Database
WordPress Vulnerability Database (page 1134)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Subscriber+) SQL Injection
Accessibility Suite by Ability, Inc
≤4.11Update to 4.12
- High7.2Authenticated (Editor+) Stored Cross-Site Scripting
Help Desk WP
≤1.2.0No patch available
- High7.2Authenticated (Administrator+) SQL Injection via *_selected
Booking calendar, Appointment Booking System
≤3.2.6Update to 3.2.7
- Medium4.3Cross-Site Request Forgery
Woocommerce Products Designer by ORION – online product customizer for t-shirts, print cards, phone cases Lettering & Decals
≤4.3.3No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Category Specific RSS feed Subscription
≤2.2Update to 2.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
White Label Branding for Elementor Page Builder
≤1.0.2No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WP Cerber Security, Anti-spam & Malware Scan
≤9.1Update to 9.2
- Medium4.3Cross-Site Request Forgery
Kodex Posts likes
≤2.4.3Update to 2.5.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Simple Tooltips
≤2.1.4No patch available
- Medium4.3Cross-Site Request Forgery
SiteAlert (Formerly WP Health)
≤1.9.7Update to 1.9.8
- Medium4.3Cross-Site Request Forgery
Simple Share Buttons Adder
≤8.4.6Update to 8.4.7
- Medium6.5Missing Authorization via ebook_store_export_orders
Ebook Store
≤5.775Update to 5.78
- Medium6.1Authenticated (Level 8/Administrator+) Stored Cross-Site Scripting
RapidExpCart
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting via date_post_id
Property Hive
≤1.5.48Update to 1.5.49
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via file_gallery_shortcode
File Gallery
≤1.8.5.3Update to 1.8.5.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via fcb shortcode
FormCraft – Form Builder
≤1.2.9Update to 1.2.10
- Medium6.1Reflected Cross-Site Scripting via page parameter
Query Wrangler
≤1.5.51Update to 1.5.52
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
I Recommend This – Love/Like Button for WordPress Posts
≤3.8.3Update to 3.9.0
- Medium6.1Reflected Cross-Site Scripting
Stock Exporter for WooCommerce
≤1.1.0Update to 1.2.0
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
RapidExpCart
≤1.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Continuous announcement scroller
≤13.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
WP-dTree
≤4.4.5Update to 4.5.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Blazeo
≤1.3.1Update to 1.3.2
- Medium4.3Cross-Site Request Forgery via save
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤4.0.6Update to 4.0.7
- Medium6.1Reflected Cross-Site Scripting
Video Grid
≤1.21Update to 1.22
- Medium4.3Missing Authorization via templates
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤4.0.6Update to 4.0.7
- Medium6.1Reflected Cross-Site Scripting
Video Grid
≤1.21Update to 1.22
- Medium5.3Maintenance Mode Bypass
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
≤4.1.7Update to 4.1.8
- Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
PublishPress Taxonomies – Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms
≤3.6.4Update to 3.6.5
- Medium4.3Missing Authorization leading to Authenticated (Subscriber+) Image Upload
OoohBoi Steroids for Elementor
≤2.1.4Update to 2.1.5