Database
WordPress Vulnerability Database (page 1129)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting via 'limit_session[count]'
Loginizer
≤1.7.8Update to 1.7.9
- Medium5.0Limited Server Side Request Forgery via 'formassembly' shortcode
WP-FormAssembly
<2.0.9Update to 2.0.9
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Advanced Woo Search – Product Search for WooCommerce
≤2.77Update to 2.78
- Medium6.1Reflected Cross-Site Scripting
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.0.4Update to 4.1
- Medium6.1Reflected Cross-Site Scripting
PPOM – Product Addons & Custom Fields for WooCommerce
≤32.0.6Update to 32.0.7
- Medium5.3Race Condition
Thumbs Rating
≤5.0.0No patch available
- Medium5.4Missing Authorization on 'make' function
Depicter — Popup & Slider Builder
≤1.9.0Update to 1.9.1
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via replace_plugin_list_tags
Plugins List
≤2.5Update to 2.5.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
User IP and Location
≤2.2Update to 2.2.1
- High7.2Authenticated (Admin+) PHP Object Injection
File Manager
≤5.2.7Update to 6.0
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery Slideshow & Masonry Tiled Gallery
≤1.0.13Update to 1.0.14
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
CM Search And Replace – Optimize content edits with a powerful search and replace tool
≤1.3.0Update to 1.3.1
- Medium6.1Unauthenticated Reflected Cross-Site Scripting via 'entrant'
Mass Email To Users
≤1.1.4Update to 1.1.5
- Medium6.0Authenticated (Subscriber+) CSV Injecton
Emails & Newsletters with Jackmail
≤1.2.22No patch available
- Medium4.3Missing Authorization
AJAX Thumbnail Rebuild
≤1.13Update to 1.14
- Medium6.1Reflected Cross-Site Scripting
Maintenance Switch
≤1.6.2Update to 1.6.3
- Medium5.4Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_display
WP Directory Kit
≤1.2.1Update to 1.2.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Search Analytics for WP – Site Search Tracking
≤1.4.5Update to 1.4.6
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting via wdk_resultitem
WP Directory Kit
≤1.1.9Update to 1.2.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP-CORS
≤0.2.1Update to 0.2.2
- Medium5.4Open Redirect
Zephyr Project Manager
≤3.3.9Update to 3.3.10
- Medium5.4Open Redirect
WP Directory Kit
≤1.1.9Update to 1.2.0
- High7.4Authenticated (Author+) Server-Side Request Forgery via URL
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
<2.10.24Update to 2.10.24
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
ClickFunnels
≤3.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting via 'message'
WP Inventory Manager
≤2.1.0.12Update to 2.1.0.13
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
WP BrowserUpdate
≤4.5Update to 4.6
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Order/Order Note Disclosure, Order Note Addition via REST API
WCFM – Multivendor Marketplace REST API for WooCommerce
≤1.5.3Update to 1.6.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Logo Scheduler – Great for holidays, events, and more
≤1.2.0Update to 1.2.1
- Medium6.1Reflected Cross-Site Scripting
Image Optimizer by 10web – Image Optimizer and Compression plugin
≤1.0.26Update to 1.0.27
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
SEO ALert
≤1.5.9No patch available