Database
WordPress Vulnerability Database (page 1080)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Client+) Stored Cross-Site Scripting
Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
≤5.5.0Update to 5.5.1
- High8.8Missing Authorization to Authenticated (Subscriber+) Settings Update & Privilege Escalation
BAN Users
≤1.5.3No patch available
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting Vulnerability via Shortcode
Testimonial Slider Shortcode
<1.1.9Update to 1.1.9
- Medium4.3Cross-Site Request Forgery via 'display_results'
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
<8.1.15Update to 8.1.16
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Photospace Responsive Gallery
≤2.1.1Update to 2.2.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
≤5.5.0Update to 5.5.1
- High8.3Missing Authorization via 'start_staging' and 'get_staging_progress'
WPvivid — Backup, Migration & Staging
<0.9.91Update to 0.9.91
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
Iptanus File Upload
<4.23.3Update to 4.23.3
- Medium5.3Insecure Password Reset Mechanism
WP User Control
≤1.5.3No patch available
- Medium4.3Cross-Site Request Forgery
WooCommerce Subscription
<4.6.0Update to 4.6.0
- Medium6.5Unauthenticated Stored Cross-Site Scripting
Booking Calendar
≤9.7.3Update to 9.7.3.1
- Medium4.9Authenticated(Shop Manager+) Sensitive Information Exposure
WooCommerce
≤7.0.0Update to 7.0.1
- High8.8Authenticated (Contributor+) Blind SQL Injection via Shortcode
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤5.0.9Update to 5.0.10
- Medium4.3Cross-Site Request Forgery to Checkout Fields Update
Checkout Field Editor
≤1.7.4Update to 1.7.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Google Maps Plugin by Intergeo
≤2.3.2No patch available
- Critical9.8Unauthenticated SQL injection
WP Sessions Time Monitoring Full Automatic
≤1.0.8Update to 1.0.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
≤2.88.4Update to 2.88.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
JQuery Accordion Menu Widget
≤3.1.2No patch available
- High8.8<= 1.7.6 - Cross-Site Request Forgery to Arbitrary File Rename
File Manager Pro – Filester
≤1.7.6Update to 1.8
- Medium4.3Cross-Site Request Forgery
Checkout Field Editor
<1.7.5Update to 1.7.5
- Medium5.3Sensitive Information Exposure
WooCommerce
≤7.8.2Update to 7.9.0
- High7.2Authenticated (Administrator+) PHP Object Injection
Read More & Accordion
≤3.2.6.1Update to 3.2.7
- Medium6.1Prototype Pollution
Socialdriver
<2024Update to 2024
- Medium6.4Authenticated (Contributor+) Server Side Request Forgery
Crayon Syntax Highlighter
≤2.8.4No patch available
- Medium6.1Reflected Cross-Site Scripting via 'PHP_SELF'
Zotpress
≤7.3.4Update to 7.3.5
- Low2.2Incomplete Authorization via 'save_image' and 'save_images'
Modula Image Gallery – Photo Grid & Video Gallery
<2.7.5Update to 2.7.5
- Medium4.3Missing Authorization to Sensitive Information Exposure
Educare – Students & Result Management System
<1.4.7Update to 1.4.7
- Medium4.3ProfilePress <= 4.13.1 Cross-Site Request Forgery via 'admin_notice'
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<4.13.2Update to 4.13.2
- High7.3Limited Privilege Escalation via 'acceptable_defined_roles'
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<4.13.2Update to 4.13.2
- Medium5.4Insufficient Escaping of Stored LDAP Values
Staff/Employee Business Directory for Active Directory
≤1.2.2Update to 1.2.3