8Authenticated (Subscriber+) SQL Injection
Accessibility Suite by Ability, Inc
≤4.12Update to 4.13
- Medium4.3Cross-Site Request Forgery
Post Gallery
≤2.3.12No patch available
- Medium5.4Cross-Site Request Forgery
Contact Form With Captcha
≤1.6.8No patch available
- Medium5.4Cross-Site Request Forgery via Multiple AJAX actions
Mailmunch Forms for Mailchimp
≤3.1.7Update to 3.1.8
- Medium4.3Missing Authorization via admin notice dismissal
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.12.6Update to 1.12.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Easy Testimonial Slider and Form
≤1.0.18Update to 1.0.19
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
BuddyPress Global Search
≤1.2.1No patch available
- Medium4.3Cross-Site Request Forgery
WP Attachments – Smarter File Management & Download Lists
≤5.0.11Update to 5.0.12
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Next Page
≤1.5.2No patch available
- Medium4.3Cross-Site Request Forgery
AGP Font Awesome Collection
≤3.2.4No patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Simple Tweet
≤1.4.0.2No patch available
- Medium4.3Cross-Site Request Forgery
Video Playlist for YouTube
≤6.1Update to 6.2
- Medium6.3Authenticated(Contributor+) Local File Inclusion via shortcode
Remote Content Shortcode
≤1.5No patch available
- Medium5.3Denial of Service via Cache Poisoning
WordPress
≤6.3.1Update to 4.7.27 or 4.8.23 or 4.9.24 or 5.0.20 or 5.1.17 or 5.2.19 or 5.3.16 or 5.4.14 or 5.5.13 or 5.6.12 or 5.7.10 or 5.8.8 or 5.9.8 or 6.0.6 or 6.1.4 or 6.2.3 or 6.3.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
WP ULike – Like Buttons, Voting & Engagement Analytics
≤4.6.8Update to 4.6.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Print, PDF & Email by PrintFriendly
≤5.5.1Update to 5.5.2
- Medium4.3Missing Authorization
Nexter
≤2.0.3Update to 2.0.4