Database
WordPress Vulnerability Database (page 1138)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization via activate_plugin
Blogger Buzz
≤1.2.4Update to 1.2.5
- Medium6.5Missing Authorization
Stamped.io Product Reviews & UGC for WooCommerce
≤2.3.2Update to 2.3.3
- Medium6.1Reflected Cross-Site Scripting via 'question'
Watu Quiz
≤3.3.9.2Update to 3.3.9.3
- Medium4.3Cross-Site Request Forgery via route
PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
≤3.4.0Update to 3.4.1
- High8.8Authenticated SQL Injection
Cyr to Lat Enhanced
≤3.5Update to 3.7
- Medium6.1Reflected Cross-Site Scripting
Betheme
≤26.7.5Update to 26.8
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via url parameter
Kaya QR Code Generator
≤1.5.2Update to 1.5.3
- Medium4.3Cross-Site Request Forgery
Enable Accessibility
≤1.4Update to 1.4.1
- Medium5.3Missing Authorization via update_setting_fantastic_content_protector
Fantastic Content Protector Free
≤2.6No patch available
- Medium6.1Reflected Cross-Site Scripting via Query String
ShiftController Employee Shift Scheduling
≤4.9.25Update to 4.9.26
- Medium6.5Unauthenticated CSV Injection
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema
≤1.6.7Update to 1.6.8
- Medium6.1Reflected Cross-Site Scripting
FooGallery Photo Gallery : Image, Video & Masonry Galleries
≤2.2.35Update to 2.2.41
- Medium4.3Missing Authorization via activate_plugin
Square
≤2.0.0Update to 2.0.1
- Medium4.3Cross-Site Request Forgery
CoSchedule
≤3.3.8Update to 3.3.9
- High7.2Local File Inclusion via 'lpp_template_select'
Landing Page Builder – Free Landing Page Templates
≤3.1.9.8Update to 3.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Simple PopUp
≤1.8.6No patch available
- Medium5.4Cross-Site Request Forgery
Newsletters
≤4.8.8Update to 4.8.9
- Medium6.5Unauthenticated Stored Cross-Site Scripting in Admin Dashboard
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤4.4.8Update to 4.4.9
- Critical9.8Unauthenticated PHP Object Injection via Cookies
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤4.4.6Update to 4.4.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via openai_settings_option_callback
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤4.4.8Update to 4.4.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WPBot – AI ChatBot for WordPress & Growth Suite: SEO, AI Writer, Email Marketing, Social Media
≤4.4.9Update to 4.5.1
- Medium4.3Missing Authorization on 'load_hcaptcha_preview' AJAX function
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.22.1Update to 1.23.3
- Medium6.1Reflected Cross-Site Scripting via 'message'
WP Inventory Manager
≤2.1.0.11Update to 2.1.0.12
- Medium6.1Reflected Cross-Site Scripting
Cloud Manager
≤1.0No patch available
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Pickup | Delivery | Dine-in date time
≤1.0.9No patch available
- Medium4.3Missing Authorization on 'load_recaptcha_preview' AJAX function
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.22.1Update to 1.23.3
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
User registration & user profile – UserPlus
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
hiWeb Migration Simple
≤2.0.0.1No patch available
- Medium4.3Missing Authorization on 'hubspot_support_request' AJAX function
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
≤1.22.1Update to 1.23.3
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
PowerPress Podcasting plugin by Blubrry
≤10.0Update to 10.0.2