Database
WordPress Vulnerability Database (page 1100)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.3Missing Authorization via REST API Endpoints
File Manager for Google Drive – Integrate Google Drive
≤1.1.99Update to 1.2.0
- High7.3Missing Authorization
Checkout with Zelle on Woocommerce
≤3.1Update to 3.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Art Direction
≤0.2.4No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via Email Subject
MailArchiver
≤2.10.1Update to 2.11.0
- High7.3Missing Authorization
DirectoryPress – Business Directory And Classified Ad Listing
≤3.6.2Update to 3.6.3
- Medium5.4Cross-Site Request Forgery via jfb_admin_page
WP Social AutoConnect
≤4.6.1Update to 4.6.2
- Medium6.3Missing Authorization
RH - Real Estate WordPress Theme
≤4.3.7Update to 4.3.8
- High7.3Missing Authorization
RH - Real Estate WordPress Theme
≤4.3.7Update to 4.3.8
- Medium5.4Missing Authorization
School Management System – WPSchoolPress
≤2.2.3Update to 2.2.4
- Medium5.9Plaintext Storage of Credentials
All-In-One Security (AIOS) – Security and Firewall
5.1.9 – 5.1.9Update to 5.2.0
- Medium6.1Cross-Site Request Forgery
Shortcode IMDB
≤6.0.8No patch available
- Medium4.3Cross-Site Request Forgery
AI Popup Builder & Popup Maker by OptiMonk
≤2.0.4Update to 2.0.5
- Medium4.3Cross-Site Request Forgery
WPAdmin AWS CDN
≤2.0.13Update to 3.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Social Share, Social Login and Social Comments Plugin – Super Socializer
≤7.13.53Update to 7.13.54
- High7.2Unauthenticated Stored Cross-Site Scripting via Email
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
≤2.5.7Update to 2.5.8
- Medium5.4Missing Authorization to Sensitive Data Exposure
KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin
≤1.5.88Update to 1.5.89
- High7.1Cross-Site Request Forgery
Buy Me a Coffee – Button and Widget Plugin
≤3.7Update to 3.8
- Medium6.3Missing Authorization
WooCommerce Warranty Requests
≤2.1.9Update to 2.2.0
- Medium4.4Authenticated(Admin+) Stored Cross-Site Scripting
Short URL
1.6.4 – 1.6.4Update to 1.6.5
- Medium5.4Insecure Direct Object Reference
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
<2.7.16Update to 2.7.16
- Medium6.1Reflected Cross-Site Scripting
View All Post's Pages
≤0.9.0Update to 0.9.1
- Medium6.1Reflected Cross-Site Scripting
Grid Kit Premium
<2.2.0Update to 2.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting via Email Subject
Mail Control – Email Customizer, SMTP Deliverability, logging, open and click Tracking
≤0.3.1Update to 0.3.2
- Medium6.5Bypass via IP Spoofing
IP2Location Country Blocker
≤2.29.1Update to 2.29.2
- Medium4.4Reflected Cross-Site Scripting
WooCommerce Ship to Multiple Addresses
≤3.8.5Update to 3.8.6
- Medium4.3Cross-Site Request Forgery
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤4.0.5Update to 4.0.6
- Medium6.3Missing Authorization
WooCommerce Ship to Multiple Addresses
≤3.8.5Update to 3.8.6
- Medium6.5Unauthenticated Insecure Direct Object Reference
WooCommerce GoCardless Gateway
≤2.5.6Update to 2.5.7
- Medium4.3Cross-Site Request Forgery
Social Media Icons Widget
≤1.6No patch available
- High7.3Missing Authorization
Buy Me a Coffee – Button and Widget Plugin
≤3.7Update to 3.8