Database
WordPress Vulnerability Database (page 1087)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated Arbitrary File Upload
Jupiter X Core
≤3.3.5Update to 3.3.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Collapse-O-Matic
≤1.8.5.5No patch available
- Medium4.3Missing Authorization in rx_coupon_from_submit
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema
≤1.6.17Update to 1.6.18
- Medium4.3Cross-Site Request Forgery
Royal Addons for Elementor – Addons and Templates Kit for Elementor
≤1.3.75Update to 1.3.76
- Medium5.3CAPTCHA Bypass in brute_math_authenticate
Hide My WP Ghost – Security & Firewall
≤5.0.25Update to 5.0.26
- High7.3Missing Authorization
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
≤2.0.5.3Update to 2.0.5.4.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤5.0.8Update to 5.0.9
- Medium4.3Cross-Site Request Forgery via submitDefaultEditor
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
≤1.24.1Update to 1.24.2
- Critical9.8Unauthenticated Privilege Escalation
Jupiter X Core
≤3.3.8Update to 3.4.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages
≤1.5.1.2Update to 1.5.1.3
- Medium4.3Missing Authorization via delete_pageview
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤5.0.5.1Update to 5.0.6
- Medium6.4Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
FTP Access
≤1.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Vertical marquee plugin
≤7.1No patch available
- Medium5.3Missing Authorization to Unauthenticated Admin Notice Dismissal
Push Notification for Post and BuddyPress
<1.64Update to 1.64
- Medium6.1Appointment booking addon for Gravity Forms <= 1.9.7 - Reflected Cross-Site Scripting
gAppointments - Appointment booking addon for Gravity Forms
≤1.9.7Update to 1.10.0
- Medium4.3Missing Authorization via AJAX actions
Lasso Lite – Affiliate Link Manager, URL Shortener & Link Tracking
≤117Update to 118
- Medium5.3Missing Authorization to Review Notice Dismissal
Void Elementor Post Grid Addon for Elementor Page builder
<2.2Update to 2.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Save as Image Plugin by PDFCrowd
≤2.16.0Update to 2.16.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Referrer Header
URL Shortify – Simple and Easy URL Shortener
≤1.7.5Update to 1.7.6
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Plugin Setting Reset
Posts Like Dislike
≤1.1.1Update to 1.1.2
- Medium5.3CAPTCHA Bypass
Cartpauj Register Captcha
≤1.0.02Update to 2.0.0
- Medium4.3Cross-Site Request Forgery to Effect Deletion
Social Proof Popups & Real-Time Notifications – Herd Effects
≤5.2.3Update to 5.2.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Social Proof Popups & Real-Time Notifications – Herd Effects
<5.2.3Update to 5.2.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
Save as PDF Plugin by PDFCrowd
≤2.16.0Update to 2.16.1
- Medium4.3Missing Authorization via ajax_request_handle
Sticky Social Media Icons
≤2.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Cookies by JM
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Min Max Control – Min Max Quantity & Step Control for WooCommerce
≤4.5Update to 4.6
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Adminify – White Label, Admin Menu Editor, Login Customizer
≤3.1.5Update to 3.1.6
- Medium6.1Reflected Cross-Site Scripting via 'post_id'
Lasso Lite – Affiliate Link Manager, URL Shortener & Link Tracking
≤117Update to 118
- Medium4.3Cross-Site Request Forgery
DX-auto-save-images
≤1.4.0No patch available