Database
WordPress Vulnerability Database (page 1083)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Insecure Direct Object Reference to Order Manipulation
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤2.9.25Update to 3.0
- Medium4.3Missing Authorization
Carousel Slider
≤2.2.2Update to 2.2.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
wordpress publish post email notification
≤1.0.2.2Update to 1.0.2.3
- Medium5.3Missing Authorization
WP Directory Kit
≤1.2.6Update to 1.2.7
- Medium4.3Cross-Site Request Forgery
Outbound Link Manager
≤1.2No patch available
- Medium4.3Missing Authorization to Opt-In
Analytify – Google Analytics 4 Tracking and Reporting in WordPress
<5.1.1Update to 5.1.1
- Medium4.3Missing Authorization
Click To Tweet
≤2.0.14No patch available
- Medium4.3Cross-Site Request Forgery
Order Delivery Date for WP e-Commerce
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Restrict – membership, site, content and user access restrictions for WordPress
≤2.2.4Update to 2.2.5
- Medium5.3Missing Authorization to Sensitive Information Exposure
Email posts to subscribers
≤6.2No patch available
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg
≤3.2.4Update to 3.2.5
- Medium6.1Reflected Cross-Site Scripting
Woodmart
≤7.2.4Update to 7.2.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Rescue Shortcodes
≤2.5Update to 2.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
SendPress Newsletters
≤1.23.11.6No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Swifty Bar, sticky bar by WPGens
≤1.2.10Update to 1.2.11
- Critical9.8Unauthenticated PHP Object Injection
RSVPMaker
≤10.6.6Update to 10.6.7
- Medium6.1Reflected Cross-Site Scripting via 'pensopay_action'
pensopay Payments
≤6.3.1Update to 6.3.2
- Medium6.1Reflected Cross-Site Scripting
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
≤8.6.2Update to 8.6.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Goods Catalog
≤2.4.1No patch available
- Medium5.3Missing Authorization
TelSender – Сontact form 7, Events, Wpforms, ninja forms and woocommerce to telegram bot
≤1.14.11Update to 1.14.12
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Stock Quotes List
≤2.9.11Update to 2.9.12
- Medium4.3Cross-Site Request Forgery
Leadster
≤1.1.2Update to 1.1.3
- Medium5.4Missing Authorization
Tilda-publishing
≤0.3.23Update to 0.3.24
- Medium4.3Cross-Site Request Forgery
Live News – Responsive News Ticker
≤1.06Update to 1.07
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
User Private Files – Secure File Sharing and Client Portal Plugin
≤2.0.3Update to 2.0.4
- Critical9.8Unauthenticated Privilege Escalation
All in One B2B for WooCommerce
≤1.0.3No patch available
- Medium4.3Cross-Site Request Forgery
MyCryptoCheckout – Bitcoin, Ethereum, and 100+ altcoins for WooCommerce
≤2.125Update to 2.126
- Medium4.3Cross-Site Request Forgery
Hide admin notices – Admin Notification Center
≤2.3.2Update to 2.3.3
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Export Import Menus
≤1.8.0Update to 1.9.0
- Medium4.3Cross-Site Request Forgery
Use Memcached
≤1.0.5No patch available