Database
WordPress Vulnerability Database (page 1147)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Lime Connect (formerly Userlike) – WordPress Live Chat plugin
≤2.2Update to 2.3
- Medium6.1Reflected Cross-Site Scripting via topic parameter
Open Graphite
≤1.6.0Update to 1.6.1
- Medium5.4Missing Authorization via eztoc_reset_options_to_default
Easy Table of Contents
≤2.0.45.2Update to 2.0.46
- Medium4.3Cross-Site Request Forgery to Feedback Submission
Contact Form Email
≤1.3.31Update to 1.3.32
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Options
Lazy Social Comments
≤2.0.4Update to 2.0.5
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings.
Disqus Conditional Load
≤11.1.1Update to 11.1.2
- Medium6.5Missing Authorization
JS Job Manager
≤2.0.0Update to 2.0.1
- High7.5PHP Object Injection
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
≤2.3.2.1Update to 2.3.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
VigilanTor
≤1.3.10Update to 1.3.11
- Medium6.4Authenticated (Editor+) Stored Cross-Site Scripting via new_style_name
Team Members – Multi Language Supported Team Plugin
≤4.4Update to 4.5
- High8.8Authenticated(Author+) Arbitrary File Upload to Remote Code Execution
JetEngine
≤3.1.3Update to 3.1.3.1
- Medium4.4Authenticated(Admin+) Stored Cross-Site Scripting
Time Sheets
≤1.29.2Update to 1.29.3
- High8.8Authenticated (Subscriber+) SQL Injection via 'search_name'
Events Made Easy
≤2.3.17Update to 2.3.18
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'post_title' parameter
TreePress – Easy Family Trees & Ancestor Profiles
≤2.0.22Update to 3.0.0
- Medium5.3Unauthenticated Path Traversal
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
≤3.4.1Update to 3.4.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
ConvertBox Auto Embed WordPress plugin
≤1.0.19Update to 1.0.20
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Cyberus Key
≤1.0Update to 1.1
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
≤5.1.4Update to 5.1.5
- Medium4.4Authenticated(Admin+) Stored Cross-Site Scripting via form fields
Simple Giveaways – Grow your business, email lists and traffic with contests
≤2.45.0Update to 2.45.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Content Censor
≤3.0.1Update to 3.1.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'mep_get_option' function
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤3.8.6Update to 3.8.7
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Settings
Simple Giveaways – Grow your business, email lists and traffic with contests
≤2.45.0Update to 2.45.1
- Medium4.3Cross-Site Request Forgery leading to Mobile Redirect Updates
Simple Mobile URL Redirect
≤1.7.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
GamiPress – Youtube integration
≤1.0.7Update to 1.0.8
- Medium6.1Reflected Cross-Site Scripting
WordPress Amazon S3 Plugin
≤1.5Update to 1.6
- Medium4.3Cross-Site Request Forgery via mobile_sitemap_generate
Google XML Sitemap for Mobile
≤1.6.1No patch available
- High8.8Authenticated (Subscriber+) SQL Injection via 'value'
WP Popup Banners
≤1.2.5No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'uid' in 'cyberkey_settings' Plugin Setting
Cyberus Key
≤1.0Update to 1.1
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
≤4.3.24Update to 4.3.25
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Kanban Boards for WordPress
≤2.5.21No patch available