Database
WordPress Vulnerability Database (page 1072)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Product Category Tree
≤2.5No patch available
- Medium4.3Authenticated (Contributor+) Content Injection
Content Pilot – Autoblogging & Affiliate Marketing Suite
≤1.3.3Update to 1.3.4
- Medium6.1Reflected Cross-Site Scripting
canvasio3D Light
≤2.5.0No patch available
- Medium4.3Cross-Site Request Forgery
Interactive World Map
≤3.2.0Update to 3.4.4
- Medium5.4Cross-Site Request Forgery
Reviews Widgets for Google & 45+ platforms by Repuso
≤5.01Update to 5.02
- Medium5.3Captcha Bypass
SilentShield – Captcha & Anti-Spam for WordPress (CF7, WPForms, Elementor, WooCommerce)
≤1.11.3Update to 1.11.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gumroad
≤3.1.0No patch available
- High7.3Missing Authorization
Sharkdropship & affiliate for AliExpress
≤2.2.4Update to 2.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Simple HTML Sitemap
≤2.4Update to 2.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Hitsteps Web Analytics
≤5.86Update to 5.87
- High8.8Authenticated (Subscriber+) SQL Injection
Copy or Move Comments
≤5.0.4No patch available
- Medium6.1Reflected Cross-Site Scripting
Delivery Date Time & Pickup for WooCommerce
≤2.4.6Update to 2.4.7
- Medium6.1Reflected Cross-Site Scripting
Social Feed | Custom Feed for Social Media Networks
≤2.2.0No patch available
- Medium5.3Cross-Site Request Forgery via qc_wp_latest_update_check
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤4.7.8Update to 4.7.9
- Medium6.1Reflected Cross-Site Scripting via 'page'
OPcache Dashboard
≤0.3.1No patch available
- High7.2Unauthenticated Cross-Site Scripting
AmpedSense – AdSense Split Tester
≤4.68No patch available
- Medium4.3Cross-Site Request Forgery
Publish Confirm Message
≤1.3.1Update to 2.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.18Update to 1.15.19
- High8.8Authenticated (Contributor+) SQL Injection
Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress
≤7.1.1Update to 8.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Podcast Subscribe Buttons
≤1.4.8Update to 1.4.9
- Medium4.3Cross-Site Request Forgery
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.7.27Update to 1.7.28
- Medium4.3Cross-Site Request Forgery
Sp*tify Play Button for WordPress
≤2.10Update to 2.11
- Medium5.4Cross-Site Request Forgery
WP Forms Puzzle Captcha
≤4.1No patch available
- Medium5.4Cross-Site Request Forgery
Post View Count
≤2.0Update to 2.0.1
- Medium6.1Reflected Cross-Site Scripting via 's'
Bulk NoIndex & NoFollow Toolkit
<1.5Update to 1.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Playlist Player for YouTube – Fast, Privacy-Friendly Playlists & Channel Feed
≤4.6.7Update to 4.6.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Complete Open Graph
≤3.4.5No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Dropshipping & Affiliation with Amazon
≤2.1.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Open User Map – Interactive Leaflet Maps
≤1.3.26Update to 1.3.27
- Medium5.3Missing Authorization via 'odb_csv_download'
Optimize Database after Deleting Revisions
≤5.0.110Update to 5.1