Database
WordPress Vulnerability Database (page 1158)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization in 'regenerateSitemaps'
WP Meta SEO
≤4.5.3Update to 4.5.4
- Medium4.3Cross-Site Request Forgery via 'setIgnore'
WP Meta SEO
≤4.5.3Update to 4.5.4
- Medium4.3Cross-Site Request Forgery via 'regenerateSitemaps'
WP Meta SEO
≤4.5.3Update to 4.5.4
- Medium4.3Cross-Site Request Forgery
多合一搜索自动推送管理插件-支持Baidu/Google/Bing/IndexNow/Yandex/头条
≤4.2.5Update to 4.2.6
- Medium5.4Cross-Site Request Forgery
phpinfo() WP – Site Health, PHP Compatibility & Server Audit
≤4.0Update to 5.0
- High8.8Cross-Site Request Forgery in upload and delete_file
Drag and Drop Multiple File Upload for WooCommerce
≤1.0.8Update to 1.0.9
- Critical9.8Arbitrary File Upload
Zendrop – Global Dropshipping
≤1.0.0Update to 1.0.1
- Medium4.3Missing Authorization in 'checkAllCategoryInSitemap'
WP Meta SEO
≤4.5.3Update to 4.5.4
- Medium5.4Missing Authorization
Apollo13 Framework Extensions
≤1.8.10Update to 1.9.0
- Medium4.4Authenticated (Subscriber+) CSV Injection
KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin
≤1.5.84Update to 1.5.85
- Medium5.9Authenticated (Administrator+) Stored Cross-Site Scripting
asMember
≤1.5.4No patch available
- High8.8Cross-Site Request Forgery in dnd_upload_cf7_upload and dnd_codedropz_upload_delete
Drag and Drop Multiple File Upload for Contact Form 7
≤1.3.6.5Update to 1.3.6.6
- Medium5.3Missing Authorization
Conditional Checkout Fields & Edit Checkout Fields for WooCommerce
≤1.2.3Update to 1.2.4
- Medium4.3Missing Authorization in 'listPostsCategory'
WP Meta SEO
≤4.5.3Update to 4.5.4
- Medium5.4Missing Authorization in 'saveSitemapSettings'
WP Meta SEO
≤4.5.3Update to 4.5.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
CM Answers – Discussion Forum Plugin for WordPress Q&A
≤3.1.9Update to 3.2.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
TypeSquare Webfonts for ConoHa
≤2.0.3Update to 2.0.4
- Medium4.3Authenticated Sensitive Information Disclosure via resume_upload_form_list shortcode
Upload Resume
≤1.2.0No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
CPT – Speakers
≤1.1No patch available
- Medium4.9Authenticated(Admin+) Directory Traversal
GMAce
≤1.5.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Simple YouTube Responsive
≤2.5Update to 3.0
- Medium4.3Cross-Site Request Forgery to Plugin Settings Changes
For the visually impaired
≤0.58No patch available
- High8.1Remote Code Execution
Block for Apple Maps
≤1.1.0Update to 1.1.1
- Medium5.4Cross-Site Request Forgery via admin_block_country_initial_page
Admin Block Country
≤7.1.4No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Simple Portfolio Gallery
≤0.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Custom Login Page
≤2.0No patch available
- Medium4.3Cross-Site Request Forgery to Plugin Activation
Coupon Zen
≤1.0.5Update to 1.0.6
- Medium6.5Missing Authorization in upload and delete_file
Drag and Drop Multiple File Upload for WooCommerce
≤1.0.8Update to 1.0.9
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WPMobile.App – Android and iOS App Builder
≤11.18Update to 11.19
- Medium4.3Cross-Site Request Forgery to Cache Deletion
My YouTube Channel
≤3.23.3Update to 3.23.4