Database
WordPress Vulnerability Database (page 1109)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
Template Debugger
≤3.1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Who Hit The Page – Hit Counter
≤1.4.14.3No patch available
- Medium6.1Reflected Cross-Site Scripting
WP Backup Manager
≤1.13.1No patch available
- Medium5.4Cross-Site Request Forgery
LWS Tools
≤2.4.1Update to 2.4.2
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
Seed Fonts
2.3.1 – 2.3.1Update to 2.4.0
- Low3.3Authenticated (Administrator+) Stored Cross-Site Scripting
breadcrumb simple
≤1.3No patch available
- Medium4.3Missing Authorization to Plugin Settings Update
CHP Ads Block Detector
≤3.9.4Update to 3.9.8
- Medium4.3Missing Authorization to Course Category Creation
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.0.8Update to 3.0.9
- Medium4.9Authenticated (Subscriber+) Stored Cross-Site Scripting
CHP Ads Block Detector
≤3.9.4Update to 3.9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤3.0.8Update to 3.0.9
- Medium6.1Reflected Cross-Site Scripting
WordPress NextGen GalleryView
≤0.5.5No patch available
- Medium6.6Authenticated (Administrator+) SQL Injection
Contact Form by WD – responsive drag & drop contact form builder tool
≤1.13.23No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Flo Forms – Easy Drag & Drop Form Builder
≤1.0.40Update to 1.0.41
- Medium4.3Cross-Site Request Forgery via chp_abd_action
CHP Ads Block Detector
≤3.9.4Update to 3.9.8
- Medium4.3Missing Authorization via constant_contact_privacy_ajax_handler
Constant Contact Forms
≤2.0.2Update to 2.0.3
- Medium4.3Cross-Site Request Forgery
Recipe Cards For Your Food Blog from Zip Recipes
≤8.0.7Update to 8.0.8
- Medium6.1Reflected Cross-Site Scripting
WP Affiliate Links
≤0.1.1No patch available
- Medium4.3Cross-Site Request Forgery
Recipe Cards For Your Food Blog from Zip Recipes
<8.0.8Update to 8.0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Matterport Shortcode
≤2.1.4Update to 2.1.5
- Medium4.3Missing Authorization in check_score
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.16Update to 1.15.17
- Medium4.3Cross-Site Request Forgery
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
<2.5.1Update to 2.5.1
- Medium4.3Cross-Site Request Forgery
Stock Manager for WooCommerce
<2.11.0Update to 2.11.0
- Medium5.3Missing Authorization
胖鼠采集(Fat Rat Collect)
≤2.6.0Update to 2.6.1
- Medium4.3Cross-Site Request Forgery to PDF Settings Update
WP PDF Generator
≤1.2.2Update to 1.2.3
- Medium4.3Cross-Site Request Forgery
Zephyr Project Manager
≤3.3.93Update to 3.3.94
- Medium4.3Cross-Site Request Forgery to Product Limit Update
MStore API – Create Native Android & iOS Apps On The Cloud
≤3.9.6Update to 3.9.7
- Medium6.1Reflected Cross-Site Scripting
Recent Posts Slider
≤1.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Password Protected
≤2.6.2Update to 2.6.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Login Configurator
≤2.1No patch available
- Medium4.3Cross-Site Request Forgery to Order Message Update
MStore API – Create Native Android & iOS Apps On The Cloud
≤3.9.6Update to 3.9.7