Database
WordPress Vulnerability Database (page 1103)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.3Missing Authorization
Kingkong Board
≤2.1.0.2No patch available
- Medium5.4Cross-Site Request Forgery in wpm-admin.php
Menubar
≤5.8.2Update to 5.9
- Medium5.3Missing Authorization
Cryptocurrency Widgets – Price Ticker & Coins List
≤2.6.2Update to 2.6.3
- Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
Animated Number Counters
≤1.6Update to 1.7
- Medium5.4Missing Authorization
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.2.3Update to 4.2.3.1
- Medium4.3Cross-Site Request Forgery
WP RSS Images
≤1.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Simple Site Verify
≤1.0.7Update to 1.0.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Content Copy Protection & No Right Click
≤3.5.5Update to 3.5.6
- Critical9.9Authenticated (Subscriber+) Arbitrary File Upload
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤3.0.2Update to 3.0.2.1
- Medium4.3Cross-Site Request Forgery
Baidu Tongji generator
≤1.0.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Reservation.Studio widget
≤1.0.11Update to 1.0.12
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Mobile Call Now & Map Buttons
<1.6.2Update to 1.6.2
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings
All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements
≤2.1.1Update to 2.1.2
- Medium6.5LMS for WordPress <= 1.6.7 - Sensitive Information Exposure
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates
<1.6.8Update to 1.6.8
- Medium4.4Authenticated (Administrator+) Stored Cross Site Scripting
Auto Location for WP Job Manager
≤1.0Update to 1.1
- Medium6.1Reflected Cross-Site Scripting via 'wpforo_debug'
wpForo Forum
≤2.1.8Update to 2.1.9
- Medium4.3Cross-Site Request Forgery via jfb_admin_page
WP Social AutoConnect
<4.6.2Update to 4.6.2
- Medium6.5Missing Authorization on multiple AJAX actions
Image Regenerate & Select Crop
<7.2.0Update to 7.2.0
- Medium6.5Cross-Site Request Forgery on multiple AJAX actions
Image Regenerate & Select Crop
<7.2.0Update to 7.2.0
- High8.8Authenticated (Subscriber+) SQL Injection
SP Project & Document Manager
≤4.67Update to 4.68
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
SP Project & Document Manager
≤4.67Update to 4.68
- Medium4.4Authenticated (Admin+) Cross-Site Scripting
Easy Accordion FAQ and Knowledge Base Software for WordPress
<2.8Update to 2.8
- Medium4.3Missing Authorization
Enhanced Text Widget
≤1.5.8Update to 1.5.9
- Medium4.3Cross-Site Request Forgery
Trustprofile and reviews for WordPress
<3.25Update to 3.25
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
My Content Management
<1.7.7Update to 1.7.7
- Medium6.1Reflected Cross-Site Scripting via item_slug
WPFactory Helper
<1.5.3Update to 1.5.3
- Medium4.3Cross-Site Request Forgery
Request a Quote – Quote Forms for Any WordPress Site
<2.3.11Update to 2.3.11
- Medium4.3Cross-Site Request Forgery
WebwinkelKeur: Webshop keurmerk & reviews for WordPress
<3.25Update to 3.25
- Critical9.8Privilege Escalation via Arbitrary User Meta Updates
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.6.6Update to 2.6.7
- High8.8Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change
SP Project & Document Manager
≤4.67Update to 4.68