Database
WordPress Vulnerability Database (page 1116)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Cross-Site Request Forgery
Worthy – VG WORT Integration für WordPress
≤1.6.5-6497609Update to 1.7.0-0cde1c2
- Medium4.4Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode
Blog-in-Blog
≤2.0.0Update to 2.0.1
- Medium6.1Reflected Cross-Site Scripting
Google Fonts For WordPress
≤3.0.0Update to 3.0.1
- Medium4.3Cross-Site Request Forgery
WP-Cirrus
≤0.6.11No patch available
- Medium4.3Cross-Site Request Forgery to Form Duplication
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.6.0Update to 2.6.1
- Medium5.41.1.1 - Missing Authorization to Non-Arbitrary User Deletion
Login | Login Page | Login Logo | Rename Login Page | Custom Login Page | Temporary Users | Rebrand Login | Login Captcha
1.0.7 – 1.1.1Update to 1.1.2
- Critical9.8Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature
Wordapp
≤1.6.0Update to 1.7.0
- Low3.8Missing Authorization to Authenticated (Editor+) Plugin Settings Reset
Nested Pages
≤3.2.3Update to 3.2.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Telegram Bot & Channel
≤3.6.2Update to 3.6.3
- Medium6.1Reflected Cross-Site Scripting
Social Share, Social Login and Social Comments Plugin – Super Socializer
<7.13.52Update to 7.13.52
- Critical9.8Unauthenticated PHP Object Injection
Gravity Forms
≤2.7.3Update to 2.7.4
- Medium4.3Cross-Site Request Forgery via create_profile
WOLF – WordPress Posts Bulk Editor and Manager Professional
≤1.0.7Update to 1.0.7.1
- Medium6.5Cross-Site Request Forgery via process_delete_product
WP EasyCart: Shopping Cart and eCommerce Store
≤5.4.8Update to 5.4.9
- Medium4.3Cross-Site Request Forgery via process_bulk_deactivate_product
WP EasyCart: Shopping Cart and eCommerce Store
≤5.4.8Update to 5.4.9
- Medium6.5Cross-Site Request Forgery via process_bulk_delete_product
WP EasyCart: Shopping Cart and eCommerce Store
≤5.4.8Update to 5.4.9
- High7.2Authenticated (Admin+) SQL Injection
Portfolio Gallery – Photo Gallery
≤1.1.8Update to 1.1.9
- Medium4.3Cross-Site Request Forgery via process_duplicate_product
WP EasyCart: Shopping Cart and eCommerce Store
≤5.4.8Update to 5.4.9
- Medium4.3Cross-Site Request Forgery via process_deactivate_product
WP EasyCart: Shopping Cart and eCommerce Store
≤5.4.8Update to 5.4.9
- Medium4.3Cross-Site Request Forgery via process_bulk_activate_product
WP EasyCart: Shopping Cart and eCommerce Store
≤5.4.8Update to 5.4.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
SlideOnline
≤1.2.1No patch available
- Critical9.8Unauthenticated Local File Inclusion via wdk_public_action
WP Directory Kit
≤1.1.9Update to 1.2.0
- High7.2Authenticated (Administrator+) SQL Injection
QueryWall: Plug'n Play Firewall
≤1.1.1No patch available
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
Google Map Shortcode
≤3.1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
This Day In History
≤3.10.1No patch available
- Medium6.6Authenticated(Administrator+) SQL Injection via txtsearch
User Activity Log
≤1.6.2Update to 1.6.3
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Rename Media Files: Improve Your SEO
≤2.5.1Update to 2.5.2
- Critical9.8Unauthenticated PHP Object Injection
Recently Viewed Products
≤1.0.0No patch available
- Medium5.3Missing Authorization
SKU Label Changer For WooCommerce
≤3.0Update to 3.0.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Video Contest WordPress Plugin
≤3.2No patch available
- Medium4.3Cross-Site Request Forgery
Video Contest WordPress Plugin
≤3.2No patch available