Database
WordPress Vulnerability Database (page 1154)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
Blog Floating Button
≤1.4.12Update to 1.4.13
- High7.2Authenticated (Administrator+) Arbitrary File Upload
Toolset Types – Custom Post Types, Custom Fields and Taxonomies
≤3.4.17Update to 3.4.18
- Medium6.4Easy Online Scheduling <= 2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Schedulicity – Easy Online Scheduling
≤2.21No patch available
- High7.1Reflected Cross-Site Scripting via upload_limit
Manage Upload Limit
≤1.0.4No patch available
- Medium4.3Cross-Site Request Forgery via plugin_menu
New Adman
≤1.6.8No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via 'accept_other_payment_methods', 'other_payment_methods' Parameters
Namaste! LMS
≤2.5.9.9Update to 2.6
- Medium4.3Cross-Site Request Forgery
WP Translitera
≤p1.2.5No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
FareHarbor for WordPress
≤3.6.6Update to 3.6.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
CPO Content Types
≤1.1.0Update to 1.1.1
- Medium4.3Cross-Site Request Forgery
Resize at Upload Plus
≤1.3No patch available
- Medium4.3Cross-Site Request Forgery via wp_clean_up_optimize
WP Clean Up
≤1.2.3No patch available
- Medium4.3Cross-Site Request Forgery
TotalPoll for Polls and Contests
≤4.8.6Update to 4.8.7
- Low3.8Authenticated (Author+) Stored Cross-Site Scripting via Email Logs
FluentSMTP – WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP
≤2.2.2Update to 2.2.3
- Medium5.4Cross-Site Request Forgery
Leyka
≤3.29.2Update to 3.30
- Medium6.4Authenticated (Subscriber+) Cross-Site Scripting via Shortcodes
YASR – Yet Another Star Rating Plugin for WordPress
≤3.1.2Update to 3.1.3
- High8.3Server-Side Request Forgery
AMP Toolbox
≤2.1.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
New Adman
≤1.6.8No patch available
- Medium4.3Cross-Site Request Forgery via render_settings_page
Classic Editor and Classic Widgets
≤1.2.5Update to 1.2.6
- Medium4.3Cross-Site Request Forgery
Elegant Custom Fonts
≤1.0Update to 1.0.1
- Medium4.3Authenticated (Subscriber+) Sensitive Information Disclosure via Shortcode
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
≤2.12.1Update to 2.12.2
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via admin settings
JCH Optimize
≤3.2.2Update to 3.2.3
- Medium4.3Cross-Site Request Forgery
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤1.1.120Update to 1.1.121
- Medium6.1Reflected Cross-Site Scripting via 'url'
GTmetrix for WordPress
≤0.4.5Update to 0.4.6
- Medium6.5Missing Authorization for Email Functionality
Sales Report Email for WooCommerce
≤2.8.0No patch available
- Medium4.3Cross-Site Request Forgery to Feedback Submission
Search in Place
≤1.0.104Update to 1.0.105
- Medium5.4Missing Authorization via import_templates
Rife Extensions & Templates for Elementor
≤1.1.10Update to 1.2.0
- Medium6.1Reflected Cross-Site Scripting via cart_search
Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD
≤3.1.5Update to 3.1.6
- Medium5.1CSV Injection
Simple CSV/XLS Exporter
≤1.5.8No patch available
- Medium4.3Cross-Site Request Forgery via wpstream_settings
WpStream – Live Streaming, Video on Demand, Pay Per View
≤4.4.10Update to 4.4.10.6
- Medium4.3Cross-Site Request Forgery via saveSettings
Translation with DeepL API
≤2.1.4Update to 2.1.5