Database
WordPress Vulnerability Database (page 1089)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Typing Effect
≤1.3.6Update to 1.3.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
RSVPMaker
≤10.6.5Update to 10.6.7
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting
Simple Staff List
≤2.2.3Update to 2.2.4
- Medium4.3Authenticated (Contributor+) Content Injection
Tabs & Accordion
≤1.3.10No patch available
- Critical9.8Unauthenticated SQL Injection via 'post'
Contact form 7 Custom validation
≤1.1.3No patch available
- Medium5.3Missing Authorization to Arbitrary Order Status Modification
Payment Gateway of Stripe for WooCommerce
3.7.9 – 3.7.9Update to 3.8.0
- Medium4.3Cross-Site Request Forgery
Video Gallery – YouTube Gallery, Playlist & Video Grid
≤3.3.5Update to 3.3.6
- Medium4.3Cross-Site Request Forgery
Dynamic Pricing and Discount Rules for WooCommerce
≤2.4.0Update to 2.4.1
- Medium5.4Cross-Site Request Forgery via 'wp_ajax_wb_smart_seo_tool'
Smart SEO Tool – SEO优化插件
<4.0.2Update to 4.0.2
- Medium6.1Reflected Cross-Site Scripting via page-url
Plausible Analytics
≤1.3.3Update to 1.3.4
- Medium4.3Cross-Site Request Forgery to Custom Field Creation
PDF Builder for WooCommerce. Create invoices,packing slips and more
≤1.2.90Update to 1.2.91
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
CT Commerce
≤2.0.1No patch available
- Medium6.6Tables & Table Charts <= 2.1.65 - Authenticated(Administrator+) PHP Object Injection
wpDataTables (Premium)
<2.1.66Update to 2.1.66
- Medium5.3Missing Authorization to Notice Dismissal
Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions
≤2.7Update to 2.8
- Medium4.3Missing Authorization to Notice Dismissal
Accordion Slider
≤1.9.6Update to 1.9.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Carrrot
≤1.1.0No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Plugin Setting Reset
Comments Like Dislike
≤1.2.0Update to 1.2.1
- Medium5.3IP Spoofing
WP-PostRatings
≤1.91Update to 1.91.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
Schedule Posts Calendar
≤5.2Update to 5.3
- Medium4.3Cross-Site Request Forgery
Schedule Posts Calendar
≤5.2Update to 5.3
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
fitness calculators
≤2.0.8Update to 2.0.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Custom Admin Login Page | WPZest
≤1.2.0No patch available
- Medium5.4Cross-Site Request Forgery
Enhanced Ecommerce Google Analytics for WooCommerce
≤3.7.1Update to 3.7.2
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
Robo Gallery – Photo & Image Slider
≤3.2.15Update to 3.2.16
- Medium5.3Missing Authorization via 'putler_connector_sync_complete'
Putler – Simple WooCommerce Analytics for your Store
≤2.12.0Update to 2.13.0
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Log View
WP Remote Users Sync
≤1.2.11Update to 1.2.12
- Medium4.3Missing Authorization via 'send_resync_request'
Putler – Simple WooCommerce Analytics for your Store
≤2.12.0Update to 2.13.0
- High8.5Authenticated (Subscriber+) Server Side Request Forgery
WP Remote Users Sync
≤1.2.12Update to 1.2.13
- High7.2Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content'
User Submitted Posts – Enable Users to Submit Posts from the Front End
≤20230809Update to 20230811
- Medium6.1Reflected Cross-Site Scripting via Search Field
Arendelle
<1.1.3Update to 1.1.3