Database
WordPress Vulnerability Database (page 1157)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting via ct_additional_features
Real Estate 7 WordPress
≤3.3.4Update to 3.3.5
- Medium4.3Cross-Site Request Forgery leading to Arbitrary Plugin Activation
Free WooCommerce Theme 99fy Extension
≤1.2.7Update to 1.2.8
- Medium4.3Cross-Site Request Forgery to Arbitrary Plugin Activation
Preview Link Generator
≤1.0.3Update to 1.0.4
- Medium5.3Missing Authorization via atw_dismiss_admin_notice
Advanced Text Widget
≤2.1.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Advanced Text Widget
≤2.1.2No patch available
- Medium6.5Authenticated (Subscriber+) Information Exposure
Shortcodes Ultimate – Content Elements
≤5.12.7Update to 5.12.8
- Critical9.8Privilege Escalation
Houzez
≤2.7.1Update to 2.7.2
- Medium4.3Cross-Site Request Forgery
WP Google Tag Manager
≤1.1No patch available
- Medium4.3Cross-Site Request Forgery to Settings Update
Read More Excerpt Link
≤1.6.0Update to 1.6.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
We’re Open!
≤1.46Update to 1.47
- Medium4.3Authenticated (Subscriber+) Arbitrary Post Access via Shortcode
Shortcodes Ultimate – Content Elements
≤5.12.7Update to 5.12.8
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Dashboard Widgets Suite
≤3.2.1Update to 3.2.2
- High8.8Missing Authorization to Arbitrary Password Reset
ProfileGrid – User Profiles, Groups and Communities
≤5.3.0Update to 5.3.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Publish to Schedule
≤4.5.4Update to 4.5.5
- Medium6.1Reflected Cross-Site Scripting
GN Publisher: Google News Compatible RSS Feeds
≤1.5.5Update to 1.5.6
- Medium6.4Ajax Load More <= 5.6.0.2 - Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode
Ajax Load More – Infinite Scroll, Load More, & Lazy Load
≤5.6.0.2Update to 5.6.0.3
- High8.8Authenticated (Subscriber+) Local File Inclusion
OceanWP
≤3.4.1Update to 3.4.2
- Medium6.1Reflected Cross-Site Scripting via JS split
Darcie
≤1.1.5Update to 1.1.6
- Medium6.3Missing Authorization leading to Authenticated (Subscriber+) Arbitrary Address Creation/Deletion/View/Updates
WooCommerce Multiple Customer Addresses & Shipping
<21.7Update to 21.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scritping
Simple Slug Translate
≤2.7.2Update to 2.7.3
- Medium5.4Cross-Site Request Forgery
FlexTable – Data Table Sync with Google Sheets
≤2.12.15Update to 2.13.0
- Medium4.3Cross-Site Request Forgery
Spam Protection | Maspik
≤0.7.8Update to 0.7.9
- Medium4.3Missing Authorization to Plugin Settings Change
Wholesale Suite – B2B, Dynamic Pricing & WooCommerce Wholesale Prices
≤2.1.5Update to 2.1.6
- Medium5.4Missing Authorization
Apollo13 Framework Extensions
≤1.8.10Update to 1.9.0
- Medium4.4Authenticated (Subscriber+) CSV Injection
KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin
≤1.5.84Update to 1.5.85
- Medium4.3Missing Authorization in 'checkAllCategoryInSitemap'
WP Meta SEO
≤4.5.3Update to 4.5.4
- Medium4.3Missing Authorization in 'regenerateSitemaps'
WP Meta SEO
≤4.5.3Update to 4.5.4
- Medium5.4Cross-Site Request Forgery
phpinfo() WP – Site Health, PHP Compatibility & Server Audit
≤4.0Update to 5.0
- High8.8Cross-Site Request Forgery in dnd_upload_cf7_upload and dnd_codedropz_upload_delete
Drag and Drop Multiple File Upload for Contact Form 7
≤1.3.6.5Update to 1.3.6.6
- Medium5.9Authenticated (Administrator+) Stored Cross-Site Scripting
asMember
≤1.5.4No patch available