Database
WordPress Vulnerability Database (page 1093)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Leyka
≤3.30.2Update to 3.30.3
- Medium6.1Reflected Cross-Site Scripting via 'mode'
Booking Package
≤1.6.01Update to 1.6.02
- Critical9.8Unauthenticated PHP Object Injection
Themesflat Addons For Elementor
≤2.0.0Update to 2.0.1
- Medium4.3Cross-Site Request Forgery
User Activity Tracking and Log
≤4.0.8Update to 4.0.9
- Medium4.3Cross-Site Request Forgery
Photo Gallery by Ays – Responsive Image Gallery
≤5.2.6Update to 5.2.7
- Medium5.4Authenticated (Subscriber+) Insecure Direct Object Reference to Message Deletion
All Users Messenger
≤1.24No patch available
- Medium4.3Cross-Site Request Forgery
Sign-up Sheets
≤2.2.8Update to 2.2.9
- Medium4.3Cross-Site Request Forgery to License Modification
GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice for CCPA, EU Cookie Law
≤4.12.4Update to 4.12.5
- Medium4.3Cross-Site Request Forgery
The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid
≤7.2.7Update to 7.2.8
- Medium4.3Cross-Site Request Forgery
POEditor
≤0.9.7Update to 0.9.8
- Medium5.3IP Spoofing
User Access Manager
≤2.2.16Update to 2.2.18
- Medium4.3Cross-Site Request Forgery to Settings Update and Cross-Site Scripting
Subscribers Text Counter
≤1.7Update to 1.7.1
- High8.8Authenticated (Contributor+) Remote Code Execution
JetElements
≤2.6.10Update to 2.6.11
- Medium6.3Cross-Site Request Forgery via 'cdp_action_handling' AJAX action
Duplicate Post
≤1.4.1Update to 1.4.2
- Medium4.3Sensitive Information Exposure
Simple Blog Card
<1.32Update to 1.32
- Medium6.6Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalation
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤7.9.8Update to 7.9.9
- High7.5Sensitive Information Exposure via Directory Listing
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤7.9.8Update to 7.9.9
- High8.0Authenticated (Author+) PHP File Creation to Remote Code Execution
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤7.9.8Update to 7.9.9
- Medium4.46.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Advanced Custom Fields (ACF®)
6.1 – 6.1.7Update to 6.1.8
- High8.0Authenticated (Author+) Remote Code Execution
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤7.9.8Update to 7.9.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Guest posting / Frontend Posting / Front Editor – WP Front User Submit
≤4.4.5Update to 4.4.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Simple Share Follow Button
≤1.03Update to 1.04
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
FormCraft – Form Builder
≤1.2.6Update to 1.2.7
- Medium6.1Reflected Cross-Site Scripting via 'orddd_lite_custom_startdate' and 'orddd_lite_custom_enddate'
Order Delivery Date for WooCommerce
≤3.20.0Update to 3.20.1
- Medium6.1Reflected Cross-Site Scripting via wcemails_edit
Woo Custom Emails
≤2.2No patch available
- Medium6.1Gutenberg Post Grid Blocks <= 3.0.5 - Reflected Cross-Site Scripting via 'postx_type'
Post Grid Gutenberg Blocks – PostX
≤3.0.5Update to 3.0.6
- Medium6.5Cross-Site Request Forgery via 'umbu_download'
Upload Media By URL
≤1.0.7Update to 1.0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Simple Ticker
≤3.05Update to 3.06
- High7.2Authenticated (Shop Manager+) Missing Authorization to Arbitrary Options Update
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
7.0.0 – 7.0.0Update to 7.1.0
- Critical9.8Arbitrary File Upload via 'jobwp_upload_resume'
JobWP – Job Board Plugin for WordPress | Job Listings, Career Page & Applications
≤2.0Update to 2.1