Database
WordPress Vulnerability Database (page 1075)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
Shockingly Simple Favicon
≤1.8.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Tiny Carousel Horizontal Slider
≤8.1No patch available
- Medium4.3Cross-Site Request Forgery
Kv TinyMCE Editor Add Fonts
≤1.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Onclick show popup
≤8.1No patch available
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Modern Events Calendar Lite
<7.1.0Update to 7.1.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
BuddyMeet
<2.3.0Update to 2.3.0
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Popup contact form
≤7.1No patch available
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Adminify – White Label, Admin Menu Editor, Login Customizer
≤3.1.7Update to 3.1.8
- Critical9.1Unauthenticated Arbitrary File Deletion
Simple File List
≤6.1.9Update to 6.1.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Awesome Feed – Custom Feed
≤2.2.5No patch available
- High8.8Cross-Site Request Forgery to Arbitrary Options Update
Events Rich Snippets for Google
≤1.8No patch available
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Popup contact form
≤7.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Blocks: Reusable Content, Shortcodes & Site Variables
≤1.6.42Update to 25.09.30.1006
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
bbp style pack
<5.6.8Update to 5.6.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Font Awesome More Icons
≤3.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
TM WooCommerce Compare & Wishlist
≤1.1.7No patch available
- Medium4.3Cross-Site Request Forgery via render_settings_page
Mediavine Control Panel
≤2.10.2Update to 2.10.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Font Awesome Integration
≤5.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Magic Action Box
≤2.17.2No patch available
- Medium4.3Cross-Site Request Forgery
Mang Board
≤1.8.1Update to 1.8.2
- Medium5.3Cross-Site Request Forgery via bspu_plugin_select.php
Block Plugin Update
≤3.3.1Update to 3.3.2
- Medium5.3Missing Authorization via page_init
Schema App Structured Data
≤1.22.3Update to 1.22.4
- Medium4.3Cross-Site Request Forgery via saveSetting
Woocommerce ESTO
≤2.23.1Update to 2.23.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
flowpaper
≤2.0.3Update to 2.0.4
- Low3.8Authenticated (Admin+) Arbitrary File Upload
Ni Purchase Order(PO) For WooCommerce
≤1.2.1Update to 1.2.2
- High8.8Authenticated (Author+) SQL Injection via 'stats' REST Endpoint
Track The Click
≤0.3.11Update to 0.3.12
- High8.8Authenticated(Editor+) Arbitrary File Upload
Welcart e-Commerce
≤2.8.21Update to 2.8.22
- High7.2Unauthenticated Stored Cross-Site Scripting via User-Agent header
User Activity Log Pro
≤2.3.3Update to 2.3.4
- High8.8Account Takeover via Password Reset
Simple Membership
≤4.3.4Update to 4.3.5
- High7.2Authenticated (Admin+) PHAR Deserialization
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤3.38Update to 3.39