Database
WordPress Vulnerability Database (page 1140)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization via clean_ajx
qTranslate X Cleanup and WPML Import
≤3.0.1Update to 3.0.2
- Medium4.3Cross-Site Request Forgery via clean_ajx
qTranslate X Cleanup and WPML Import
≤3.0.1Update to 3.0.2
- Medium4.3Missing Authorization in 'wpfc_clear_cache_of_allsites_callback'
WP Fastest Cache – WordPress Cache Plugin
≤1.1.2Update to 1.1.3
- High8.8Authenticated (Contributor+) SQL Injection via get_maps
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
≤2.85.4Update to 2.85.5
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via Listing Fields
IMPress Listings
≤2.6.2No patch available
- Medium5.4Cross-Site Request Forgery via get
ShiftController Employee Shift Scheduling
≤4.9.23Update to 4.9.24
- Medium4.3Missing Authorization via spbsmAjax
Superb Social Media Share Buttons and Follow Buttons
≤1.1.3Update to 1.1.5
- High7.2Unauthenticated Stored Cross-Site Scripting
Limit Login Attempts
≤1.7.1Update to 1.7.2
- Medium4.3Cross-Site Request Forgery via spbsmAjax
Superb Social Media Share Buttons and Follow Buttons
≤1.1.3Update to 1.1.5
- Medium4.3Cross-Site Request Forgery via 'wpfc_purgecache_varnish_callback'
WP Fastest Cache – WordPress Cache Plugin
≤1.1.2Update to 1.1.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Maps Widget for Google Maps
≤4.24Update to 4.25
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
SimpleModal Contact Form (SMCF)
≤1.2.9No patch available
- Medium4.4Hustle <= 7.6.4 = Authenticated (Administrator+) Stored Cross-Site Scripting
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤7.6.4Update to 7.6.6
- High7.2Authenticated (Administrator+) SQL Injection via orderby
Transbank Webpay
≤1.6.6Update to 1.6.7
- Medium4.3Cross-Site Request Forgery via 'wpfc_start_cdn_integration_ajax_request_callback'
WP Fastest Cache – WordPress Cache Plugin
≤1.1.2Update to 1.1.3
- Medium4.3Missing Authorization in 'wpfc_purgecache_varnish_callback'
WP Fastest Cache – WordPress Cache Plugin
≤1.1.2Update to 1.1.3
- Medium4.3Cross-Site Request Forgery via 'wpfc_preload_single_callback'
WP Fastest Cache – WordPress Cache Plugin
≤1.1.2Update to 1.1.3
- Medium4.3Missing Authorization via init
Dynamics 365 Integration
≤1.3.13Update to 1.3.14
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Optin Forms – Simple List Building Plugin for WordPress
≤1.3.2Update to 1.3.3
- Medium6.1Reflected Cross-Site Scripting
The7 — Website and eCommerce Builder for WordPress
≤11.6.0Update to 11.6.1
- Medium4.3Cross-Site Request Forgery via 'wpfc_preload_single_save_settings_callback'
WP Fastest Cache – WordPress Cache Plugin
≤1.1.2Update to 1.1.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Tiny carousel horizontal slider plus
≤3.2No patch available
- Medium4.3Cross-Site Request Forgery via 'wpfc_clear_cache_of_allsites_callback'
WP Fastest Cache – WordPress Cache Plugin
≤1.1.2Update to 1.1.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
PiWeb Cancel order / Refund request for WooCommerce
≤1.3.2Update to 1.3.3
- Medium6.1Reflected Cross-Site Scripting
TheRoof
≤1.0.3Update to 1.0.4
- Critical9.8Unauthenticated PHP Object Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤6.1.2Update to 6.2
- Medium4.3Missing Authorization in 'wpfc_preload_single_callback'
WP Fastest Cache – WordPress Cache Plugin
≤1.1.2Update to 1.1.3
- Critical9.8Unauthenticated SQL Injection
Houzez
<2.8.3Update to 2.8.3
- Medium4.3Cross-Site Request Forgery
Spreadshop Plugin
≤1.6.5Update to 1.6.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
IFrame Shortcode
≤1.0.5Update to 1.0.6