Database
WordPress Vulnerability Database (page 1128)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Open Redirect via 'redirect_to'
Library Viewer
≤2.0.6Update to 2.0.6.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodes
TP Education
≤4.4Update to 4.5
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings
Participants Database
<2.5Update to 2.5
- Medium5.4Cross-Site Request Forgery via _process_general
Participants Database
≤2.4.9Update to 2.5.0
- High7.2Stored Cross-Site Scripting
Contact Form 7 extension for Google Map fields
≤1.8.3Update to 1.8.4
- High8.8Authenticated (Subscriber+) SQL Injection via getStatistics
CM Pop-Up – Create engaging popups to capture attention and boost interaction
≤1.5.10Update to 1.6.0
- Medium6.1Reflected Cross-Site Scripting via ays_gpg_settings_tab
Photo Gallery by Ays – Responsive Image Gallery
≤5.1.3Update to 5.1.4
- Medium6.1Reflected Cross-Site Scripting
Albo Pretorio On line
≤4.6.3Update to 4.6.4
- High8.1Authenticated Local File Inclusion via print_pane
JupiterX
≤3.0.0Update to 3.1.0
- Critical9.8Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Change
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.10.7Update to 2.11.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
UserAgent-Spy
≤1.3.1No patch available
- Medium6.1Reflected Cross-Site Scripting
WPPizza – A Restaurant Plugin
≤3.17.1Update to 3.17.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via wpbe_update_page_field
WOLF – WordPress Posts Bulk Editor and Manager Professional
≤1.0.6Update to 1.0.7
- Medium6.4OpenStreetMap <= 6.0.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via 'osm_map' Shortcode
OSM – OpenStreetMap
≤6.0.5Update to 6.0.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Library Viewer
≤2.0.6Update to 2.0.6.1
- Medium4.7Reflected Cross-Site Scripting via page parameter
Spiffy Calendar
<4.9.4Update to 4.9.4
- Medium6.1Reflected Cross-Site Scripting via 's'
Custom 404 Pro
≤3.7.2Update to 3.7.3
- Medium6.6Authenticated (edit_popups+) SQL Injection
HollerBox — Fast & Effective Popups & Lead-Generation
<2.1.4Update to 2.1.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Login rebuilder
≤2.8.0Update to 2.8.1
- Medium6.1Reflected Cross-Site Scripting
WP Docs
<2.0.0Update to 2.0.0
- High8.6Sensitive Information Exposure
Dynific Addons for Elementor (formerly Anywhere Elementor)
≤1.2.7Update to 1.2.8
- Medium6.1Reflected Cross-Site Scripting via 'limit_session[count]'
Loginizer
≤1.7.8Update to 1.7.9
- High7.2Unauthenticted Stored Cross-Site Scripting via 'nl_data'
Newsletter Popup
≤1.2No patch available
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings
Add to Feedly
≤1.2.11No patch available
- Medium5.0Limited Server Side Request Forgery via 'formassembly' shortcode
WP-FormAssembly
<2.0.9Update to 2.0.9
- Medium4.3Cross-Site Request Forgery to Record Deletion
Newsletter Popup
≤1.2No patch available
- Low2.7Authenticated(Administator+) Directory Traversal
Image Optimizer by 10web – Image Optimizer and Compression plugin
≤1.0.26Update to 1.0.27
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
PPOM – Product Addons & Custom Fields for WooCommerce
<32.0.6Update to 32.0.6
- Critical9.83.1.1.4.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
3.1 – <3.1.1.4.2Update to 3.1.1.4.2
- Medium6.5Authenticated(Administrator+) Blind Server Side Request Forgery via check_url
WP Fastest Cache – WordPress Cache Plugin
≤1.1.4Update to 1.1.5