Database
WordPress Vulnerability Database (page 1117)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Unauthenticated Stored Cross-Site Scripting
IP Metaboxes
≤2.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
WooCommerce Product Categories Selection Widget
≤2.0No patch available
- Medium5.3Cross-Site Request Forgery in tools-data-base.php
Button Generator – Easily Create Custom Buttons with Icons and Analytics
≤2.3.5Update to 2.3.6
- Medium4.3Cross-Site Request Forgery
Product Gallery Slider, Additional Variation Images for WooCommerce
<2.2.9Update to 2.2.9
- Medium6.1Reflected Cross-Site Scripting
IP Metaboxes
≤2.1.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤4.5.5Update to 4.5.6
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Rename Media Files: Improve Your SEO
≤2.5.1Update to 2.5.2
- High7.2Authenticated (Vendor admin+) SQL Injection
Product Vendors
≤2.1.76Update to 2.1.77
- Medium5.3Captcha Bypass via resume_upload_form
Upload Resume
≤1.2.0No patch available
- Critical9.8Authentication Bypass
MStore API – Create Native Android & iOS Apps On The Cloud
≤3.9.2Update to 3.9.3
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
Responsive Tabs For WPBakery Page Builder (formerly Visual Composer)
≤1.1No patch available
- Medium5.4Cross-Site Request Forgery
Easy Google Maps by Supsystic – Custom Markers, Clustering & Map Themes
≤1.11.7Update to 1.11.8
- High7.2Authenticated (Follow-up emails manager+) SQL Injection
Woocommerce Follow-ups
≤4.9.50Update to 4.9.51
- Medium4.3Cross-Site Request Fogery via 'do_admin_action'
JetFormBuilder — Dynamic Blocks Form Builder
≤3.0.6Update to 3.0.7
- Low3.3Authenticated (Administrator+) Stored Cross-Site Scripting
UTM Tracker
≤1.3.1No patch available
- Medium4.3Cross-Site Request Forgery
Download Plugin
<2.0.5Update to 2.0.5
- Medium4.3Cross-Site Request Forgery via fjgwpp_settings()
Flickr Justified Gallery
≤3.5No patch available
- Medium6.1Reflected Cross-Site Scripting
Conditional Menus
≤1.2.0Update to 1.2.1
- Medium5.4Cross-Site Request Forgery via AJAX action
Easy Google Maps by Supsystic – Custom Markers, Clustering & Map Themes
≤1.11.7Update to 1.11.8
- High8.8Missing Authorization
OAuth Single Sign On – SSO (OAuth Client)
≤6.23.3Update to 6.23.4
- Medium5.3Cross-Site Request Forgery via dtwap_download()
Download Theme
≤1.0.9Update to 1.1.0
- Medium4.3Cross-Site Request Forgery
WP Tiles
≤1.1.2No patch available
- Critical9.1Authenticated (Admin+) SQL Injection
WP Custom Cursors | WordPress Cursor Plugin
≤3.1Update to 3.2
- Medium5.4Cross-Site Request Forgery via update_automator_connect
Uncanny Automator – MCP Server + Automation MCP for Claude & ChatGPT
<4.15Update to 4.15
- Medium5.4Missing Authorization via multiple AJAX actions
Tutor LMS – eLearning and online course solution
≤2.1.8Update to 2.1.9
- Medium6.1Reflected Cross-Site Scripting
Product Vendors
≤2.1.76Update to 2.1.77
- Medium4.3Missing Authorization via wt_delete_schedule
WebToffee WP Backup and Migration
≤1.4.0Update to 1.4.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Yoast SEO: Local
≤14.9Update to 15.0
- High7.2Authenticated (Administrator+) SQL Injection via 'orderby'
SIS Handball
≤1.0.45No patch available
- Medium4.9Authenticated (Administrator+) Path Traversal
Iptanus File Upload
≤4.19.1Update to 4.19.2