Database
WordPress Vulnerability Database (page 1120)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Shortcode Execution in User Generated Content
WordPress
<6.2.2Update to 5.9.7 or 6.0.5 or 6.1.3 or 6.2.2
- Medium5.4Missing Authorization to Non-Arbitrary File Upload
Groundhogg — CRM, Newsletters, and Marketing Automation
≤2.7.9.8Update to 2.7.10
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
<1.6.83Update to 1.6.83
- Medium4.3Cross-Site Request Forgery
Jazz Popups
≤1.8.7No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Cookie Monster
≤1.51No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP htaccess Control
≤3.5.1No patch available
- Medium4.3Cross-Site Request Forgery via dismiss-wp-pointer
Performance Lab
≤2.2.0Update to 2.3.0
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting via action_authenticate_storage
UpdraftPlus Premium
≤1.23.3Update to 1.23.4
- Critical9.8Authentication Bypass
BP Social Connect
≤1.5Update to 1.6.2
- Medium5.3Missing Authorization via multiple AJAX actions
Predictive Search for WooCommerce
≤5.8.0Update to 5.8.1
- Medium5.3Cross-Site Request Forgery via multiple AJAX actions
Predictive Search for WooCommerce
≤5.8.0Update to 5.8.1
- Low3.3Authenticated (Administrator+) Stored Cross-Site Scripting
Baidu Tongji generator
≤1.0.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
nuajik
≤0.1.0No patch available
- High8.8Authenticated (Subscriber+) SQL Injection
SEO Change Monitor – Track Website Changes
≤1.2Update to 1.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WeSecur Security – Antivirus, Malware Scanner and Protection for your WordPress
≤1.2.1No patch available
- Medium6.1Reflected Cross-Site Scripting via 'wpjazzpopup_switchonoff'
Jazz Popups
≤1.8.7No patch available
- Medium4.3Cross-Site Request Forgery via handle_actions
Customize WordPress Emails and Alerts – Better Notifications for WP
≤1.9.2Update to 1.9.3
- Medium5.4Cross-Site Request Forgery via processParameters
Stop Referrer Spam
≤1.3.0Update to 1.3.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WishSuite – Wishlist for WooCommerce
≤1.3.4Update to 1.3.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Scripts n Styles
≤3.5.3Update to 3.5.4
- Medium4.3Missing Capabilities Check to User Enumeration
WP Activity Log
≤4.5.0Update to 4.5.2
- Critical9.8Authentication Bypass
MStore API – Create Native Android & iOS Apps On The Cloud
≤3.9.0Update to 3.9.1
- Medium4.3Cross-Site Request Forgery via ajax_run_cleanup
WP Activity Log
≤4.5.0Update to 4.5.2
- Medium4.3Missing Authorization via ajax_switch_db
WP Activity Log Premium
≤4.5.0Update to 4.5.2
- High7.4Missing Authorization Checks leading to Authenticated (Subscriber+) Stored Cross-Site Scripting
Waiting: One-click countdowns
≤0.6.2No patch available
- Medium4.3Cross-Site Request Forgery via ajax_switch_db
WP Activity Log Premium
≤4.5.0Update to 4.5.2
- Medium6.1Reflected Cross-Site Scripting via 'sql_error'
Easy Forms for Mailchimp
≤6.8.8Update to 6.8.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
File Away
≤3.9.9.0.1No patch available
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
≤3.0.9Update to 3.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
PixelYourSite Pro – Your smart PIXEL (TAG) Manager
≤9.6.1Update to 9.6.2