Database
WordPress Vulnerability Database (page 1108)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Missing Authorization via redirect_pay_for_order_to_update_payment_method
WooPayments: Integrated WooCommerce Payments
≤5.9.0Update to 5.9.1
- Critical9.8Unauthenticated SQL Injection
MStore API – Create Native Android & iOS Apps On The Cloud
≤3.9.7Update to 3.9.8
- Medium6.1Reflected Cross-Site Scripting
Companion Sitemap Generator – Simple, Smart, and SEO-Ready
≤4.5.1.1Update to 4.5.3
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via SVG
Enable SVG Uploads
≤2.1.5No patch available
- Medium6.6Authenticated(Administrator+) Remote Code Execution
HTTP Headers
≤1.18.10Update to 1.18.11
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
PrePost SEO
≤3.0No patch available
- Critical9.8Unauthenticated Privilege Escalation
MStore API – Create Native Android & iOS Apps On The Cloud
≤3.9.8Update to 3.9.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Social Share, Social Login and Social Comments Plugin – Super Socializer
≤7.13.52Update to 7.13.53
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via block attributes
Simple Iframe
≤1.1.1Update to 1.2.0
- Medium4.3Cross-Site Request Forgery
Extra User Details
≤0.5Update to 0.5.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Call Now Accessibility Button
≤1.0.2Update to 1.1
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
Float menu – awesome floating side menu
≤5.0.2Update to 5.0.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
MojoPlug Slide Panel
≤1.1.2No patch available
- Medium4.7Open Redirect via _wp_http_referer
Core Web Vitals & PageSpeed Booster
≤1.0.12Update to 1.0.13
- Medium6.1Reflected Cross-Site Scripting
Export All URLs
≤4.5Update to 4.6
- Medium4.3Missing Authorization via multiple AJAX actions
WooCommerce Square
≤3.8.1Update to 3.8.2
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Sticky Social
1.0.1 – 1.0.1Update to 1.0.2
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
GradeBook
≤5.0.1No patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
TinyMCE Custom Styles
≤1.1.3Update to 1.1.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Extra User Details
≤0.5Update to 0.5.1
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
Display Custom Fields – wpView
≤1.3.0No patch available
- High8.1Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature
CMS Commander – Manage Multiple Sites
≤2.287Update to 2.288
- Medium6.5Missing Authorization to Insecure Direct Object Reference
WooCommerce Subscription
≤5.1.2Update to 5.1.3
- Medium4.3Cross-Site Request Forgery
WooCommerce Brands
≤1.6.49Update to 1.6.50
- High8.8Authenticated (Contributor+) Arbitrary File Upload
Unlimited Elements for Elementor
≤1.5.66Update to 1.5.67
- Medium6.1Reflected Cross-Site Scripting
Google Map Shortcode
≤3.1.2No patch available
- Medium5.4Cross-Site Request Forgery
LWS Cleaner
≤2.3.0Update to 2.3.1
- Medium4.3Cross-Site Request Forgery
Template Debugger
≤3.1.2No patch available
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
Seed Fonts
2.3.1 – 2.3.1Update to 2.4.0
- Medium6.1Reflected Cross-Site Scripting
Who Hit The Page – Hit Counter
≤1.4.14.3No patch available