Database
WordPress Vulnerability Database (page 1073)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Cross-Site Scripting
AmpedSense – AdSense Split Tester
≤4.68No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Complete Open Graph
≤3.4.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Product Category Tree
≤2.5No patch available
- Medium6.1Reflected Cross-Site Scripting
canvasio3D Light
≤2.5.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Instagram for WordPress
≤2.1.6No patch available
- Medium5.4Cross-Site Request Forgery
Post View Count
≤2.0Update to 2.0.1
- Medium4.3Cross-Site Request Forgery
Sp*tify Play Button for WordPress
≤2.10Update to 2.11
- Medium5.3Missing Authorization via 'odb_csv_download'
Optimize Database after Deleting Revisions
≤5.0.110Update to 5.1
- Medium4.3Cross-Site Request Forgery
AI Content Writing Assistant
≤1.1.6Update to 1.1.7
- High7.2Authenticated (Podcast manager+) SQL Injection via order_by
Seriously Simple Stats
≤1.5.0Update to 1.5.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Open User Map – Interactive Leaflet Maps
≤1.3.26Update to 1.3.27
- Medium4.3Cross-Site Request Forgery
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.7.27Update to 1.7.28
- Medium5.4Cross-Site Request Forgery
WP Forms Puzzle Captcha
≤4.1No patch available
- Medium4.3Authenticated (Contributor+) Content Injection
Content Pilot – Autoblogging & Affiliate Marketing Suite
≤1.3.3Update to 1.3.4
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Dropshipping & Affiliation with Amazon
≤2.1.2No patch available
- High8.8Authenticated (Contributor+) SQL Injection
Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress
≤7.1.1Update to 8.0.1
- High7.2Authenticated (Administrator+) SQL Injection
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
<2.6.1Update to 2.6.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Podcast Subscribe Buttons
≤1.4.8Update to 1.4.9
- Medium6.1Reflected Cross-Site Scripting via 's'
Bulk NoIndex & NoFollow Toolkit
<1.5Update to 1.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.18Update to 1.15.19
- Medium5.3Missing Authorization
HireZoot – Job Listings, Career Page & Recruitment Tool
≤3.4.1Update to 3.4.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Playlist Player for YouTube – Fast, Privacy-Friendly Playlists & Channel Feed
≤4.6.7Update to 4.6.8
- Medium4.3Cross-Site Request Forgery
Publish Confirm Message
≤1.3.1Update to 2.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Abandoned Cart Lite for WooCommerce
≤5.15.2Update to 5.16.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WP Responsive header image slider
≤3.2.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WOLF – WordPress Posts Bulk Editor and Manager Professional
≤1.0.7.1Update to 1.0.7.2
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Media Library Assistant
≤3.11Update to 3.12
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Social Metrics
≤2.2No patch available
- Medium5.3Information Disclosure via Debug Log
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤4.13.2Update to 4.13.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Contact form Form For All – Easy to use, fast, 37 languages.
≤1.2No patch available