Database
WordPress Vulnerability Database (page 1102)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Secondary Title
≤2.0.9.1Update to 2.1.0
- Medium6.5Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion
BadgeOS
≤3.7.1.6No patch available
- Medium4.3Cross-Site Request Forgery via rate_the_plugin_action
Media Library Helper — Bulk edit image ALT, caption & description
≤1.2.0Update to 1.3.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Simple Light Weight Social Share (Tweet, Like, Share and Linkedin)
≤2.0No patch available
- Medium4.3Cross-Site Request Forgery via toggle_option
Visibility Logic for Elementor
≤2.3.4Update to 2.3.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Email Subject
SMTP Mail
≤1.3.46No patch available
- High7.2Authenticated (Administrator+) SQL Injection
Coming Soon Page – Responsive Coming Soon & Maintenance Mode
≤1.5.9Update to 1.6.0
- Medium5.3Missing Authorization
Product Category Tree
≤2.5No patch available
- Medium6.3Cross-Site Request Forgery
WPLMS Learning Management System for WordPress, WordPress LMS
<4.900Update to 4.900
- Medium4.3Cross-Site Request Forgery via process_data
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
≤2.6.2Update to 2.6.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Title Overwrite
BadgeOS
≤3.7.1.6No patch available
- Medium4.3Missing Authorization via admin_post 'toggle_option'
Visibility Logic for Elementor
<2.3.5Update to 2.3.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Livestream Notice
≤1.2.0Update to 1.3.0
- Medium4.3Missing Authorization in delete_badgeos_log_entries
BadgeOS
≤3.7.1.6No patch available
- Critical9.8Authorization Bypass to Arbitrary Password Reset
Booking Package
<1.5.99Update to 1.5.99
- High7.2Unauthenticated Stored Cross-Site Scripting via Email
WP Mail Log
≤1.1.1Update to 1.1.2
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
BadgeOS
≤3.7.1.6No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via Email Subject
WP Reroute Email
≤1.4.9Update to 1.5.0
- High7.2Authenticated (Administrator+) SQL Injection via 'resend'
RSVPMaker
<10.5.5Update to 10.5.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions
≤7.0.5Update to 7.0.6
- Medium4.3Cross-Site Request Forgery via rtcl_ajax_thumbnail_delete
Classified Listing – AI-Powered Classified ads & Business Directory
≤2.4.5Update to 2.4.6
- Medium4.3Cross-Site Request Forgery
WP Dummy Content Generator
≤2.3.0Update to 3.0.0
- Medium6.5Cross-Site Request Forgery
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤4.0.5Update to 4.0.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Simple Site Verify
≤1.0.7Update to 1.0.8
- Medium4.3Cross-Site Request Forgery
WP RSS Images
≤1.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Content Copy Protection & No Right Click
≤3.5.5Update to 3.5.6
- Critical9.9Authenticated (Subscriber+) Arbitrary File Upload
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤3.0.2Update to 3.0.2.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Mobile Call Now & Map Buttons
<1.6.2Update to 1.6.2
- Medium5.4Cross-Site Request Forgery in wpm-admin.php
Menubar
≤5.8.2Update to 5.9
- Medium5.4Missing Authorization
Image Regenerate & Select Crop
≤7.1.0Update to 7.2.0