Database
WordPress Vulnerability Database (page 1135)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Video Grid
≤1.21Update to 1.22
- Medium6.1Reflected Cross-Site Scripting
Video Grid
≤1.21Update to 1.22
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Panorama – WordPress Project Management Plugin
≤1.5Update to 1.5.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings
Blazeo
≤1.3.1Update to 1.3.2
- Medium4.3Missing Authorization leading to Authenticated (Subscriber+) Image Upload
OoohBoi Steroids for Elementor
≤2.1.4Update to 2.1.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via qrCode attribute
Kaya QR Code Generator
≤1.5.2Update to 1.5.3
- Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
PublishPress Taxonomies – Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms
≤3.6.4Update to 3.6.5
- Medium4.3Cross-Site Request Forgery to Designation Deletion
Clock In Portal- Staff & Attendance Management
≤2.1No patch available
- Medium4.3Cross-Site Request Forgery via save
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤4.0.6Update to 4.0.7
- Medium6.1Reflected Cross-Site Scripting
Helpie FAQ — Accordion, Docs & Knowledge Base
≤1.9.8Update to 1.9.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Custom Author URL
<1.0.5Update to 1.0.5
- Medium4.3Cross-Site Request Forgery to Holidays Deletion
Clock In Portal- Staff & Attendance Management
≤2.1No patch available
- Medium4.3Cross-Site Request Forgery To Staff Deletion
Clock In Portal- Staff & Attendance Management
≤2.1No patch available
- Medium4.3Cross-Site Request Forgery
Zendesk Support for WordPress
≤1.8.4Update to 1.8.5
- Medium5.4Missing Authorization
Sokol: Smart WooCommerce Search
≤2.5.0Update to 2.5.1
- Medium4.3Cross-Site Request Forgery to folder management
WP Docs
≤1.9.8Update to 1.9.9
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Captcha Them All
<1.4Update to 1.4
- Medium6.1Reflected Cross-Site Scripting
Church Admin
≤3.7.5Update to 3.7.6
- Medium5.5Authenticated (Editor+) Stored Cross-Site Scripting
PublishPress Taxonomies – Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms
≤3.6.4Update to 3.6.5
- Medium5.3Maintenance Mode Bypass
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
≤4.1.7Update to 4.1.8
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Pretty Url
<1.5.5Update to 1.5.5
- Medium4.3Missing Authorization via template_count
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤4.0.6Update to 4.0.7
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
YourChannel: Everything you want in a YouTube plugin.
≤1.2.5Update to 1.2.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
BBSpoiler
≤2.01Update to 2.02
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WP-FormAssembly
≤2.0.7Update to 2.0.8
- Medium4.3Cross-Site Request Forgery
BadgeOS
≤3.7.1.6No patch available
- Medium4.3Missing Authorization via templates
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
≤4.0.6Update to 4.0.7
- High7.5Cross-Site Request Forgery and PHAR Deserialization
Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
≤5.3.1Update to 5.4.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Semalt Blocker
≤1.1.3No patch available
- Medium6.1Reflected Cross-Site Scripting
Responsive Thumbnail Slider
<1.1.10Update to 1.1.10