Database
WordPress Vulnerability Database (page 1146)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Cross-Site Request Forgery via delete_settings
Variation Swatches for WooCommerce
≤1.2.7Update to 1.2.8
- Medium6.1Reflected Cross-Site Scripting
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress
≤8.2.5Update to 8.2.6
- Medium6.5Missing Authorization via settings_init
Lead Form Builder & Contact Form
≤1.8.4Update to 1.8.5
- Medium6.1Reflected Cross-Site Scripting
W4 Post List
≤2.4.5Update to 2.4.6
- Medium4.3Cross-Site Request Forgery via update_project
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce
≤12.4.0Update to 12.4.1
- Medium4.3Missing Authorization
Stock Sync for WooCommerce
≤2.3.2Update to 2.4.0
- Medium4.3Cross-Site Request Forgery
I Recommend This – Love/Like Button for WordPress Posts
≤3.9.0Update to 3.9.1
- Medium4.3Cross-Site Request Forgery
Stock Sync for WooCommerce
≤2.3.2Update to 2.4.0
- Medium5.0Missing Authorization leading to Authenticated (Subscriber+) Arbitrary Plugin Activation
Resoto
≤1.0.8No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Pricing Tables For WPBakery Page Builder (formerly Visual Composer)
≤2.0Update to 3.0
- Medium5.5Authenticated (Subscriber+) CSV Injection
Export Users Data Distinct
≤1.3No patch available
- Medium5.4Cross-Site Request Forgery
Wbcom Designs – BuddyPress Activity Social Share
≤3.5.0Update to 3.5.1
- High8.8Authenticated (Subscriber+) SQL Injection via 'pbc_down[meta][id]'
Waiting: One-click countdowns
≤0.6.2No patch available
- Medium6.4Stored (Contributor+) Cross-Site Scripting via Shortcode
GS Pinterest Portfolio – Pinterest Feed, Pinterest Board & Pin Widgets
≤1.6.1Update to 1.6.2
- Medium5.3Missing Authorization to Admin Settings Modification
If Menu – Visibility control for Menus
≤0.16.3Update to 0.17
- High8.1Authenticated (Subscriber+) Local File Inclusion via Shortcode
Pricing Tables For WPBakery Page Builder (formerly Visual Composer)
≤2.0Update to 3.0
- Medium5.3Missing Authorization via save_paramter.php
Owl Carousel
≤0.5.3No patch available
- Medium6.1Unauthenticated Cross-Site Scripting
WooCommerce JazzCash Gateway Plugin
≤2.0No patch available
- Medium4.3Cross-Site Request Forgery via send_email
Thanko Thank You Page Customizer for WooCommerce
≤1.0.13Update to 1.0.14
- Medium6.1Reflected Cross-Site Scripting
Bulk Price Update for Woocommerce
≤2.2.1Update to 2.2.2
- Medium4.3Missing Authorization to Toggle Crawler State
LiteSpeed Cache
≤5.3Update to 5.3.1
- Medium5.5Authenticated (Subscriber+) CSV Injection
amr users
≤4.59.4No patch available
- Medium5.4Cross-Site Request Forgery to Plugin Reset
Redirection
≤1.1.4Update to 1.1.5
- Medium6.4Authenticated (Editor+) Stored Cross-Site Scripting via new_style_name
Team Members – Multi Language Supported Team Plugin
≤4.4Update to 4.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
VigilanTor
≤1.3.10Update to 1.3.11
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
Vertical scroll recent post
≤14.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Lime Connect (formerly Userlike) – WordPress Live Chat plugin
≤2.2Update to 2.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Options
Lazy Social Comments
≤2.0.4Update to 2.0.5
- Medium6.5Missing Authorization
JS Job Manager
≤2.0.0Update to 2.0.1
- High7.5PHP Object Injection
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤2.3.2.1Update to 2.3.3