Database
WordPress Vulnerability Database (page 1142)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Sp*tify Play Button for WordPress
≤2.07Update to 2.08
- Medium4.3Cross-Site Request Forgery
Comment Reply Notification
≤1.4No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
CopySafe Web Protection – Copy Protect Images
≤3.13Update to 3.14
- High7.2Unauthenticated Stored Cross-Site Scripting
Steveas WP Live Chat Shoutbox
≤1.4.2No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP FEvents Book
≤0.46No patch available
- Medium4.3Missing Authorization via wp_ajax_stm_wpcfto_get_settings
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤2.9.34Update to 2.9.35
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
SMTP Mailing Queue
≤1.4.7Update to 2.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Generate Images (AI) – Magic Post Thumbnail
≤4.1.10Update to 4.1.11
- Medium6.1Reflected Cross-Site Scripting via 'merge_ids'
Property Hive
≤1.5.46Update to 1.5.47
- Medium6.1Reflected Cross-Site Scripting
Albo Pretorio On line
≤4.6.1Update to 4.6.2
- High8.8Authenticated (Contributor+) PHP Object Injection
Advanced Custom Fields (ACF®)
≤6.0.7Update to 5.12.5 or 6.1.0
- Medium6.1Reflected Cross-Site Scripting
Ajax Search Pro
≤4.26.1Update to 4.26.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
PiWeb Product Enquiry or product catalog for WooCommerce
≤2.2.12Update to 2.2.13
- Medium5.4Authenticated (Subscriber+) SQL Injection
Random Text
≤0.3.0No patch available
- Critical9.8Unauthenticated SQL Injection
Steveas WP Live Chat Shoutbox
≤1.4.2No patch available
- High7.2Reflected Cross-Site Scripting
Ajax Search Lite – Live Search & Filter
≤4.11Update to 4.11.1
- Medium4.7Cross-Site Request Forgery
WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager
≤2.0.8Update to 2.0.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Product page shipping calculator for WooCommerce
≤1.3.20Update to 1.3.21
- Medium6.3Authenticated (Subscriber+) Insecure Direct Object Reference to Booking Manipulation
WP FEvents Book
≤0.46Update to 0.47
- Medium4.3Cross-Site Request Forgery via plugin_activation
HT Builder – WordPress Theme Builder for Elementor
≤1.2.9Update to 1.3.0
- Medium6.5Cross-Site Request Forgery via runAction
Premmerce
≤1.3.18Update to 1.3.19
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Display Name
Weaver Show Posts
≤1.6Update to 1.7
- Medium4.3Cross-Site Request Forgery via plugin_activation
Really Simple Google Tag Manager (GTM)
≤1.0.6Update to 1.0.7
- Medium4.3Missing Authorization
Welcome Bar
≤2.0.3Update to 2.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Coupon Affiliates – Affiliate Plugin for WooCommerce
≤5.4.3Update to 5.4.4
- Medium6.1Reflected Cross-Site Scripting via 'id'
Responsive Vertical Icon Menu
≤1.5.8Update to 1.5.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Enhanced WP Contact Form
≤2.2.3Update to 2.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Enhanced WP Contact Form
≤2.2.3Update to 2.2.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
PI Conditional cart fee / Extra charge rule for WooCommerce
≤1.0.96Update to 1.0.97
- Medium4.3Cross-Site Request Forgery
Welcome Bar
≤2.0.3Update to 2.0.4