Database
WordPress Vulnerability Database (page 1130)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated(Administrator+) Stored Cross-Site Scripting
SEO ALert
≤1.5.9No patch available
- Medium6.1Reflected Cross-Site Scripting via 'message'
WP Inventory Manager
≤2.1.0.12Update to 2.1.0.13
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
ClickFunnels
≤3.1.1No patch available
- High8.2Reflected Cross-Site Scripting
Thumbnail Slider With Lightbox
≤1.0.17Update to 1.0.18
- Medium6.1Reflected Cross-Site Scripting
Arya Multipurpose
≤1.0.5No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning
<17.0.18Update to 17.0.18
- Medium6.1Cross-Site Scripting
Viable Blog
≤1.1.4No patch available
- Medium5.4Cross-Site Request Forgery to Shortcode Deletion
Tiempo.com
≤0.1.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Ko-fi Button
≤1.3.2Update to 1.3.3
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Critical CSS Rules
Autoptimize
≤3.1.6Update to 3.1.7
- High8.8Yet Another Related Posts Plugin <= 5.30.2 - Authenticated (Subscriber+) SQL Injection via Shortcode
YARPP – Yet Another Related Posts Plugin
<5.30.3Update to 5.30.3
- Medium6.1Reflected Cross-Site Scripting
Everest News
≤1.1.0No patch available
- Critical9.8Unauthenticated SQL Injection
Custom 404 Pro
<3.7.3Update to 3.7.3
- Medium4.3Missing Authorization via load_alerts_settings
Stream – Activity Log & Audit Trail
<3.9.3Update to 3.9.3
- Medium6.1Reflected Cross-Site Scripting
Vertical Image Slider – Responsive Thumbnail Slider with Lightbox
≤1.2.16Update to 1.2.17
- High7.2Authenticated (Administrator+) PHP Object Injection
Customizer Export/Import
≤0.9.5Update to 0.9.6
- Critical9.8Unauthenticated SQL Injection via 's'
Custom 404 Pro
≤3.8.0Update to 3.8.1
- Medium6.1Cross-Site Scripting
Mocho Blog
≤1.0.4No patch available
- Medium6.4Authenticated (Subscriber+) Media Attachment Deletion
REST API TO MiniProgram
≤4.7.7No patch available
- Medium5.4Cross-Site Request Forgery to Stored Cross-Site Scripting
Tiempo.com
≤0.1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Tiempo.com
≤0.1.2No patch available
- Medium6.1Reflected Cross-Site Scripting in UX Builder
Flatsome
≤3.16.8Update to 3.17.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
URL Params
≤2.4Update to 2.5
- Medium4.3Missing Authorization
Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning
<17.0.18Update to 17.0.18
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Arconix Shortcodes
≤2.1.7Update to 2.1.8
- Medium6.1Reflected Cross-Site Scripting
Extensions for Leaflet Map
≤3.4.1Update to 3.4.2
- Medium5.4Cross-Site Request Forgery
Simple Giveaways – Grow your business, email lists and traffic with contests
≤2.46Update to 2.46.1
- Medium4.3Cross-Site Request Forgery via plugin_settings_page
Chronosly Events Calendar
≤2.6.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
NS Coupon To Become Customer
≤1.2.2No patch available
- Medium5.5Cross-Site Request Forgery to Reflected Cross-Site Scripting
Advanced Youtube Channel Pagination
≤1.0No patch available