Database
WordPress Vulnerability Database (page 1126)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization to Zapier Key Reset
Yoast SEO Premium
≤20.4Update to 20.5
- High7.2Authenticated (Administrator+) SQL Injection
Zero Spam for WordPress
≤5.4.4Update to 5.4.5
- Medium6.1Reflected Cross-Site Scripting
Responsive Tabs — Horizontal, Vertical & Accordion Tabs for WordPress
≤1.1.15Update to 1.1.16
- Medium4.7Unauthenticated Self-Based Cross-Site Scripting
QuBot – Chatbot Builder with Templates
≤1.1.5Update to 1.1.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Divi
≤4.20.2Update to 4.20.3
- Medium6.4Stored (Contributor+) Cross-Site Scripting in Tag Edit
VK Blocks Pro
≤1.53.0.1Update to 1.54.0
- Medium6.5Manage file media types <= 1.0.7 - Cross-Site Request Forgery via pmt_settings_section_callback_tab_1
Pro Mime Types – Manage file media types
<2.0.0Update to 2.0.0
- Critical9.8Unauthenticated SQL Injection via form_id
Ultra Addons for Contact Form 7
≤3.1.23Update to 3.1.24
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'snippet_content'
Post Snippets – Custom WordPress Code Snippets Customizer
≤4.0.2Update to 4.0.3
- Medium6.4Stored (Contributor+) Cross-Site Scripting in Post
VK Blocks Pro
≤1.53.0.1Update to 1.54.0
- Low3.3Authenticated (Administrator+) Stored Cross-Site Scripting
Block Referer Spam
≤1.1.9.4Update to 1.1.9.5
- Medium4.3Cross-Site Request Forgery
CM Search And Replace – Optimize content edits with a powerful search and replace tool
≤1.3.0Update to 1.3.1
- Medium6.1Reflected Cross-Site Scripting
Vertical Image Slider – Responsive Thumbnail Slider with Lightbox
≤1.2.16Update to 1.2.17
- Medium6.1Reflected Cross-Site Scripting
Team Circle Image Slider With Lightbox
≤1.0.17Update to 1.0.18
- Medium6.4Stored (Contributor+) Cross-Site Scripting in CTA Post
VK All in One Expansion Unit
≤9.88.1.0Update to 9.88.2.0
- Medium4.3Cross-Site Request Forgery
Easy Hide Login
≤1.0.8Update to 1.0.9
- Medium6.4Stored (Contributor+) Cross-Site Scripting in Profile Setting
VK All in One Expansion Unit
≤9.88.1.0Update to 9.88.2.0
- Medium6.1Reflected Cross-Site Scripting
Radio Station by netmix® – Manage and play your Show Schedule in WordPress!
≤2.4.0.9Update to 2.5.0
- Medium4.3Cross-Site Request Forgery
Wise Chat
≤3.1.3Update to 3.1.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
≤7.31Update to 7.32
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Easy Form
≤1.2.0Update to 1.2.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Easy Hide Login
≤1.0.7Update to 1.0.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
My WP Customize Admin/Frontend
<1.21.1Update to 1.21.1
- Medium6.1Ordering - Reservations <= 2.3.6 - Reflected Cross-Site Scripting via 'redirect'
Restaurant Menu – Food Ordering System – Table Reservation
<2.3.7Update to 2.3.7
- Medium4.3Cross-Site Request Forgery
Yoast SEO: Local
≤14.8Update to 14.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
≤7.14.1Update to 7.14.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
SALERT – Social Proof Notifications & Live Sales Popup
≤1.2.1Update to 1.2.2
- Medium4.3Insufficient Authorization
Web Stories
<1.32.0Update to 1.32.0
- Medium5.4Cross-Site Request Forgery via shortpixel_ai_handle_page_action
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization
<3.7.2Update to 3.7.2
- Critical9.8Unauthenticated Arbitrary File Upload via 'upload'
Manager for IcoMoon
≤2.0Update to 2.1