Database
WordPress Vulnerability Database (page 1085)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
Remove/hide Author, Date, Category Like Entry-Meta
≤2.1No patch available
- Medium4.3Cross-Site Request Forgery
Multi-column Tag Map
≤17.0.26Update to 17.0.27
- Medium5.4Missing Authorization
Surfer – WordPress Plugin
≤1.3.2.357Update to 1.3.3.379
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Smarty for WordPress
≤3.1.35No patch available
- High7.2Donation Plugin <= 2.33.0 - Authenticated(Give Manager+) Privilege Escalation
GiveWP – Donation Plugin and Fundraising Platform
<2.33.1Update to 2.33.1
- Medium4.3Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤3.3.1Update to 3.3.2
- Medium5.3Missing Authorization to Access Token Update
All-in-One WP Migration Dropbox Extension
≤3.75Update to 3.76
- Medium5.4Cross-Site Request Forgery via 'clicked'
Simple 301 Redirects by BetterLinks – Easy Redirect Manager
<2.0.8Update to 2.0.8
- Critical9.8Unauthenticated SQL Injection
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.0.5Update to 2.0.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Email Encoder – Protect Email Addresses and Phone Numbers
≤2.1.8Update to 2.1.9
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
<3.7.2Update to 3.7.2
- Medium6.1Reflected Cross-Site Scripting
Happy Addons for Elementor Pro
≤2.8.0Update to 2.8.1
- Medium6.1Reflected Cross-Site Scripting
Ditty – Responsive News Tickers, Sliders, and Lists
<3.1.25Update to 3.1.25
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation
AffiliateWP
2.14.0 – 2.14.0Update to 2.14.1
- Medium5.4Authenticated (Contributor+) Server-Side Request Forgery via wp_ajax_powerpress_media_info
PowerPress Podcasting plugin by Blubrry
≤11.0.6Update to 11.0.7
- Medium6.1Reflected Cross-Site Scripting
Social Media Share Buttons & Social Sharing Icons
≤2.8.3Update to 2.8.4
- Medium6.1Reflected Cross-Site Scripting
Arya Multipurpose Pro
≤1.0.8No patch available
- Medium5.4Missing Authorization
Site Reviews
<6.10.3Update to 6.10.3
- Medium5.3Missing Authorization via vtprd_ajax_clone_rule
Pricing Deals for WooCommerce
≤2.0.3.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
≤2.5.0Update to 2.5.1
- Medium5.3Cross-Site Request Forgery via admin menu
Localize Remote Images
≤1.0.9No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.24.6Update to 1.25.0
- Medium6.1Reflected Cross-Site Scripting
Bridge Core
≤3.0.9Update to 3.1.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Pixel Integration for Snapchat
≤1.5.7Update to 1.5.8
- Medium6.1Reflected Cross-Site Scripting
Everest News Pro
≤1.1.7No patch available
- Medium4.3Missing Authorization via wpusme_save_settings
WP Users Media
≤4.2.3No patch available
- High7.2Authenticated (Administrator+) Arbitrary File Upload in mo_media_restrict_page
Prevent Files / Folders Access
≤2.5.1Update to 2.5.2
- Medium4.3Cross-Site Request Forgery via 'wpsmy_admin_options'
WP Super Minify • Minify, Compress and Cache HTML, CSS & JavaScript
≤1.5.1Update to 1.6
- High8.8Authenticated (Author+) Arbitrary File Upload in handle_folders_file_upload
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
≤2.9.2Update to 2.9.3
- Critical9.8Unauthenticated Remote Code Execution
Import XML and RSS Feeds
≤2.1.4Update to 2.1.5