Database
WordPress Vulnerability Database (page 1122)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Essential Addons for Elementor Pro
≤5.4.8Update to 5.4.9
- High7.2Unauthenticated Cross-Site Scripting
WooCommerce Pre-Orders
≤1.9.0Update to 2.0.0
- Medium4.3Cross-Site Request Forgery
WP Custom Cursors | WordPress Cursor Plugin
<3.2Update to 3.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Stop Spammers Classic
≤2022.6Update to 2023
- Medium6.1Reflected Cross-Site Scripting
Quiz Maker by AYS
≤6.4.2.6Update to 6.4.2.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WooCommerce Pre-Orders
≤2.0.0Update to 2.0.1
- Medium6.5Missing Authorization
Predictive Search
≤1.2.2Update to 1.2.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WooCommerce Brands
≤1.6.45Update to 1.6.46
- Medium6.1Reflected Cross-Site Scripting
Stop Spammers Classic
≤2022.6Update to 2023
- Medium5.5Authenticated (Shop manager+) SQL Injection
AutomateWoo
≤5.7.1Update to 5.7.2
- Medium6.1Reflected Cross-Site Scripting
Video Gallery
≤1.0.10Update to 1.0.11
- Medium4.3Cross-Site Request Forgery
WooCommerce Product Add-ons
≤6.1.3Update to 6.2.0
- Critical9.8Authentication Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤5.2.1.0Update to 5.2.1.1
- High7.3Unauthenticated Server-Side Request Forgery
Essential Addons for Elementor Pro
≤5.4.8Update to 5.4.9
- Medium6.1Reflected Cross-Site Scripting via 'page'
Custom 404 Pro
≤3.8.1Update to 3.8.2
- Medium4.3Cross-Site Request Forgery
Product Recommendations
<2.3.0Update to 2.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Download Manager
≤3.2.70Update to 3.2.71
- Medium4.3Missing Authorization via save_fields_settings
Booking Ultra Pro Appointments Booking Calendar Plugin
≤1.1.6Update to 1.1.7
- Medium4.3GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via ajax_edit_item
Complianz GDPR/CCPA Cookie Consent Banner
≤6.4.4Update to 6.4.5
- Medium6.1Reflected Cross-Site Scripting
Donations Made Easy – Smart Donations
≤4.0.12No patch available
- Medium4.3Cross-Site Request Forgery to Field Duplication
Community by PeepSo – Download from PeepSo.com
≤6.0.9.0Update to 6.1.0.0
- Medium5.4Missing Authorization to Settings Update
Elementor Website Builder – more than just a page builder
≤3.13.1Update to 3.13.2
- Medium4.3GDPR/CCPA Cookie Consent <= 6.4.4 - Cross-Site Request Forgery via ajax_create_pages
Complianz GDPR/CCPA Cookie Consent Banner
≤6.4.4Update to 6.4.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Button
≤1.1.22Update to 1.1.23
- Medium4.3Cross-Site Request Forgery to Settings Update
Sunny Search
≤1.0.2No patch available
- Medium4.4Authenticated (Contributor+) Stored Cross-Site Scripting
Column-Matic
≤1.3.3No patch available
- Low3.1Cross-Site Request Forgery to SQL Injection
Active Directory Integration / LDAP Integration
≤4.1.4Update to 4.1.5
- Medium4.3Cross-Site Request Forgery via AJAX action
WP Reactions Lite
≤1.3.8Update to 1.3.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
Product page shipping calculator for WooCommerce
≤1.3.25Update to 1.3.26
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Get your number
≤1.1.3No patch available