Database
WordPress Vulnerability Database (page 1106)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization to Notice Dismissal
WP Mail Logging
<1.12.0Update to 1.12.0
- High7.2Unauthenticated Cross-Site Scripting
Post Grid Gutenberg Blocks – PostX
≤2.9.9Update to 2.9.10
- Medium6.1Reflected Cross-Site Scripting
Membership Plugin – Kadence Memberships
<3.2.3Update to 3.2.3
- Medium5.9Information Disclosure via Back-Up Files
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
≤4.4.1.1Update to 4.4.1.2
- Medium5.3Missing Authorization
BBS e-Popup
≤2.4.5No patch available
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting via SVG
Enable SVG, WebP, and ICO Upload
≤1.1.1Update to 1.1.2
- Medium6.1Reflected Cross-Site Scripting
Five Star Restaurant Reservations – WordPress Booking Plugin
≤2.6.7Update to 2.6.8
- Medium6.4Authenticated(Author+) Stored Cross-Site Scripting
InventoryPress
≤1.7No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Lana Text to Image
≤1.0.0Update to 1.1.0
- Medium5.3Missing Authorization to Notice Dismissal
Membership Plugin – Kadence Memberships
<3.2.3Update to 3.2.3
- Critical9.8Unauthenticated SQL Injection
MStore API – Create Native Android & iOS Apps On The Cloud
≤4.0.1Update to 4.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Lana Shortcodes
≤1.1.1Update to 1.2.0
- Medium6.1Reflected Cross-Site Scripting via error message
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<4.11.0Update to 4.11.0
- High7.1Prototype Pollution
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
<1.10.19Update to 1.10.19
- Medium4.3Missing Authorization via gallery_remove
Gallery Metabox
≤1.5No patch available
- Medium6.3Missing Authorization
Anti-Spam, Spam FireWall by CleanTalk
≤6.10Update to 6.11
- Medium4.3Missing Authorization via refresh_metabox
Gallery Metabox
≤1.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting via Email Subject
Mail Queue
≤1.1Update to 1.2
- Medium5.3Missing Authorization
ReDi Restaurant Reservation – Instant Restaurant Booking & Table Reservation System
≤23.0211Update to 23.0212
- High7.2Authenticated (Administrator+) SQL Injection via post_id
Colibri Page Builder
≤1.0.227Update to 1.0.229
- Medium4.3Cross-Site Request Forgery to Settings Update
WP-Members Membership Plugin
≤3.4.7.3Update to 3.4.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
About Me 3000 widget
≤2.2.6No patch available
- Medium6.5Authenticated (Admin+) Arbitrary File Deletion
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.6.24Update to 3.6.25
- Medium5.4Cross-Site Request Forgery via permalink_setup
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤3.3.2Update to 3.3.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Customer Support Ticket System & Helpdesk
<5.13Update to 5.13
- Medium6.1Reflected Cross-Site Scripting via meta_field_id and cite_id
teachPress
<9.0.3Update to 9.0.3
- Medium6.1Reflected Cross-Site Scripting
Booking Calendar Contact Form
≤1.2.40Update to 1.2.41
- Medium4.3Cross-Site Request Forgery
MyCurator Content Curation
≤3.74Update to 3.75
- High8.8Authenticated (Contributor+) SQL Injection via post_id
Quick Post Duplicator
≤2.0No patch available
- Medium5.4Cross-Site Request Forgery via empty_ham_entries and empty_spam_entries
oopspam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA)
<1.1.45Update to 1.1.45