Database
WordPress Vulnerability Database (page 1090)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Low2.7Authenticated (Administrator+) Directory Traversal via 'file_url'
Trakoo – Orders Tracking for WooCommerce
≤1.2.5Update to 1.2.6
- Medium6.1Reflected Cross-Site Scripting via 'uid'
WP LINE Notify
≤1.4.4Update to 1.4.5
- High7.2Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content'
User Submitted Posts – Enable Users to Submit Posts from the Front End
≤20230809Update to 20230811
- Medium4.3Cross-Site Request Forgery via 'admin/class-make-paths-relative-admin.php'
Make Paths Relative
≤1.3.0Update to 2.0.0
- Medium5.3IP Address Spoofing
User Activity Log
≤1.6.6Update to 1.6.7
- Medium6.3Authenticated (Author+) Improper Privilege Management
Media from FTP
≤11.16Update to 11.17
- Medium6.1Reflected Cross-Site Scripting via multiple parameters
WebLibrarian
≤3.5.8.1Update to 3.5.8.2
- High7.5Authenticated (Subscriber+) Sensitive Information Exposure
InfiniteWP Client
≤1.11.1Update to 1.12.1
- Medium6.6Authenticated (Administrator+) Arbitrary File and Folder Access
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution
≤5.1Update to 5.1.1
- Critical9.8Weak Password Recovery Mechanism
Password Reset with Code for WordPress REST API
≤0.0.15Update to 0.0.16
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
123.chat - Video Chat
≤1.3.0Update to 1.3.1
- High8.33.3.0 - Missing Authorization
Jupiter X Core
3.0.0 – 3.3.0Update to 3.3.5
- Medium4.33.3.0 - Missing Authorization
Jupiter X Core
3.0.0 – 3.3.0Update to 3.3.5
- High8.8Authenticated (Subscriber+) SQL Injection via Export
PDF Builder for WooCommerce. Create invoices,packing slips and more
≤1.2.89Update to 1.2.90
- Medium6.5Missing Authorization via 'wp_aas_get_attachment_edit_form' and 'wp_aas_save_attachment_data'
Accordion and Accordion Slider
≤1.2.4Update to 1.2.5
- Medium6.1Reflected Cross-Site Scripting
ImageRecycle pdf & image compression
<3.1.11Update to 3.1.11
- Medium4.3Cross-Site Request Forgery via 'ecl_options'
Easy Cookie Law
≤3.1No patch available
- Medium6.1Reflected Cross-Site Scripting
ImageRecycle pdf & image compression
≤3.1.11Update to 3.1.12
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WP 404 Auto Redirect to Similar Post
≤1.0.3Update to 1.0.4
- Medium6.3Cross-Site Request Forgery
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.10.19Update to 1.10.20
- Medium6.1Reflected Cross-Site Scripting via 'asview-nouce'
Responsive WordPress Slider – Avartan Slider Lite
≤1.5.3No patch available
- Medium4.3Cross-Site Request Forgery via 'sb_cl_update_settings'
SB Child List
≤4.5No patch available
- Medium4.3Cross-Site Request Forgery
Futurio Extra
≤1.9.0Update to 1.9.1
- Medium6.1Reflected Cross-Site Scripting in ajax_stockticker_load
Stock Ticker
≤3.23.3Update to 3.23.4
- Medium4.3Cross-Site Request Forgery to Settings Update
WP Pipes
<1.4.1Update to 1.4.1
- Medium4.3Cross-Site Request Forgery via Save
PDF Builder for WooCommerce. Create invoices,packing slips and more
≤1.2.90Update to 1.2.91
- Medium4.3Cross-Site Request Forgery via 'futurio_extra_reset_mod'
Futurio Extra
≤1.8.2Update to 1.8.3
- Medium5.3Missing Authorization
SendPress Newsletters
≤1.23.11.6No patch available
- Medium5.4Missing Authorization via multiple AJAX actions
Mailmunch Forms for Mailchimp
≤3.1.4Update to 3.1.5
- Medium4.3WP Rating System <= 3.4.1 - Insecure Direct Object Reference
Rate My Post – Star Rating Plugin by FeedbackWP
<3.4.2Update to 3.4.2