Database
WordPress Vulnerability Database (page 1074)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Timely Booking Button
≤2.0.2No patch available
- Medium6.32.2.1 - Authenticated (Subscriber+) Arbitrary Options Update
WPGet API – Connect to any external REST API
2.1.0 – <2.2.2Update to 2.2.2
- Medium4.3Cross-Site Request Forgery
Instant CSS
≤1.2.1Update to 1.2.2
- Medium4.3Missing Authorization
Unyson
≤2.7.28No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Jump Menu
≤3.6.4No patch available
- Critical9.9Authenticated (Subscriber+) Remote Code Execution via Shortcode
OpenHook
≤4.3.0Update to 4.3.1
- Medium4.3Cross-Site Request Forgery
Keap Landing Pages
≤1.4.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Tiger Forms – Drag and Drop Form Builder
<2.1.0Update to 2.1.0
- Medium4.3Cross-Site Request Forgery
Table of Contents Plus – Automatic Table of Contents for Posts & Pages
≤2302Update to 2309
- Medium4.3Cross-Site Request Forgery
Remove slug from custom post type
≤1.0.3No patch available
- Medium4.3Cross-Site Request Forgery
WP Captcha
≤2.0.0No patch available
- Medium4.3Missing Authorization
WP GPX Maps – GPX, FIT & KML maps with elevation profile
≤1.7.05Update to 1.7.06
- High7.2Reflected Cross-Site Scripting
FooGallery Photo Gallery : Image, Video & Masonry Galleries
<2.3.2Update to 2.3.2
- Medium4.3Missing Authorization to Transients Deletion
WP Custom Admin Interface
<7.33Update to 7.33
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Cooked – Recipe Management
≤1.7.14Update to 1.7.15.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Slideshow, Image Slider by 2J
≤1.3.54No patch available
- Medium4.3Cross-Site Request Forgery
Contact Form
≤2.0.11Update to 2.0.12
- Medium4.3Cross-Site Request Forgery
WP Hide Pages
≤1.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Comments by Startbit
≤1.4No patch available
- Medium4.3Cross-Site Request Forgery
FooGallery Photo Gallery : Image, Video & Masonry Galleries
≤2.2.44Update to 2.3.2
- Medium4.3Cross-Site Request Forgery
Shockingly Simple Favicon
≤1.8.2No patch available
- Medium4.3Cross-Site Request Forgery
Timthumb Vulnerability Scanner
≤1.54No patch available
- Medium6.1Reflected Cross-Site Scripting
Contractor Contact Form Website to Workflow Tool
≤4.0.0Update to 4.1.0
- Medium4.3Cross-Site Request Forgery
WP Site Protector
≤2.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WWM Social Share On Image Hover
≤2.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Advanced Custom Fields: Extended
≤0.8.9.3Update to 0.8.9.4
- Medium5.3Cross-Site Request Forgery
CopyRightPro
≤2.1No patch available
- Medium4.3Cross-Site Request Forgery to Transients Deletion
WP Custom Admin Interface
<7.33Update to 7.33
- Medium5.3CAPTCHA Bypass
WP Captcha
≤2.0.0No patch available
- Medium4.3Cross-Site Request Forgery
Backend Localization
≤2.1.10No patch available