Database
WordPress Vulnerability Database (page 1131)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
NS Coupon To Become Customer
≤1.2.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodes
Rating-Widget: Star Review System
≤3.2.0Update to 3.2.1
- High8.8Authenticated (Subscriber+) SQL Injection via id
Ultra Addons for Contact Form 7
≤3.1.23Update to 3.1.24
- Medium5.5Authenticated(Administrator+) Stored Cross-Site Scripting
Advanced Youtube Channel Pagination
≤1.0No patch available
- Medium5.5Cross-Site Request Forgery to Reflected Cross-Site Scripting
Advanced Youtube Channel Pagination
≤1.0No patch available
- Medium6.6Authenticated(Administrator+) SQL Injection
HTTP Headers
≤1.18.8Update to 1.18.9
- Medium6.1Reflected Cross-Site Scripting
Extensions for Leaflet Map
≤3.4.1Update to 3.4.2
- Medium6.1Reflected Cross-Site Scripting via page parameter
XML for Google Merchant Center
≤3.0.1Update to 3.0.2
- High7.1Cross-Site Request Forgery via Multiple Functions
Inactive User Deleter
≤1.59Update to 1.60
- Medium4.3Cross-Site Request Forgery via wpbu_administration
WP BrowserUpdate
≤4.4.1Update to 4.5
- High7.2Authenticated (Administrator+) SQL Injection via 'order' and 'orderby'
BSK Forms Blacklist
≤3.6.2Update to 3.6.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
CRM Memberships
≤2.2Update to 2.5
- Medium4.3Cross-Site Request Forgery via wp_page_numbers_settings
WP Page Numbers
≤0.5No patch available
- Medium4.3Cross-Site Request Forgery via video_sitemap_generate
Video XML Sitemap Generator
≤1.0.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Decon WP SMS
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting via 'title'
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.6.21Update to 3.6.22
- Medium6.6Authenticated(Administrator+) SQL Injection via 'replace_urls'
Elementor Website Builder – more than just a page builder
<3.12.2Update to 3.12.2
- Medium6.1Reflected Cross-Site Scripting via page parameter
Stock Sync for WooCommerce
≤2.4.0Update to 2.4.1
- Medium5.5Authenticated (Shop manager+) Stored Cross-Site Scripting via plugin settings
Woocommerce Tip/Donation
≤1.2No patch available
- Medium6.5Missing Authorization via vg_display_data shortcode
Display custom fields in the frontend – Post and User Profile Fields
≤1.2.0Update to 1.2.1
- Medium6.1Reflected Cross-Site Scripting via 's' parameter
Recipe Cards For Your Food Blog from Zip Recipes
<8.0.7Update to 8.0.7
- Medium6.1Stored Cross-Site Scripting via Cross-Site Request Forgery in _form.php
Advanced Category Template
≤0.1No patch available
- Critical9.8Unauthenticated SQL Injection
WP Visitor Statistics (Real Time Traffic)
≤6.8.1Update to 6.9
- Medium6.1Reflected Cross-Site Scripting
Push Notifications for WordPress by PushAssist
≤3.0.8No patch available
- Medium6.1Reflected Cross-Site Scripting via 'backup_timestamp'
Updraft
≤0.6.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via tippy shortcode
Tippy
≤6.2.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Image Optimizer by 10web – Image Optimizer and Compression plugin
≤1.0.26Update to 1.0.27
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Cab Grid
≤1.5.15Update to 1.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
eRocket
≤1.2.4Update to 1.2.5
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via esrcpt_slider_allow_iframes_filter
Easy Slider
≤1.0.0Update to 1.1.0