Database
WordPress Vulnerability Database (page 1071)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery via render_admin_page
Mailrelay
≤2.1.1Update to 2.1.2
- Medium4.3Cross-Site Request Forgery via sendpulse_config
SendPulse Free Web Push
≤1.3.1Update to 1.3.3
- Medium5.4Cross-Site Request Forgery via init_ajax
Urvanov Syntax Highlighter
≤2.8.33Update to 2.8.34
- Medium4.3Cross-Site Request Forgery via admin_options
GoodBarber
≤1.0.23Update to 1.0.24
- Medium4.3Cross-Site Request Forgery via post_settings
Permalinks Customizer
≤2.8.2No patch available
- Medium6.5Kali Forms <= 2.3.28 - Missing Authorization via get_log
Kali Forms — Contact Form & Drag-and-Drop Builder
≤2.3.28Update to 2.3.29
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WP Popular Posts
<6.3.3Update to 6.3.3
- Medium4.3Missing Authorization to Admin Notice Dismissal
Bold Timeline Lite
≤1.1.9Update to 1.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Smart Cookie Kit
<2.3.2Update to 2.3.2
- Medium4.3Cross-Site Request Forgery via hst_optionpage
Hitsteps Web Analytics
≤5.86Update to 5.87
- Medium4.3Cross-Site Request Forgery via admin menu pages
Automated Editor
≤1.3No patch available
- Low3.4Open Redirect via atkpout.php
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
≤3.3.9Update to 3.4.0
- Medium5.4Cross-Site Request Forgery via multiple admin_post functions
Simple SEO
≤2.0.25Update to 2.0.26
- Medium4.3Cross-Site Request Forgery via params_api_form.php
WhitePage
≤1.1.5No patch available
- Medium4.3Missing Authorization via option_data_save
WowStore – Store Builder & Product Blocks for WooCommerce
≤2.7.8Update to 3.0.0
- Medium5.4Missing Authorization in Reviews Exporter
Customer Reviews for WooCommerce
≤5.36.0Update to 5.36.1
- Medium5.4Cross-Site Request Forgery via initBackEndAJAX
Pinpoint Booking System – Legacy version
≤2.9.9.4.0Update to 2.9.9.4.1
- Medium5.3Missing Authorization to Sensitive Information Exposure
Profile Extra Fields by BestWebSoft
≤1.2.7Update to 1.2.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Hotjar
≤1.0.15Update to 1.0.16
- Medium6.6Authenticated (Admin+) Command Injection
Newsletters
≤4.9.2Update to 4.9.3
- Medium4.3Authenticated (Subscriber+) Information Disclosure via Shortcode
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤7.1.1Update to 7.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Geo Controller – Geolocation & Geotargeting
≤8.5.2Update to 8.5.3
- Medium4.3Missing Authorization
Customer Reviews for WooCommerce
<5.36.1Update to 5.36.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Mendeley Plugin
≤1.3.4No patch available
- Medium5.4Cross-Site Request Forgery
LeadSquared Suite
≤0.7.4No patch available
- Medium5.3Missing Authorization to Information Dislcosure via is_print_page
WP Mail SMTP Pro
≤3.8.0Update to 3.8.1
- Medium6.1Reflected Cross-Site Scripting
Seriously Simple Stats
≤1.5.1Update to 1.5.2
- Medium4.3Cross-Site Request Forgery
ShortCodes UI
≤1.9.8No patch available
- Medium4.3Cross-Site Request Forgery
Short URL
≤1.6.8No patch available
- Medium4.3Cross-Site Request Forgery
Category Meta plugin
≤1.2.8No patch available