Database
WordPress Vulnerability Database (page 1137)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting via wp_lang
WPML Multilingual CMS
≤4.6.0Update to 4.6.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Roles at Registration
≤0.23No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Article Directory Redux
≤1.0.2No patch available
- High7.2Reflected Cross-Site Scripting
Paytm Payment Donation
≤2.2.0Update to 2.2.1
- Medium4.3Missing Authorization via activate_plugin
Educenter
≤1.5.7Update to 1.5.8
- High7.2Authenticated (Administrator+) SQL Injection
WP Reroute Email
≤1.4.6Update to 1.4.8
- Medium6.1Reflected Cross-Site Scripting
AdFoxly – Ad Manager, AdSense Ads & Ads.txt
≤1.8.4No patch available
- Medium4.3Cross-Site Request Forgery via admin_page
Database Collation Fix
≤1.2.7Update to 1.2.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Motor Racing League
≤1.9.9No patch available
- Medium4.3Cross-Site Request Forgery
WP Reroute Email
≤1.4.6Update to 1.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Affiliate Links – Link Cloaking and Management
≤2.6Update to 2.7
- Medium6.1Reflected Cross-Site Scripting via 'view' and 'page'
Vimeotheque – Vimeo WordPress Plugin & Video Gallery
≤2.2.1Update to 2.2.2
- Medium5.4Cross-Site Request Forgery
Custom Order Numbers for WooCommerce
≤1.4.0Update to 1.4.1
- Medium6.1Multiple Cross-Site Scripting
Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
≤1.7.0Update to 1.7.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
External Videos
≤2.0.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Optima Express IDX
≤7.3.0Update to 7.3.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Booqable Rental Plugin
≤2.4.15Update to 2.4.16
- Medium4.3Cross-Site Request Forgery
WP Easy Pay – Payment and Donation Form Builder for Square
≤4.0.4Update to 4.1
- Critical9.8Authentication Bypass
ZM Ajax Login & Register
≤2.0.2No patch available
- Medium5.3Missing Authorization
Shortcodes by Angie Makes
≤3.46No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Electric Studio Client Login
≤0.8.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Easy Appointments
≤3.11.0Update to 3.11.1
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via url parameter
Kaya QR Code Generator
≤1.5.2Update to 1.5.3
- Medium6.1Reflected Cross-Site Scripting via Query String
ShiftController Employee Shift Scheduling
≤4.9.25Update to 4.9.26
- Medium5.3Missing Authorization via update_setting_fantastic_content_protector
Fantastic Content Protector Free
≤2.6No patch available
- Medium4.3Missing Authorization via activate_plugin
Square
≤2.0.0Update to 2.0.1
- Medium4.3Cross-Site Request Forgery
CoSchedule
≤3.3.8Update to 3.3.9
- Medium6.1Reflected Cross-Site Scripting
Betheme
≤26.7.5Update to 26.8
- High8.8Authenticated SQL Injection
Cyr to Lat Enhanced
≤3.5Update to 3.7
- High7.2Local File Inclusion via 'lpp_template_select'
Landing Page Builder – Free Landing Page Templates
≤3.1.9.8Update to 3.2