Database
WordPress Vulnerability Database (page 1141)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unauthenticated SQL Injection
Houzez
<2.8.3Update to 2.8.3
- Medium6.1Reflected Cross-Site Scripting
Product Catalog Simple
<1.7.0Update to 1.7.0
- Medium4.3Cross-Site Request Forgery via 'deleteCssAndJsCacheToolbar'
WP Fastest Cache – WordPress Cache Plugin
≤1.1.2Update to 1.1.3
- Medium6.1Reflected Cross-Site Scripting via url
MyCryptoCheckout – Bitcoin, Ethereum, and 100+ altcoins for WooCommerce
≤2.123Update to 2.124
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Optin Forms – Simple List Building Plugin for WordPress
≤1.3.2Update to 1.3.3
- Medium4.3Missing Authorization in 'wpfc_preload_single_callback'
WP Fastest Cache – WordPress Cache Plugin
≤1.1.2Update to 1.1.3
- Medium5.4Cross-Site Request Forgery to Plugin Settings Change
YourChannel: Everything you want in a YouTube plugin.
≤1.2.4Update to 1.2.5
- Medium6.5Missing Authorization to Plugin Cache Reset
YourChannel: Everything you want in a YouTube plugin.
≤1.2.3Update to 1.2.4
- Medium6.3Cross-Site Request Forgery
WCFM – Frontend Manager for WooCommerce
≤6.5.13Update to 6.6.0
- Medium5.4Cross-Site Request Forgery to Plugin Channel Reset
YourChannel: Everything you want in a YouTube plugin.
≤1.2.4Update to 1.2.5
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
StagTools
≤2.3.6Update to 2.3.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Site Reviews
≤6.7.0Update to 6.7.1
- Medium6.3Cross-Site Request Forgery
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.4.12Update to 3.5.0
- Medium6.3Cross-Site Request Forgery
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.9.10Update to 2.10.0
- Medium6.3Insufficient Authorization on Mulitple AJAX Actions
Fancy Product Designer
≤4.6.9Update to 4.7.0
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name
Weaver Xtreme
≤5.0.7Update to 6.2
- Medium4.3Cross-Site Request Forgery
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce
≤12.4.4Update to 12.4.5
- Medium4.3Cross-Site Request Forgery to Plugin Language Translation Update
YourChannel: Everything you want in a YouTube plugin.
≤1.2.4Update to 1.2.5
- Medium6.3Missing Authorization
WCFM – Frontend Manager for WooCommerce
6.6.0 – 6.6.0Update to 6.6.1
- High8.8Insufficient Authorization to Arbitrary Options Update via fpd_update_options
Fancy Product Designer
≤4.6.9Update to 4.7.0
- Medium5.4Cross-Site Request Forgery to Plugin Language Translation Reset
YourChannel: Everything you want in a YouTube plugin.
≤1.2.4Update to 1.2.5
- High7.3Missing Authorization
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.10.0Update to 2.10.1
- High8.8Missing Authorization
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.4.11Update to 3.4.12
- Medium6.6Authenticated (Administrator+) PHP Object Injection
SEOPress – AI SEO Plugin & On-site SEO
≤6.5.0.2Update to 6.5.0.3
- Medium6.5Missing Authorization to Plugin Settings Reset
YourChannel: Everything you want in a YouTube plugin.
≤1.2.3Update to 1.2.4
- Critical9.8Unauthenticated Privilege Escalation
WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
≤2.10.0Update to 2.10.1
- Medium4.3Cross-Site Request Forgery
Comment Reply Notification
≤1.4No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Sp*tify Play Button for WordPress
≤2.07Update to 2.08
- Medium5.3Sensitive Information Exposure
Libsyn Publisher Hub
≤1.3.2Update to 1.4.1
- Medium6.1Reflected Cross-Site Scripting
outdoor
≤3.9.6Update to 3.9.7