Database
WordPress Vulnerability Database (page 1124)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Free WordPress Lead Generation Opt in, Free Popups, Generated Lead Email Popup, Exit-Intent Popup – NotifyVisitors
≤1.0No patch available
- Medium6.3Missing Authorization Checks
Announcement Bar, Notification Bar & Banner – Bulletin
≤3.6.0Update to 3.7.0
- Medium4.3Authenticated (Contributor+) Arbitrary Redirect
Frontend Post WordPress Plugin – AccessPress Anonymous Post
≤2.8.4No patch available
- Critical9.8Unauthenticated Arbitrary Password Reset to Privilege Escalation
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤5.7.1Update to 5.7.2
- Critical9.8PHP Object Injection
Woodmart Core
≤1.0.36Update to 1.0.37
- Medium6.3Cross-Site Request Forgery
Announcement Bar, Notification Bar & Banner – Bulletin
≤3.7.0Update to 3.7.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Owl Carousel
≤0.5.3No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Don8
≤0.4No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
DevBuddy Twitter Feed
≤4.0.0No patch available
- Medium6.1Reflected Cross-Site Scripting
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤5.0.4Update to 5.0.5
- Medium4.3Cross-Site Request Forgery to Transient Cache Clearing
Simple Calendar – Google Calendar, Events, & ICS Feeds
≤3.1.42Update to 3.1.43
- Medium4.3Missing Authorization to Soundcloud User Add
SoundCloud Is Gold
≤2.5.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Add Posts to Pages
≤1.4.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Pinterest RSS Widget
≤2.3.1No patch available
- Medium6.5Missing Authorization to Arbitrary Gallery Deletion
Portfolio Gallery – Responsive Image Gallery
≤1.4.5Update to 1.4.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
WP Category Post List Widget
≤2.0.3No patch available
- Medium4.3Missing Authorization via fasc_buttons
Forget About Shortcode Buttons
≤2.1.2Update to 2.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
BuddyForms
≤2.8.1Update to 2.8.2
- Medium4.3Missing Authorization
Woodmart
≤7.2.1Update to 7.2.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via settings
eBecas
≤3.1.3No patch available
- Critical9.8Authentication Bypass to Privilege Escalation
Woodmart Core
≤1.0.36Update to 1.0.37
- High7.2Authenticated (Administrator+) SQL Injection
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤5.0.4Update to 5.0.5
- High8.1Arbitrary File Deletion
Online Scheduling and Appointment Booking System – Bookly
≤21.7.1Update to 21.8
- Medium4.3Cross-Site Request Forgery via ig_update
Injection Guard
≤1.2.1Update to 1.2.2
- Medium4.3Missing Authorization via ig_update
Injection Guard
≤1.2.1Update to 1.2.2
- Medium5.4Missing Authorization
WP-Chatbot for Messenger
≤4.7Update to 4.8
- High7.2Authenticated (Administrator+) SQL Injection via 'sortdata'
Order Your Posts Manually
≤2.2.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Brands for WooCommerce
≤3.7.0.6Update to 3.8.2
- High8.8Authenticated (Contributor+) SQL Injection
WP Replicate Post
≤4.0.2Update to 4.1
- Medium5.3Missing Authorization to Unauthenticated Settings Change
Woo Custom Emails
≤2.2No patch available