Database
WordPress Vulnerability Database (page 1133)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
I Recommend This – Love/Like Button for WordPress Posts
≤3.8.3Update to 3.9.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
SparkPost
≤3.2.7Update to 3.2.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WP Links Page
≤4.9.1Update to 4.9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via fcb shortcode
FormCraft – Form Builder
≤1.2.9Update to 1.2.10
- Medium6.1Reflected Cross-Site Scripting via page parameter
Query Wrangler
≤1.5.51Update to 1.5.52
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Simple Tooltips
≤2.1.4No patch available
- Medium6.1Authenticated (Level 8/Administrator+) Stored Cross-Site Scripting
RapidExpCart
≤1.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
EZP Maintenance Mode
≤1.0.1No patch available
- Medium4.3Cross-Site Request Forgery via gallery_remove
Gallery Metabox
≤1.5No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
RapidExpCart
≤1.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
WP-dTree
≤4.4.5Update to 4.5.0
- High8.8Authenticated (Subscriber+) SQL Injection
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema
≤1.6.8Update to 1.6.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Yatra – Travel Booking & Tour Operator Software
≤2.1.14Update to 2.1.15
- Medium5.4Cross-Site Request Forgery via Multiple Functions
Motors – Car Dealership & Classified Listings Plugin
≤1.4.5Update to 1.4.6
- Medium4.3Directory Traversal to Information Exposure
Image Optimizer by 10web – Image Optimizer and Compression plugin
<1.0.26Update to 1.0.26
- High7.2Authenticated (Administrator+) SQL Injection
The School Management – Education & Learning ERP
≤4.1Update to 4.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Ebook Store
<5.78Update to 5.78
- Medium4.3Cross-Site Request Forgery via album-gallery-column-settings.php
Album Gallery for Photo & Video
≤1.4.9Update to 1.5.0
- Medium4.3Cross-Site Request Forgery via save_slide_ajax
Layer Slider
≤1.1.9.7No patch available
- High7.2Authenticated (Administrator+) SQL Injection
Shortcode IMDB
≤6.0.8No patch available
- Medium6.1Reflected Cross-Site Scripting via tab parameter
WCP Contact Form
≤3.1.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via uji_popup_code shortcode
Uji Popup
≤1.4.3No patch available
- High7.2Authenticated (Admin+) PHP Object Injection
Ad Inserter – Ad Manager & AdSense Ads
≤2.7.25Update to 2.7.26
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Login Page Styler – Custom WordPress Login Page Customizer & Security
≤6.2Update to 6.2.5
- Critical9.8Unauthenticated SQL Injection
Email posts to subscribers
≤6.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.7.0.10Update to 1.7.0.11
- Medium4.3Cross-Site Request Forgery to Settings Update
LIQUID SPEECH BALLOON
≤1.1.8Update to 1.2
- Medium6.1Reflected Cross-Site Scripting
Google Analytics Top Content Widget
≤1.5.5Update to 1.5.6
- Medium6.3Cross-Site Request Forgery
vSlider Multi Image Slider for WordPress
≤4.1.2No patch available
- Medium5.3Unauthenticated Information Disclosure
Active Directory Integration / LDAP Integration
≤4.1.0Update to 4.1.1