Database
WordPress Vulnerability Database (page 1125)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization via init()
Link Whisper Free
≤0.6.3Update to 0.6.4
- Medium4.3Cross-Site Request Forgery to Whitelist Update
Injection Guard
≤1.2.1Update to 1.2.2
- Medium6.1Reflected Cross-Site Scripting via 'lang'
Brevo – Email, SMS, Web Push, Chat, and more.
≤3.1.60Update to 3.1.61
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Hostel
≤1.1.5.1Update to 1.1.5.2
- High7.2Authenticated (Admin+) SQL Injection
Pricing Table Builder – AP Pricing Tables Lite
≤1.1.6No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Custom Field Suite
≤2.6.2.1Update to 2.6.3
- Medium6.1Reflected Cross-Site Scripting via '_user_request'
Order Your Posts Manually
≤2.2.5No patch available
- Medium5.3Missing Authorization to Whitelist Update
Injection Guard
≤1.2.1Update to 1.2.2
- Medium5.3Missing Authorization to Unauthenticated Settings Change
Woo Custom Emails
≤2.2No patch available
- Medium6.1Open Redirect
MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder
≤4.0.9.3Update to 4.0.9.4
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Chinese Conversion
≤1.1.16No patch available
- Medium6.6Authenticated (Admin+) PHP Object Injection
GiveWP – Donation Plugin and Fundraising Platform
≤2.25.3Update to 2.26.0
- High8.8Authenticated (Contributor+) SQL Injection
WP Replicate Post
≤4.0.2Update to 4.1
- High7.2Authenticated (Administrator+) SQL Injection via 'sortdata'
Order Your Posts Manually
≤2.2.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Brands for WooCommerce
≤3.7.0.6Update to 3.8.2
- Medium5.4Missing Authorization
WCP Contact Form
≤3.1.0No patch available
- Medium4.3Cross-Site Request Forgery
WhyDonate – FREE Donate button – Crowdfunding – Fundraising
≤3.12.14Update to 3.12.16
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'base'
Custom Base Terms
≤1.0.2.3Update to 1.0.3
- Medium5.4Sensitive Information Exposure via REST API
Download Monitor
≤4.7.60Update to 4.7.70
- High7.2Unauthenticated Stored Cross-Site Scripting
Booking Ultra Pro Appointments Booking Calendar Plugin
≤1.1.8Update to 1.1.9
- Medium4.3Cross-Site Request Forgery
Google Site Verification plugin using Meta Tag
≤1.2No patch available
- Medium5.4Reflected Cross-Site Scripting via 'cat_id'
Order Your Posts Manually
≤2.2.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)
≤8.14.0Update to 8.14.1
- High7.5Sensitive Information Exposure
Backup Migration
≤1.2.8Update to 1.2.9
- Medium6.1Reflected Cross-Site Scripting
10Web Social Post Feed
≤1.2.8Update to 1.2.9
- High7.2Authenticated (Administrator+) Local File Inclusion
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤7.5.3Update to 7.5.4
- Medium4.3Missing Authorization via salert_save_settings_with_ajax()
SALERT – Social Proof Notifications & Live Sales Popup
≤1.2.1Update to 1.2.2
- Medium6.5Manage file media types <= 1.0.7 - Cross-Site Request Forgery via pmt_settings_section_callback_tab_1
Pro Mime Types – Manage file media types
<2.0.0Update to 2.0.0
- Medium6.1Reflected Cross-Site Scripting
Responsive Tabs — Horizontal, Vertical & Accordion Tabs for WordPress
≤1.1.15Update to 1.1.16
- Medium4.3Cross-Site Request Forgery
CM Search And Replace – Optimize content edits with a powerful search and replace tool
≤1.3.0Update to 1.3.1