Database
WordPress Vulnerability Database (page 1139)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
PowerPress Podcasting plugin by Blubrry
≤10.0Update to 10.0.2
- Critical9.8Unauthenticated SQL Injection via parse_user_filters
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
≤3.1.4Update to 3.1.5
- Medium6.4Authenticated(Subscriber+) Stored Cross-Site Scripting
Limit Login Attempts
≤1.7.1Update to 1.7.2
- Medium6.1Reflected Cross-Site Scripting via 'page'
Product Catalog Feed by PixelYourSite
≤2.1.0Update to 2.1.1
- Medium4.3Cross-Site Request Forgery
tencentcloud-cos
≤1.0.7No patch available
- Medium4.3Cross-Site Request Forgery
Better Search – Relevant search results for WordPress
≤3.1.0Update to 3.2.0
- Medium4.3Missing Authorization to Arbitrary Ticket Modification
Ruby Help Desk
≤1.3.3Update to 1.3.4
- Medium4.3Authenticated(Subscriber+) Sensitive Information Exposure via blocksy_posts shortcode
Blocksy Companion
≤1.8.81Update to 1.8.82
- Medium6.1Reflected Cross-Site Scripting via 'edit'
Product Catalog Feed by PixelYourSite
≤2.1.0Update to 2.1.1
- Medium4.3Cross-Site Request Forgery
MoreConvert Wishlist for WooCommerce
≤1.5.4Update to 1.5.5
- Medium5.3Unauthenticated Information Disclosure
Download Manager
4.0 – <6.3.0Update to 6.3.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
a3 Portfolio
≤3.1.0Update to 3.1.1
- Medium4.3Cross-Site Request Forgery via sjb_save_settings_section
Simple Job Board
≤2.10.3Update to 2.10.4
- Medium4.3Cross-Site Request Forgery
PixTypes
≤1.4.14Update to 1.4.15
- Medium6.5Missing Authorization to Unauthenticated Registered User Deletion
Front End Users
≤3.2.24Update to 3.2.25
- Medium6.1Reflected Cross-Site Scripting
Email Subscription Popup — Newsletter & GDPR Consent
<1.2.17Update to 1.2.17
- Medium4.3Cross-Site Request Forgery
Comments Ratings
≤1.1.6Update to 1.1.7
- Medium4.3Cross-Site Request Forgery
Front End Users
≤3.2.24Update to 3.2.25
- Medium4.3Cross-Site Request Forgery via 'wpfc_purgecache_varnish_callback'
WP Fastest Cache – WordPress Cache Plugin
≤1.1.2Update to 1.1.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Maps Widget for Google Maps
≤4.24Update to 4.25
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Listing Fields
IMPress Listings
≤2.6.2No patch available
- Medium5.4Cross-Site Request Forgery via get
ShiftController Employee Shift Scheduling
≤4.9.23Update to 4.9.24
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
SimpleModal Contact Form (SMCF)
≤1.2.9No patch available
- Medium4.3Cross-Site Request Forgery via spbsmAjax
Superb Social Media Share Buttons and Follow Buttons
≤1.1.3Update to 1.1.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Limit Login Attempts
≤1.7.1Update to 1.7.2
- Medium4.4Hustle <= 7.6.4 = Authenticated (Administrator+) Stored Cross-Site Scripting
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤7.6.4Update to 7.6.6
- Medium4.3Missing Authorization via spbsmAjax
Superb Social Media Share Buttons and Follow Buttons
≤1.1.3Update to 1.1.5
- Medium4.3Missing Authorization to Cache Deletion
WP Fastest Cache – WordPress Cache Plugin
≤1.1.2Update to 1.1.3
- High7.5Authenticated (Subscriber+) Privilege Escalation
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤5.3.7Update to 5.3.8
- Medium4.3Missing Authorization via AJAX actions
tencentcloud-cos
≤1.0.7No patch available