Database
WordPress Vulnerability Database (page 1155)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery to Settings Update
ClickFunnels
≤3.1.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Button Generator – Easily Create Custom Buttons with Icons and Analytics
≤2.3.3Update to 2.3.4
- Medium5.3reCaptcha Protection Bypass
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤3.2.1Update to 3.2.2
- High7.1Cross-Site Request Forgery
LWS Tools
≤2.3.1Update to 2.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Simple Vimeo Shortcode
≤2.9.1No patch available
- Medium5.4Authenticated (Author+) Server-Side Request Forgery via instant_images_download
Instant Images – One-click Image Uploads from Unsplash, Openverse, Pixabay, Pexels, and Giphy
≤5.1.0.1Update to 5.1.0.2
- Medium4.3Cross-Site Request Forgery via [placeholder]
AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization
≤2.7Update to 2.7.1
- Medium4.3Cross-Site Request Forgery via wpstream_settings
WpStream – Live Streaming, Video on Demand, Pay Per View
≤4.4.10Update to 4.4.10.6
- Medium5.1CSV Injection
Simple CSV/XLS Exporter
≤1.5.8No patch available
- Medium4.3Cross-Site Request Forgery via saveSettings
Translation with DeepL API
≤2.1.4Update to 2.1.5
- High7.2Authenticated (Vendor+) SQL Injection
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤3.7.12Update to 3.7.13
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Cost Calculator
≤1.8No patch available
- Medium4.3Cross-Site Request Forgery
Fontiran
≤2.1No patch available
- Medium6.1Unauthenticated Reflected Cross-Site Scripting via search_term
Easy Testimonial Slider and Form
≤1.0.15Update to 1.0.16
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'cookies_policy_link' Shortcodes
Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA
≤2.4.6Update to 2.4.7
- High8.1Missing Authorization in pgc_sgb_action_wizard
SimpLy Gallery
≤3.0.7Update to 3.0.8
- Medium4.3Cross-Site Request Forgery via wll_hide_subscription_notice
When Last Login
≤1.2.1Update to 1.2.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
menu shortcode
≤1.0No patch available
- Medium4.3Authenticated Feedback Submission
CP Contact Form with PayPal
≤1.3.34Update to 1.3.35
- Medium5.4Cross-Site Request Forgery
Real Estate 7 WordPress
≤3.3.4Update to 3.3.5
- Medium6.5Cross-Site Request Forgery to License Update
Woodmart
≤7.1.1Update to 7.1.2
- Medium6.5Missing Authorization to Shortcode Injection
Woodmart
≤7.1.1Update to 7.1.2
- Medium4.3Authenticated(Subscriber+) Plugin Activation
Total
≤2.1.19Update to 2.1.20
- Medium4.3Missing Authorization to Feedback Submission
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤1.1.120Update to 1.1.121
- Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
WP News – WordPress News / Magazine Plugin
≤1.1.9Update to 1.2.0
- Medium4.3Cross-Site Request Forgery via 'delete' in mooauth_client_applist_page
OAuth Single Sign On – SSO (OAuth Client)
≤6.24.1Update to 6.24.2
- Medium4.3Cross-Site Request Forgery to Plugins Options Changes
Rus-To-Lat
≤0.3No patch available
- Medium6.4Ultimate Form Builder <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
NEX-Forms – Ultimate Forms Plugin for WordPress
≤8.3.2Update to 8.3.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Simple File List
≤6.0.9Update to 6.0.10
- Medium4.3Missing Authorization leading to Authenticated (Subscriber+) Attachment Deletion
OoohBoi Steroids for Elementor
≤2.1.3Update to 2.1.5