Database
WordPress Vulnerability Database (page 1069)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization via admin notice dismissal
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
≤1.12.6Update to 1.12.7
- Medium5.4Cross-Site Request Forgery via Multiple AJAX actions
Mailmunch Forms for Mailchimp
≤3.1.7Update to 3.1.8
- Medium5.4Cross-Site Request Forgery
Contact Form With Captcha
≤1.6.8No patch available
- Medium6.1Reflected Cross-Site Scripting
Proofreading
≤1.1Update to 1.2
- Medium4.3Missing Authorization
Nexter
≤2.0.3Update to 2.0.4
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Simple Tweet
≤1.4.0.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Simple File List
≤6.1.9Update to 6.1.10
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Print, PDF & Email by PrintFriendly
≤5.5.1Update to 5.5.2
- Medium5.3Insecure Direct Object Reference
User Private Files – Secure File Sharing and Client Portal Plugin
<2.0.5Update to 2.0.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Etsy Shop
≤3.0.4Update to 3.0.5
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
<1.7.0.14Update to 1.7.0.14
- Medium4.3Authenticated (Contributor+) Content Injection
Responsive Tabs
<4.0.6Update to 4.0.6
- Medium5.3Captcha Bypass
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
<1.15.21Update to 1.15.21
- Medium6.1Reflected Cross-Site Scripting via 'event_id'
EventPrime – Events Calendar, Bookings, Tickets & AI
≤3.1.5Update to 3.1.6
- Critical9.1Authenticated (Administrator+) Directory Traversal to Arbitrary File Read
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤5.6.23Update to 5.6.24
- Medium5.4Cross-Site Request Forgery via Multiple AJAX Actions
Lasso Lite – Affiliate Link Manager, URL Shortener & Link Tracking
≤120Update to 121
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting via plugin widget
Get Custom Field Values
≤4.0.1Update to 4.1
- Medium6.1Reflected Cross-Site Scripting
Copy or Move Comments
≤5.0.4No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
QR Twitter Widget
≤0.2.3No patch available
- Medium5.4Cross-Site Request Forgery
Gallery – Image and Video Gallery with Thumbnails
≤2.0.3No patch available
- Medium5.3Missing Authorization to Double Booking
Appointment Hour Booking – Booking Calendar
≤1.4.23Update to 1.4.24
- Medium6.1Reflected Cross-Site Scripting
SpiderVPlayer
≤1.5.22No patch available
- Medium5.4Missing Authorization via Multiple AJAX Actions
Gallery – Image and Video Gallery with Thumbnails
≤2.0.3No patch available
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤2.0.3Update to 2.0.4
- Medium5.4Missing Authorization to Settings and Schedule Modification
WebToffee WP Backup and Migration
≤1.4.1Update to 1.4.2
- Critical9.6AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤4.9.2Update to 4.9.1 or 4.9.3
- Medium4.3Cross-Site Request Forgery via init
Feed Statistics
≤4.1No patch available
- Medium5.3Missing Authorization on AJAX actions
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤4.9.2Update to 4.9.1 or 4.9.3
- Medium6.1Reflected Cross-Site Scripting via id
Tweeple
≤0.9.5No patch available
- Medium5.3Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_user
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤4.8.9Update to 4.9.1