Database
WordPress Vulnerability Database (page 1148)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Scheduled Announcements Widget
≤0.2Update to 1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Stylish Cost Calculator
<7.9.0Update to 7.9.0
- Medium4.3Cross-Site Request Forgery via mobile_sitemap_generate
Google XML Sitemap for Mobile
≤1.6.1No patch available
- Medium4.3Cross-Site Request Forgery leading to Mobile Redirect Updates
Simple Mobile URL Redirect
≤1.7.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
GamiPress – Youtube integration
≤1.0.7Update to 1.0.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Content Censor
≤3.0.1Update to 3.1.0
- Medium6.1Reflected Cross-Site Scripting
WordPress Amazon S3 Plugin
≤1.5Update to 1.6
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
≤5.1.4Update to 5.1.5
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Settings
Simple Giveaways – Grow your business, email lists and traffic with contests
≤2.45.0Update to 2.45.1
- High8.8Authenticated (Subscriber+) SQL Injection via 'value'
WP Popup Banners
≤1.2.5No patch available
- Medium4.4Authenticated(Admin+) Stored Cross-Site Scripting via form fields
Simple Giveaways – Grow your business, email lists and traffic with contests
≤2.45.0Update to 2.45.1
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via pec_coupon[code]
WP Express Checkout (Fast Payments via PayPal & Stripe)
2.2.8 – 2.2.8Update to 2.2.9
- High8.8Authenticated (Subscriber+) SQL Injection
WP Popup Banners
≤1.2.5No patch available
- Medium6.3Cross-Site Request Forgery
RapidLoad AI – Optimize Web Vitals Automatically
≤1.7.1Update to 1.7.2
- Medium6.3Missing Authorization
GEO Plugin by Squirrly SEO
≤12.1.20Update to 12.1.21
- Medium4.3Cross-Site Request Forgery
Contact Form 7 – PayPal & Stripe Add-on
≤1.9.3Update to 1.9.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Ecwid by Lightspeed Ecommerce Shopping Cart
≤6.11.4Update to 6.11.5
- High7.2Unauthenticated Stored Cross-Site Scripting via Name
Online Scheduling and Appointment Booking System – Bookly
21.5 – 21.5Update to 21.5.1
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
≤2.0.5Update to 2.0.6
- High7.2Unauthenticated Stored Cross-Site Scripting
Return and Warranty Management System for WooCommerce
≤1.2.3No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation
Real Estate Directory
≤1.0.4Update to 1.0.5
- Medium6.1Reflected Cross-Site Scripting via open_data_rdw_kenteken
Tussendoor – Open RDW
≤2.0.14Update to 2.1.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
eCommerce Product Catalog
≤3.3.8Update to 3.3.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Surbma | GDPR Proof Cookie Consent & Notice Bar
≤17.5.3Update to 17.6.0
- Medium6.1Reflected Cross-Site Scripting via 'page' and 'tab'
GEO Plugin by Squirrly SEO
≤12.1.20Update to 12.1.21
- Medium4.3Cross-Site Request Forgery via rdm_activate_plugin
Real Estate Directory
≤1.0.5Update to 1.0.6
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Simple Events
≤1.0No patch available
- Medium4.3Cross-Site Request Forgery via bulk_resize_resize_image
Bulk Resize Media
≤1.1No patch available
- Medium4.3Cross-Site Request Forgery via external_image_import_all_ajax
Import External Images
≤1.4No patch available
- Medium4.3Cross-Site Request Forgery
WP Shortcode by MyThemeShop
≤1.4.16Update to 1.4.17