Database
WordPress Vulnerability Database (page 1149)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Reflected Cross-Site Scripting
NewsMag
≤2.4.4No patch available
- Medium6.1Reflected Cross-Site Scripting
Mediciti Lite
≤1.3.0No patch available
- Medium4.3Authenticated(Subscriber+) Sensitive Information Exposure
WP Tiles
≤1.1.2No patch available
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation
Chankhe
≤1.0.5Update to 1.0.6
- Medium5.3Information Disclosure
Simple Shopping Cart
4.6.3 – 4.6.3Update to 4.6.4
- Medium6.1Cross-Site Scripting
wpml
≤4.6.0Update to 4.6.1
- Medium4.3Missing Authorization to Plugin Settings Update via wpbe_save_settings
WP Basic Elements
≤5.2.15Update to 5.3.0
- Medium4.3Cross-Site Request Forgery leading to Uninstall Form Submission
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
≤3.7.7Update to 3.7.8
- Medium4.3Cross-Site Request Forgery via custom_options_plus_adm
Custom Options Plus
≤1.8.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Branda – White Label & Branding, Free Login Page Customizer
≤3.4.8.1Update to 3.4.9
- Medium4.3Cross-Site Request Forgery
WP Shortcode by MyThemeShop
≤1.4.16Update to 1.4.17
- Medium6.1Reflected Cross-Site Scripting
Estatik Mortgage Calculator
≤2.0.11No patch available
- Medium4.3Cross-Site Request Forgery leading to Limited Plugin Activation
HT Feed
≤1.2.7Update to 1.2.8
- Medium4.3Cross-Site Request Forgery to Settings Update
MotoPress Hotel Booking
≤4.6.0Update to 4.7.0
- Medium4.3Cross-Site Request Forgery via admin_magenet_settings
Website Monetization by MageNet
≤1.0.29.1Update to 1.0.29.2
- Medium4.3Cross-Site Request Forgery via bulk_resize_resize_image
Bulk Resize Media
≤1.1No patch available
- Medium4.3Missing Authorization to Feedback Submission
Contact Form Email
≤1.3.31Update to 1.3.32
- Medium4.3Cross-Site Request Forgery via external_image_import_all_ajax
Import External Images
≤1.4No patch available
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode
WP Tiles
≤1.1.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
SMTP2GO for WordPress – Email Made Easy
≤1.4.2Update to 1.5.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via $logo
WSB Brands
≤1.1.8Update to 1.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
PB SEO Friendly Images
≤4.0.5No patch available
- Medium6.1Contact Form 7 Standard <= 5.0.6.3 and <= 2.11.0 - Reflected Cross-Site Scripting
Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard
≤5.0.6.3Update to 2.11.1 or 5.0.6.4
- Medium6.5Authenticated(Admin+) SQL Injection
Slideshow Gallery LITE
≤1.7.6Update to 1.7.7
- Medium5.3Missing Authorization via post_user_feedback_backup_bank
Backup Bank: WordPress Backup Plugin
≤4.0.28No patch available
- Medium4.3Cross-Site Request Forgery via video_sitemap_generate
Google XML Sitemap for Videos
≤2.6.1No patch available
- Medium6.5Authenticated (Subscriber+) SQL Injection
Be POPIA Compliant
≤1.2.0Update to 1.3.0
- Medium4.3Cross-Site Request Forgery via admin_slides
Slideshow Gallery LITE
≤1.7.6Update to 1.7.7
- Medium5.4Missing Authorization via wp_ajax_wpcrm_log & wp_ajax_wpcrm_log_verbosity
Dynamics 365 Integration
≤1.3.12Update to 1.3.13
- Medium4.3Cross-Site Request Forgery via admin_galleries
Slideshow Gallery LITE
≤1.7.6Update to 1.7.7