Database
WordPress Vulnerability Database (page 1127)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Directory Traversal via _file_upload
MW WP Form
<4.4.3Update to 4.4.3
- Medium5.3Directory Traversal via 'view' REST endpiont
Snow Monkey Forms
≤5.1.1Update to 5.1.2
- Critical9.8Unauthenticated Arbitrary File Upload via 'upload'
Manager for IcoMoon
≤2.0Update to 2.1
- Medium4.3Insufficient Authorization
Web Stories
<1.32.0Update to 1.32.0
- Medium6.1Reflected Cross-Site Scripting
WP Abstracts
≤2.6.1Update to 2.6.2
- Medium6.5IP Address Spoofing to Protection Mechanism Bypass
Hide My WP Ghost – Security & Firewall
≤5.0.18Update to 5.0.20
- High7.2Authenticated (Administrator+) SQL Injection
Cryptocurrency Donation Box – Bitcoin & Crypto Donations
≤2.2.7Update to 2.2.8
- Medium6.3Cross-Site Request Forgery via multiple AJAX actions
Easy Appointments
≤3.11.9Update to 3.11.10
- Medium6.3Improper Authentication
TheGem
<5.8.1.1Update to 5.8.1.1
- Medium4.3Cross-Site Request Forgery to Settings Change
Points and Rewards for WooCommerce – Create Loyalty Programs, Reward Customer Purchases, Referral Points, User Badges, and Gamification
≤1.5.0Update to 1.6.0
- Medium6.3Missing Authorization
TheGem
<5.8.1.1Update to 5.8.1.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
TheGem
<5.8.1.1Update to 5.8.1.1
- Medium5.3Missing Authorization to Settings Modification
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.0.1Update to 2.0.2
- Medium4.3Cross-Site Request Forgery to Settings Modification
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.0.1Update to 2.0.2
- Medium5.3Missing Authorization to Sensitive Information Exposure
Community by PeepSo – Download from PeepSo.com
≤6.0.9.0Update to 6.1.0.0
- Medium6.5Missing Authorization
Points and Rewards for WooCommerce – Create Loyalty Programs, Reward Customer Purchases, Referral Points, User Badges, and Gamification
≤1.5.0Update to 1.6.0
- Medium6.1reflected Cross-Site Scripting via error_description
WPO365 | Mail Integration for Office 365 / Outlook
≤1.9.0Update to 1.9.1
- High7.3Authorization Bypass
TK Google Fonts
≤2.2.7Update to 2.2.8
- Medium4.3Cross-Site Request Forgery to Arbitrary Ratings Value Change
Multi Rating
≤5.0.6No patch available
- Medium4.3Missing Authorization to Settings Update
DX Delete Attached Media
≤2.0.2Update to 2.0.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Manage Bookings
Hostel
≤1.1.5.1Update to 1.1.5.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Manager for IcoMoon
≤2.1Update to 2.2
- Medium6.5Missing Authorization
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤3.3.0Update to 3.3.2
- Medium6.3Missing Authorization to Authenticated Plugin Activation
Editorialmag
≤1.2.0Update to 1.2.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Multi Rating
≤5.0.6No patch available
- Medium5.3Missing Authorization to Arbitrary Ratings Value Change
Multi Rating
≤5.0.6No patch available
- Medium6.1Reflected Cross-Site Scripting via 'post_status'
Advanced Custom Fields (ACF®)
≤6.1.5Update to 5.12.6 or 6.1.6
- High8.8Authenticated (Subscriber+) SQL Injection via getStatistics
CM Pop-Up – Create engaging popups to capture attention and boost interaction
≤1.5.10Update to 1.6.0
- Medium6.1Reflected Cross-Site Scripting
Albo Pretorio On line
≤4.6.3Update to 4.6.4
- High7.2Stored Cross-Site Scripting
Contact Form 7 extension for Google Map fields
≤1.8.3Update to 1.8.4