Database
WordPress Vulnerability Database (page 1096)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting via 'site_account'
CodeBard’s Patron Button and Widgets for Patreon
≤2.1.8Update to 2.1.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Custom Field For WP Job Manager
≤1.1Update to 1.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Ultra Addons for Contact Form 7
<3.1.29Update to 3.1.29
- High7.5Unauthenticated SQL Injection
User Activity Log
≤1.6.4Update to 1.6.5
- Medium4.3Cross-Site Request Forgery to Plugin Settings Update
Taboola
≤2.0.1Update to 20.2
- Medium6.1Reflected Cross-Site Scripting
Custom Field Template
≤2.5.9Update to 2.6.0
- Medium4.3Missing Authorization to Settings Update
Simple Googlebot Visit
≤1.2.4Update to 1.2.5
- Medium4.3Missing Authorization via wqm_make_url_permanent
QR code MeCard/vCard generator
≤1.6.0Update to 1.6.1
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder
≤2.1.0Update to 2.2.0
- Critical9.8Unauthenticated Remote/Local File Inclusion
LWS Affiliation
≤2.2.6Update to 2.3
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
WP-EMail
<2.69.1Update to 2.69.1
- Medium4.3Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary User Sensitive Information Exposure
Simple Author Box
≤2.51Update to 2.52
- High7.2Authenticated (Administrator+) SQL Injection
WordPress Database Administrator
≤1.0.3No patch available
- Medium4.3Missing Authorization to Post Deletion
Remove Duplicate Posts
≤1.3.5Update to 1.3.6
- Medium5.3Missing Authorization to Menu Clone
WP Clone Menu
≤1.0.1No patch available
- High8.8Authenticated (Subscriber+) SQL Injection via 'id'
Quasar form free – Contact Form Builder for WordPress
≤6.1No patch available
- Medium4.3Missing Authorization
Donations Made Easy – Smart Donations
≤4.0.12No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update
Local Development
≤2.8.2Update to 2.8.3
- Medium6.1Reflected Cross-Site Scripting
Ultra Addons for Contact Form 7
<3.1.29Update to 3.1.29
- Medium6.5Cross-Site Request Forgery
Schema Pro
≤2.7.7Update to 2.7.8
- Medium6.5Missing Authorization
EasyTest – Simplify A/B Testing
≤1.7.5Update to 1.7.6
- Medium4.3Cross-Site Request Forgery
Oxygen
<4.4Update to 4.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Post Connector
≤1.0.9Update to 1.0.10
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Client Portal : SuiteDash Direct Login
≤1.7.3Update to 1.7.5
- Medium5.3Content Spoofing
Pinpoint Booking System – Legacy version
≤2.9.9.3.4Update to 2.9.9.3.5
- Medium4.3Cross-Site Request Forgery
TS Webfonts for さくらのレンタルサーバ
≤3.1.2Update to 3.1.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Media Library Categories
≤2.0.0Update to 2.0.1
- Medium4.3Open Redirect via setup_plugin
Integration for WooCommerce and QuickBooks
≤1.2.3Update to 1.2.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Exifography
≤1.3.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Audio Player with Playlist Ultimate
≤1.2.2Update to 1.3