Database
WordPress Vulnerability Database (page 1091)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization
SendPress Newsletters
≤1.23.11.6No patch available
- Medium4.3Cross-Site Request Forgery via Save
PDF Builder for WooCommerce. Create invoices,packing slips and more
≤1.2.90Update to 1.2.91
- Medium4.3Cross-Site Request Forgery via 'send_test'
Email Template Designer – WP HTML Mail
≤3.4.0Update to 3.4.1
- Medium6.1Reflected Cross-Site Scripting via 'asview-nouce'
Responsive WordPress Slider – Avartan Slider Lite
≤1.5.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
flowpaper
≤1.9.9Update to 2.0.0
- High7.5Missing Authorization to Sensitive Information Exposure via REST API
Post Grid
≤2.2.50Update to 2.2.51
- Medium6.1Reflected Cross-Site Scripting
Kangu para WooCommerce
≤2.2.9Update to 2.2.10
- High7.2Authenticated (Administrator+) SQL Injection
Donations Made Easy – Smart Donations
≤4.0.12No patch available
- Medium6.1Reflected Cross-Site Scripting
PixTypes
≤1.4.15Update to 1.4.16
- Medium4.3Cross-Site Request Forgery
Printful Integration for WooCommerce
≤2.2.2Update to 2.2.3
- Medium4.3Cross-Site Request Forgery
Product Attachment for WooCommerce
≤2.1.8Update to 2.2.0
- Medium5.3Missing Authorization
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤5.9.2Update to 5.9.3
- Medium6.5Missing Authorization via multiple AJAX actions
Highcompress Image Compressor
≤5.0.0Update to 6.0.0
- Medium4.3Missing Authorization via 'dismiss_how_to_use_notice' and 'dismiss_notice'
Justified Gallery
≤1.7.3Update to 1.8.0
- Medium6.1Reflected Cross-Site Scripting
Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback
≤3.9.3Update to 3.9.4
- Medium6.1Reflected Cross-Site Scripting via User Register Element
Avada (Fusion) Builder
≤3.11.1Update to 3.11.2
- Medium6.1Reflected Cross-Site Scripting
WP Categories Widget
≤2.2Update to 2.3
- High8.8Authenticated(Author+) Arbitrary File Upload via Zip Extraction
Avada | Website Builder For WordPress & WooCommerce
≤7.11.1Update to 7.11.2
- High7.5Authenticated(Contributor+) Arbitrary File Upload via 'ajax_import_options'
Avada | Website Builder For WordPress & WooCommerce
≤7.11.1Update to 7.11.2
- Medium4.3Missing Authorization
Avada | Website Builder For WordPress & WooCommerce
≤7.11.1Update to 7.11.2
- Medium6.1Reflected Cross-Site Scripting
Post Timeline
≤2.2.5Update to 2.2.6
- High8.8Authenticated (Contributor+) Local File Inclusion via woocommerce_one_page_checkout
woocommerce-one-page-checkout
≤2.3.0Update to 2.4.0
- Medium6.5Cross-Site Request Forgery
Avada (Fusion) Builder
≤3.11.1Update to 3.11.2
- High7.2Authenticated (Administrator+) SQL Injection
demon image annotation
≤5.3Update to 5.4
- Medium4.3Cross-Site Request forgery via 'save_mail_status'
YITH WooCommerce Waitlist
≤2.6.0Update to 2.6.1
- High8.5Authenticated(Contributor+) Server Side Request Forgery via 'ajax_import_options'
Avada | Website Builder For WordPress & WooCommerce
≤7.11.1Update to 7.11.2
- Medium6.1Reflected Cross-Site Scripting in ajax_stockticker_symbol_search_test
Stock Ticker
≤3.23.2Update to 3.23.3
- Medium4.3Missing Authorization
Avada (Fusion) Builder
≤3.11.1Update to 3.11.2
- Medium6.1Reflected Cross-Site Scripting via 'asl-nounce'
Agile Store Locator
≤1.4.12Update to 1.4.13
- High8.1Authenticated(Subscriber+) Arbitrary File Deletion via 'disconnect'
Easy!Appointments
≤1.4.0Update to 1.4.1