Database
WordPress Vulnerability Database (page 1136)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
f(x) TOC
≤1.1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Membership Database
≤1.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Custom Post Type List Shortcode
≤1.4.4No patch available
- Medium6.1Reflected Cross-Site Scripting
YML for Yandex Market
<3.10.8Update to 3.10.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Mega Addons For WPBakery Page Builder
≤4.2.7Update to 4.3.0
- High8.8Authenticated (Subscriber+) SQL Injection
Avirato hotels online booking engine
≤5.0.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate Carousel For Elementor
≤2.17No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Popups – WordPress Popup builder
≤2.1.5Update to 2.1.5.1
- Critical9.8Unauthenticated SQL Injection
Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop
≤1.7.2Update to 1.7.3
- High8.8Authenticated (Contributor+) SQL Injection via cntctfrmtdb_department
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
≤1.7.0Update to 1.7.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Ultimate Carousel For WPBakery Page Builder
≤2.6No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Sloth Logo Customizer
≤2.0.2No patch available
- High7.2Authenticated (Administrator+) SQL Injection
NEX-Forms – Ultimate Forms Plugin for WordPress
≤8.3.3Update to 8.4
- Medium6.1Reflected Cross-Site Scripting
Responsive Thumbnail Slider
≤1.1.9Update to 1.1.10
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Post Shortcode
≤2.0.9No patch available
- Medium6.1Reflected Cross-Site Scripting
Japanized for WooCommerce
≤2.5.6Update to 2.5.7
- Medium5.4Open Redirect
Freshdesk (official)
1.7 – 1.7Update to 1.8
- Medium6.1Reflected Cross-Site Scripting
Responsive Filterable Portfolio Gallery – Media Grid & Video Portfolio
≤1.0.19Update to 1.0.20
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Locatoraid Store Locator
≤3.9.14Update to 3.9.15
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
PowerPress Podcasting plugin by Blubrry
≤10.0.1Update to 10.0.2
- Medium5.3Interpretation Conflict
WP Offload SES Lite
<1.6.4Update to 1.6.4
- Medium6.1Reflected Cross-Site Scripting via ‘td_video_url’
tagDiv Composer
<4.0Update to 4.0
- Medium4.3Enable/Disable Auto Login when Register <= 1.1.0 Cross-Site Request Forgery
Enable/Disable Auto Login when Register
≤1.1.0No patch available
- Medium5.4Export/Import Courses <= 4.0.2 - Reflected Cross-Site Scripting
LearnPress – Backup & Migration Tool
<4.0.3Update to 4.0.3
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Meta Keys
Product Slider For WooCommerce Lite
≤1.1.7No patch available
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
WP Login Box
≤2.0.2No patch available
- Medium6.1Reflected Cross-Site Scripting via wedp_duplicated
Easy Duplicate Product for WooCommerce
≤0.3.0.0Update to 0.3.0.1
- High7.2Authenticated (Admin+) SQL Injection
Video List Manager
≤1.7No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Wp-D3
≤2.4.1No patch available
- Critical9.8Unauthenticated SQL Injection
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤8.1.4Update to 8.1.5