Database
WordPress Vulnerability Database (page 1159)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Multiple Cross-Site Request Forgery
Tooltips for WordPress
≤8.2.5Update to 8.2.7
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤4.9.3.2Update to 4.9.3.3
- High8.1Cross-Site Request Forgery via gmace_manager_client
GMAce
≤1.5.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
CM Answers – Discussion Forum Plugin for WordPress Q&A
≤3.1.9Update to 3.2.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
CPT – Speakers
≤1.1No patch available
- Medium4.9Authenticated(Admin+) Directory Traversal
GMAce
≤1.5.2No patch available
- High8.8Authenticated (Subscriber+) SQL Injection
WP Meta SEO
≤4.5.2Update to 4.5.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
GoToWP
≤5.1.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WPB Advanced FAQ
≤1.0.6No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
Hero Banner Ultimate
≤1.3.4Update to 1.4
- Medium4.3Cross-Site Request Forgery via 'addRedirect' function
Redirection
≤1.1.3Update to 1.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Custom Content Shortcode
≤4.0.2No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
≤1.1.150Update to 1.1.151
- Medium4.3Cross-Site Request Forgery via settings_page function
WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms – CRM, Bigin
≤1.2.2Update to 1.2.3
- Medium5.4Cross-Site Request Forgery via cp_create_private_pages_for_all_users function
Client Portal – Private user pages and login
≤1.1.8Update to 1.1.9
- Medium4.3Missing Authorization in 'LoadTab' function
Redirection
≤1.1.3Update to 1.1.4
- Medium4.3Cross-Site Request Forgery via aalChangeOptions function
Auto Affiliate Links
≤6.3.0.2Update to 6.3.0.3
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting via Several Parameters
Accordion – Multiple Accordion or FAQs Builder
≤2.3.0Update to 2.3.1
- High8.8Authenticated (Editor+) SQL Injection via 'post'
Paytm Payment Gateway
≤2.7.3Update to 2.7.7
- Medium5.4Cross-Site Request Forgery to Plugin Settings Update
Etsy Shop
≤3.0.3Update to 3.0.4
- Medium4.7Reflected Cross-Site Scripting via REQUEST_URI
VK All in One Expansion Unit
≤9.87.0.1Update to 9.87.1.0
- Medium5.3Unauthenticated Information Exposure
WP-RecentComments
≤2.2.7No patch available
- High8.8Authenticated (Contributor+) Local File Inclusion via Shortcode
Custom Content Shortcode
≤4.0.2No patch available
- Medium4.4<= 3.2.4 - Authenticated(Admin+) Stored Cross-Site Scripting
WebberZone Top 10 — Popular Posts
≤3.2.4Update to 3.2.5
- Medium4.3Missing Authorization on tptn_chart_data
WebberZone Top 10 — Popular Posts
≤3.2.4Update to 3.2.5
- High8.1Cross-Site Request Forgery leading to Plugin/Subscription Deletion
Community by PeepSo – Download from PeepSo.com
≤6.0.2.0Update to 6.0.3.0
- Medium4.3Cross-Site Request Forgery via 'cronLogDeleteOption' function
Redirection
≤1.1.3Update to 1.1.4
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WordPress Старт
≤3.7Update to 3.8
- Medium4.3Missing Authorization in 'logPageContent' function
Redirection
≤1.1.3Update to 1.1.4
- Medium4.3Missing Authorization in 'selectAll' function
Redirection
≤1.1.3Update to 1.1.4