Database
WordPress Vulnerability Database (page 1086)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
DoLogin Security
≤3.6Update to 3.7
- Critical9.8Unauthenticated Remote Code Execution
Import XML and RSS Feeds
≤2.1.4Update to 2.1.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Easy Coming Soon
≤2.3No patch available
- High7.2Authenticated (Administrator+) Arbitrary File Upload in mo_media_restrict_page
Prevent Files / Folders Access
≤2.5.1Update to 2.5.2
- Medium6.1Reflected Cross-Site Scripting via 'page'
Ultra Addons for Contact Form 7
≤3.1.0Update to 3.1.2
- Medium6.1Reflected Cross-Site Scripting
Order Tracking – WordPress Status Tracking Plugin
≤3.3.6Update to 3.3.7
- Medium4.3Cross-Site Request Forgery via 'wpsmy_admin_options'
WP Super Minify • Minify, Compress and Cache HTML, CSS & JavaScript
≤1.5.1Update to 1.6
- Medium6.1Reflected Cross-Site Scripting via 'page'
URL Shortener by MyThemeShop
≤1.0.17No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤5.0.9Update to 5.0.10
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
GuruWalk Affiliates
≤1.0.0No patch available
- Medium4.3Cross-Site Request Forgery via 'syntatical_settings_content'
Social Share Boost
≤4.5No patch available
- Medium5.4Cross-Site Request Forgery
LuckyWP Scripts Control
≤1.2.1Update to 1.2.2
- High7.2Authenticated (Administrator+) Arbitrary File Upload in olive_one_click_demo_import_save_file
Olive One Click Demo Import
≤1.1.2No patch available
- High8.8Authenticated (Author+) Arbitrary File Upload in handle_folders_file_upload
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
≤2.9.2Update to 2.9.3
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤4.2.1Update to 4.2.2
- Medium5.4Cross-Site Request Forgery via 'admin_action_request'
Maintenance Switch
≤1.5.2No patch available
- Medium4.3Missing Authorization via wpusme_save_settings
WP Users Media
≤4.2.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'sitekit_iframe ' shortcode
Sitekit
≤1.3Update to 1.4
- Medium4.7Authenticated (Administrator+) Stored Cross-Site Scripting
Order Tracking – WordPress Status Tracking Plugin
≤3.3.6Update to 3.3.7
- Medium6.1Reflected Cross-Site Scripting
Locatoraid Store Locator
≤3.9.23Update to 3.9.24
- Medium4.4Authenticated (Administrator+) Cross-Site Scripting via Multiple Parameters
Translate WordPress with GTranslate
<3.0.4Update to 3.0.4
- Medium4.3Cross-Site Request Forgery and Missing Authorization via 'hide_authenticate_notice'
Kadence Central – Site Management, Backups, Security, and Reporting
<2.1.14Update to 2.1.14
- High8.8Authenticated (Author+) Arbitrary File Upload
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
<2.9.3Update to 2.9.3
- Medium5.3Missing Authorization via 'saveSettings'
Secure Admin IP
≤2.0No patch available
- Medium5.4Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Update
FV Flowplayer Video Player
≤7.5.37.7212Update to 7.5.39.7212
- Medium4.3Missing Authorization via notice dismissal functionality
Product Category Slider & Grid for WooCommerce – Reno Product Category
≤1.4.15Update to 1.4.16
- High8.3Missing Authorization via role management functions
Premmerce User Roles
≤1.0.12Update to 1.0.13
- Medium4.3Cross-Site Request Forgery via AJAX actions
WP VK-付费内容插件（付费阅读/资料/工具软件资源管理）
<1.3.4Update to 1.3.4
- Medium5.4Missing Authorization
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤2.9.1Update to 2.9.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Leyka
<3.30.3Update to 3.30.3