Database
WordPress Vulnerability Database (page 1081)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Sensitive Information Exposure
EWWW Image Optimizer
<7.2.1Update to 7.2.1
- Medium5.4Insufficient Escaping of Stored LDAP Values
Staff/Employee Business Directory for Active Directory
≤1.2.2Update to 1.2.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Simple Download Counter
1.6 – 1.6Update to 1.6.1
- Medium4.3Cross-Site Request Forgery
WP Crowdfunding
≤2.1.5Update to 2.1.6
- Medium4.3Cross-Site Request Forgery
Easy Form
<1.3.9Update to 1.3.9
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
My Account Page Editor
≤1.3.1Update to 1.3.2
- Medium4.3Cross-Site Request Forgery
EmbedPress
<3.8.4Update to 3.8.4
- Critical9.8Unauthenticated Arbitrary File Upload
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
<1.15.20Update to 1.15.20
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
User Submitted Posts – Enable Users to Submit Posts from the Front End
≤20230901Update to 20230902
- Medium4.3Missing Authorization to Post Duplication
Duplicate Post Page Menu & Custom Post Type
≤2.3.1Update to 2.4.0
- Medium4.3Missing Authorization via export_settings
rtMedia for WordPress, BuddyPress and bbPress
≤4.6.14Update to 4.6.15
- Medium5.3Hide Login Page Feature Protection Bypass
Defender Security – Malware Scanner, Login Security & Firewall
≤4.0.2Update to 4.1.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via style
Auto Amazon Links – Amazon Associates Affiliate Plugin
≤5.3.1Update to 5.3.2
- Medium5.3Insecure Direct Object Reference to Order Manipulation
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤2.9.25Update to 3.0
- High7.2Unauthenticated Cross-Site Scripting
Travel Map
≤1.0.1Update to 1.0.2
- Medium4.3Cross-Site Request Forgery to Settings Update
CP Blocks
≤1.0.20Update to 1.0.21
- Critical9.8Unauthenticated Local/Remote File Inclusion & Remote Code Execution
Media Library Assistant
≤3.09Update to 3.10
- Medium4.3Missing Authorization
Laposta Signup Embed
<1.1.1Update to 1.1.1
- Medium4.3Missing Authorization via AJAX actions
Automatic YouTube Gallery – Embed Auto-Updating YouTube Video Galleries, Feeds, Playlists & Channels
≤2.3.3Update to 2.3.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
UniConsent Cookie Consent CMP – Consent Manager
≤1.4.3Update to 1.4.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Notice Bar
≤3.1.0Update to 3.1.1
- Medium6.1Reflected Cross-Site Scripting
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
≤4.7.0Update to 4.7.1
- Medium5.3Missing Authorization
BitPay Checkout for WooCommerce
≤4.1.0Update to 5.0.0
- Medium4.3Incorrect Authorization
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg
≤3.2.5Update to 3.2.6
- Medium6.1Unauthenticated Cross-Site Scripting
Raise Mag
≤1.0.7No patch available
- Medium4.3Cross-Site Request Forgery
SendPress Newsletters
≤1.23.11.6No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Regpack
≤0.1No patch available
- Medium4.3Cross-Site Request Forgery
MailMunch – Grow your Email List
≤3.1.2Update to 3.1.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Email posts to subscribers
≤6.2No patch available
- Medium4.3Missing Authorization via AJAX actions
Slider Pro
≤4.8.6Update to 4.8.7