Database
WordPress Vulnerability Database (page 1099)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.9Hardcoded Encryption Key
ProfileGrid – User Profiles, Groups and Communities
≤5.5.0Update to 5.5.1
- Medium6.1Reflected Cross-Site Scripting
CartFlows Pro
≤1.11.11Update to 1.11.12
- Critical9.8Unauthenticated SQL Injection in donate-display.php
WP Donate
≤1.4Update to 1.5
- High8.5Authenticated (Contributor+) Server-Side Request Forgery in import_wpforms
Spectra Legacy – Gutenberg Blocks
≤2.6.6Update to 2.6.7
- High8.1Unauthenticated SQL Injection via username
User Activity Log
≤1.6.2Update to 1.6.3
- Medium4.3Missing Authorization
Spectra Legacy – Gutenberg Blocks
≤2.6.6Update to 2.6.7
- Medium6.4Authenticated (Contributor+) Server-Side Request Forgery in template_importer
Spectra Legacy – Gutenberg Blocks
≤2.6.6Update to 2.6.7
- Medium4.4Membership Plugin <= 4.0.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤4.0.16Update to 4.0.17
- High7.2Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change
Export and Import Users and Customers
≤2.4.1Update to 2.4.2
- Medium4.3Cross-Site Request Forgery to Widget Deletion
WP Testimonials
<1.4.3Update to 1.4.3
- Medium5.5Server-Side Request Forgery
HTTP Headers
≤1.18.11Update to 1.19.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Custom Field For WP Job Manager
≤1.1Update to 1.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Buy Me a Coffee – Button and Widget Plugin
≤3.6Update to 3.7
- High7.1Open Redirect
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
≤1.3.3Update to 1.3.4
- Medium6.1Reflected Cross-Site Scripting
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
≤2.7.16Update to 2.7.17
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Dovetail
≤1.2.13No patch available
- Medium5.3Unauthenticated Sensitive Information Exposure
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress
≤1.0.64Update to 1.0.65
- High7.2Reflected Cross-Site Scripting
Radio Forge Muses Player with Skins
≤2.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via Email Subject
MailArchiver
≤2.10.1Update to 2.11.0
- Medium6.1Reflected Cross-Site Scripting via style
Variation Images Gallery for WooCommerce
≤2.3.3Update to 2.3.4
- Medium5.4Cross-Site Request Forgery via add_language
Falang multilanguage for WordPress
≤1.3.39Update to 1.3.40
- Medium5.4Cross-Site Request Forgery via jfb_admin_page
WP Social AutoConnect
≤4.6.1Update to 4.6.2
- High7.3Missing Authorization
DirectoryPress – Business Directory And Classified Ad Listing
≤3.6.2Update to 3.6.3
- High7.3Missing Authorization
Checkout with Zelle on Woocommerce
≤3.1Update to 3.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Art Direction
≤0.2.4No patch available
- Medium6.1Reflected Cross-Site Scripting
Coming Soon Chop Chop
≤2.2.4No patch available
- High7.3Missing Authorization via REST API Endpoints
File Manager for Google Drive – Integrate Google Drive
≤1.1.99Update to 1.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via event_title and event_time
MF Gig Calendar
≤1.2Update to 1.2.1
- Medium4.3Cross-Site Request Forgery
Replace Word
≤2.1No patch available
- High7.2Authenticated (Administrator+) SQL Injection
User Activity Log
≤1.6.2Update to 1.6.3