Database
WordPress Vulnerability Database (page 1114)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
CRM and Lead Management by vcita
≤2.7.0Update to 2.7.1
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via azh_save
Page Builder with Image Map by AZEXO
≤1.27.133No patch available
- High8.8Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤7.5.4Update to 7.5.5
- Medium4.0Authenticated (Admin+) Stored Cross-Site Scripting
Online Scheduling and Appointment Booking System – Bookly
21.7 – 21.7Update to 21.8
- High8.8Authenticated (Contributor+) SQL Injection via post_id
Web Directory plugin Free – AI powered
≤1.6.8Update to 1.6.9
- Medium6.5Marketing Automation For WordPress <= 2.8.01 - Insufficient Use of Hash as Authorization Control
FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution
≤2.8.0.1Update to 2.8.02
- Medium6.1Reflected Cross-Site Scripting via 'search'
WP Directory Kit
≤1.2.3Update to 1.2.4
- Medium6.5Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤7.5.4Update to 7.5.5
- High8.8Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents
wpForo Forum
≤2.1.7Update to 2.1.8
- Medium4.3Open Redirect
Uncanny Toolkit for LearnDash
<3.6.4.4Update to 3.6.4.4
- High8.8Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema
≤1.6.13Update to 1.6.14
- Medium4.3Cross-Site Request Forgery
LWS Hide Login
≤2.1.6Update to 2.1.7
- Medium4.3Cross-Site Request Forgery
WP Full Auto Tags Manager
≤2.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Dynamic QR Code Generator
≤0.0.5No patch available
- Medium5.4Reflected Cross-Site Scripting
WordPress Social Login
≤3.0.4No patch available
- Medium4.3Cross-Site Request Forgery
TPG Redirect
≤1.0.7Update to 1.0.8
- Critical9.8Unauthenticated Arbitrary File Upload to Remote Code Execution via Shortcode
File Manager Advanced Shortcode
≤2.3.2Update to 2.4
- Medium4.3Cross-Site Request Forgery
WP-Cache.com
≤1.1.1No patch available
- Medium6.5Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<6.3.1Update to 6.3.1
- High7.2Cross-Site Scripting
bbPress Toolkit
≤1.0.12No patch available
- Medium4.3Cross-Site Request Forgery to Settings Modification
Floating Action Button
≤1.2.1Update to 1.2.2
- Medium4.3Cross-Site Request Forgery
WP Report Post
≤2.1.2No patch available
- Medium4.3Cross-Site Request Forgery to Survey Submission
Donation Platform for WooCommerce: Fundraising & Donation Management
<1.2.10Update to 1.2.10
- Medium4.3Cross-Site Request Forgery
TS Webfonts for さくらのレンタルサーバ
≤3.1.1Update to 3.1.2
- Medium4.3Cross-Site Request Forgery
Ajax Pagination and Infinite Scroll
≤2.0.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Yandex Metrica Counter
≤1.4.3No patch available
- Medium4.3Cross-Site Request Forgery
bbPress Toolkit
≤1.0.12No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WordPress Social Login
≤3.0.4No patch available
- Low3.7IP Address Spoofing to Protection Mechanism Bypass
Brizy – Page Builder
≤2.4.18Update to 2.4.19
- Medium5.5Authenticated (Shop manager+) Stored Cross-Site Scripting
Bulk Order Form for WooCommerce
≤3.5.7Update to 3.6.0