Database
WordPress Vulnerability Database (page 1097)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Post Connector
≤1.0.9Update to 1.0.10
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Client Portal : SuiteDash Direct Login
≤1.7.3Update to 1.7.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Elastic Email Sender
≤1.2.6Update to 1.2.7
- Medium5.3Cross-Site Request Forgery
Disabler
≤3.0.3Update to 4.0.0
- Medium5.3Cross-Site Request Forgery
WP-FlyBox
≤6.46No patch available
- High7.5Unauthenticated Arbitrary File Download
Jupiter X Core
≤4.6.6Update to 4.6.9
- Medium4.3Open Redirect via setup_plugin
Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin
<1.3.7Update to 1.3.7
- Critical9.8Unauthenticated SQL Injection
Subscribe to Category
≤2.7.4No patch available
- Medium4.3Missing Authorization
WordPress Language
≤1.2.1No patch available
- High7.2Authenticated (Administrator+) SQL Injection
Onepage Builder – Easiest Landing Page Builder For WordPress
≤2.4.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Exifography
≤1.3.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Borderless – Addons and Templates for Elementor
≤1.4.8Update to 1.4.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Audio Player with Playlist Ultimate
≤1.2.2Update to 1.3
- Medium4.3Cross-Site Request Forgery via wpstream_update_local_event_settings
WpStream – Live Streaming, Video on Demand, Pay Per View
≤4.5.4Update to 4.5.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WRC Pricing Tables – Responsive CSS3 Pricing Tables
≤2.3.4Update to 2.3.5
- Medium5.4Authenticated (Author+) Insecure Direct Object Reference in ajax_generate_auth_token
Photo Engine (Media Organizer & Lightroom)
≤6.2.5Update to 6.2.6
- Medium5.3Unauthenticated MailChimp API Key Disclosure
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤5.8.1Update to 5.8.2
- Medium4.3Cross-Site Request Forgery via CopyProtect_options_page
WP-CopyProtect [Protect your blog posts]
≤3.1.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Art Decoration Shortcode
≤1.5.6No patch available
- Medium6.1Reflected Cross-Site Scripting
Post List With Featured Image
≤1.2No patch available
- Medium4.3Open Redirect
T1 Theme
≤19.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Brutal AI
<2.06Update to 2.06
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
wpShopGermany IT-RECHT KANZLEI
≤1.7Update to 1.8
- Medium4.3Cross-Site Request Forgery
WP Emoji One
≤0.6.0No patch available
- Medium4.3Cross-Site Request Forgery
GTmetrix for WordPress
≤0.4.7Update to 0.4.8
- Medium5.3Cross-Site Request Forgery via displaySmartyManagementPage
Smarty for WordPress
≤3.1.35No patch available
- Medium6.1DOM-Based iFrame Injection
Elementor Website Builder – more than just a page builder
≤3.5.4Update to 3.5.5
- Medium4.3Open Redirect
Ninja Popups
≤4.7.7Update to 4.7.8
- Medium5.3Authenticated (Administrator+) Sensitive Information Exposure in class-w3w-autosuggest-public.php
what3words Address Field
≤4.0.0Update to 4.0.1
- Medium6.1Reflected Cross-Site Scripting via fs_request_get
Live Scores for SportsPress
≤1.9.2No patch available