Database
WordPress Vulnerability Database (page 1095)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Cross-Site Request Forgery via 'TellAFriend_admin'
wp tell a friend popup form
≤7.1No patch available
- Medium4.3Cross-Site Request Forgery
Simple Wp Sitemap
≤1.2.1No patch available
- Medium4.3Cross-Site Request Forgery via 'odb_start_manually'
Optimize Database after Deleting Revisions
≤5.1.1Update to 5.2
- Medium5.3Missing Authorization
WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce
≤4.4.1Update to 4.4.2
- Medium6.1Reflected Cross-Site Scripting
User Email Verification for WooCommerce
≤3.5.0No patch available
- Medium4.3Cross-Site Request Forgery
Banner Management For WooCommerce
≤2.4.1Update to 2.4.3
- Medium5.4Authenticated (Subscriber+) Content Injection
Discussion Board – WordPress Forum Plugin
≤2.4.8Update to 2.4.9
- Medium6.1Prototype Pollution to Reflected Cross-Site Scripting
Winters - WordPress Blog Theme
≤1.4.3No patch available
- Critical9.8Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiver
InstaWP Connect – 1-click WP Staging & Migration
≤0.0.9.18Update to 0.0.9.19
- Medium5.5Server-Side Request Forgery via church_admin_import_csv
Church Admin
≤3.7.56Update to 3.8.0
- Medium4.3Authenticated (Subscriber+) Arbitrary Usermeta Update
ACF Photo Gallery Field
≤1.9Update to 2.0
- Medium4.3Cross-Site Request Forgery via 'odb_csv_download'
Optimize Database after Deleting Revisions
≤5.0.110Update to 5.1
- Medium6.1Prototype Pollution to Reflected Cross-Site Scripting
NSC WordPress Theme
≤1.0No patch available
- Medium5.4Cross-Site Request Forgery
HTTP Auth
≤0.3.2Update to 1.0.0
- Medium5.3Missing Authorization to Contributor+ Form Submission Export
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.6.25Update to 3.6.26
- Medium4.3Missing Authorization to Form Submission Export
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.6.25Update to 3.6.26
- Low3.7Sensitive Information Exposure
Video Conferencing with Zoom
≤4.2.1Update to 4.2.2
- Medium4.3Missing Authorization
The Events Calendar
≤6.1.2.2Update to 6.1.3
- High7.2Unauthenticated Stored Cross-Site Scripting
NOPARCELS / MultiParcels Shipping For WooCommerce
≤1.15.5Update to 1.15.6
- Medium6.1Reflected Cross-Site Scripting via 'data'
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.6.25Update to 3.6.26
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
tagDiv Composer
<4.4Update to 4.4
- Medium5.4Missing Authorization
WP Quick Post Duplicator
≤2.0Update to 2.1
- Medium4.3Cross-Site Request Forgery to Settings Update
Mobile Address Bar Changer
≤3.0No patch available
- Medium5.3Missing Authorization to Menu Clone
WP Clone Menu
≤1.0.1No patch available
- High7.2Authenticated (Administrator+) SQL Injection
WordPress Database Administrator
≤1.0.3No patch available
- Medium4.3Missing Authorization
Donations Made Easy – Smart Donations
≤4.0.12No patch available
- Medium4.3Missing Authorization to Post Deletion
Remove Duplicate Posts
≤1.3.5Update to 1.3.6
- High7.2Authenticated (Administrator+) SQL Injection via 'context'
WPML String Translation
≤3.2.5Update to 3.2.6
- Medium6.1Reflected Cross-Site Scripting
Ultra Addons for Contact Form 7
<3.1.29Update to 3.1.29
- High8.8Authenticated (Subscriber+) SQL Injection via 'id'
Quasar form free – Contact Form Builder for WordPress
≤6.1No patch available