Database
WordPress Vulnerability Database (page 1078)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Magee Shortcodes
≤2.1.1No patch available
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
EventON – Events Calendar
≤2.1.7Update to 2.2
- Medium4.3Cross-Site Request Forgery
Checkfront Online Booking System
≤3.6Update to 3.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Connect Matomo – Analytics Dashboard for WordPress
≤1.0.28Update to 1.0.29
- High7.2Unauthenticated Stored Cross-Site Scripting
Drag and Drop Multiple File Upload for WooCommerce
≤1.1.0Update to 1.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Shared Files – File Upload & Download Manager
≤1.7.5Update to 1.7.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Memberlite Shortcodes
<1.3.9Update to 1.3.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Anchor Episodes Index (Spotify for Podcasters)
<2.1.8Update to 2.1.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Leaflet Map
≤3.3.0Update to 3.3.1
- Medium6.1Reflected Cross-Site Scripting
Dreamfoxmedia Payment Gateway per Product for WooCommerce
<3.2.8Update to 3.2.8
- Medium4.3Cross-Site Request Forgery
Inactive Logout
<3.2.3Update to 3.2.3
- Medium5.3Missing Authorization
Inactive Logout
<3.2.3Update to 3.2.3
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
≤3.1.37.1Update to 3.1.38
- High7.2Authenticated (Administrator+) PHP Object Injection via Imported File
Weaver Xtreme Theme Support
≤6.3.0Update to 6.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WordPress Charts
≤0.7.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Table of Contents Plus – Automatic Table of Contents for Posts & Pages
<2309Update to 2309
- High7.2Authenticated (Admin+) Arbitrary File Upload
File Manager Pro – Filester
≤1.8Update to 1.8.1
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
File Manager Pro – Filester
≤1.8Update to 1.8.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Widget Responsive for Youtube
≤1.6.1Update to 1.6.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist
<1.2Update to 1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Poptin – Email Marketing Automation, Newsletter & Exit Pop Ups, Email Popups
≤1.3Update to 1.3.1
- High8.8Unauthenticated SQL Injection
Comments – wpDiscuz
<7.6.6Update to 7.6.6
- Medium4.3Missing Authorization on 'deleteLegalTemplate'
Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator
<1.3.8Update to 1.3.8
- Medium5.8Unauthenticated Email Creation/Sending
Super Store Finder
≤6.9.3Update to 6.9.4
- Medium6.5Unauthenticated Stored Cross-Site Scripting
Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder
<3.4Update to 3.4
- Medium4.3Cross-Site Request Forgery to Settings Update
Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode
≤6.15.13.1Update to 6.15.15.3
- Medium5.5Authenticated (Admin+) CSV Injection
Statify – Extended Evaluation
<2.6.4Update to 2.6.4
- Medium6.3Cross-Site Request Forgery
School Management System – WPSchoolPress
<2.2.5Update to 2.2.5
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
Horizontal scrolling announcement
≤9.2No patch available
- High7.2Unauthenticated Server-Side Request Forgery via 'link'
Dropbox Folder Share
≤1.9.7No patch available