Database
WordPress Vulnerability Database (page 1151)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
Robo Gallery – Photo & Image Slider
≤3.2.12Update to 3.2.13
- Medium4.3Cross-Site Request Forgery via reblex_reusable_screen_block_pattern_registration
Reusable Blocks Extended
≤0.9Update to 0.9.1
- Medium4.3Cross-Site Request Forgery via wp_ajax_wpcrm_log
Dynamics 365 Integration
≤1.3.12Update to 1.3.13
- Medium5.4Cross-Site Request Forgery via delete()
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.4.2Update to 4.4.3
- Medium5.4Reflected Cross-Site Scripting
Regina Lite
≤2.0.7No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Site Reviews
≤6.5.1Update to 6.6.0
- Medium5.4Missing Authorization
Site Reviews
≤6.5.0Update to 6.6.0
- Medium6.1Reflected Cross-Site Scripting
Brilliance
≤1.3.1No patch available
- Medium4.3Cross-Site Request Forgery via ts_reset_tracking_setting
Print Invoice & Delivery Notes for WooCommerce
≤4.7.2Update to 4.7.3
- Medium4.3Missing Authorization via AJAX actions
Stock Ticker
≤3.23.0Update to 3.23.1
- High8.8Cross-Site Request Forgery to Privilege Escalation
User Role by BestWebSoft – Add and Customize Roles and Capabilities in WordPress
≤1.6.6Update to 1.6.7
- Medium5.0Authenticated (Subscriber+) Server-Side Request Forgery
PhonePe Payment Solutions
≤1.0.15Update to 2.0.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
CMS Press
≤0.2.3No patch available
- Medium4.3Cross-Site Request Forgery
Kopa Framework
≤1.3.5No patch available
- Medium6.3Missing Authorization
Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables
≤1.10.25Update to 1.10.26
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Klaviyo
≤3.0.7Update to 3.0.8
- High7.2Authenticated (Admin+) Local File Inclusion via import_file_url
WP EasyCart: Shopping Cart and eCommerce Store
≤5.4.2Update to 5.4.3
- Medium5.4Cross-Site Request Forgery leading to Plugin Settings Changes
Weight Based Shipping for WooCommerce
≤5.4.1Update to 5.5.0
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Solidres – Hotel booking plugin for WordPress
≤0.9.4No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
WH Testimonials
≤3.0.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Weaver Xtreme Theme Support
≤6.2.5Update to 6.2.7
- Medium4.3Cross-Site Request Forgery via 'clear_uucss_logs'
RapidLoad AI – Optimize Web Vitals Automatically
≤1.7.1Update to 1.7.2
- Medium4.3Cross-Site Request Forgery via 'ucss_connect'
RapidLoad AI – Optimize Web Vitals Automatically
≤1.7.1Update to 1.7.2
- Medium5.4Cross-Site Request Forgery via plugin_mass_delete_unused_tags_init
Mass Delete Unused Tags
≤2.0.0Update to 3.0.0
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤2.25.1Update to 2.25.2
- Medium4.3Missing Authorization in 'ajax_deactivate'
RapidLoad AI – Optimize Web Vitals Automatically
≤1.7.1Update to 1.7.2
- Medium4.3Cross-Site Request Forgery via 'clear_page_cache'
RapidLoad AI – Optimize Web Vitals Automatically
≤1.7.1Update to 1.7.2
- Critical9.8Unauthenticated PHP Object Injection via AJAX
LeadSnap
≤1.23Update to 1.24
- Medium5.4Authenticated (Contributor+) Arbitrary Content Deletion
GiveWP – Donation Plugin and Fundraising Platform
≤2.25.1Update to 2.25.2
- Medium4.3Missing Authorization in 'clear_uucss_logs'
RapidLoad AI – Optimize Web Vitals Automatically
≤1.7.1Update to 1.7.2