Database
WordPress Vulnerability Database (page 1161)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
Read More Excerpt Link
≤1.6Update to 1.6.1
- Medium4.3Cross-Site Request Forgery via 'SaveSettings' function
Redirection
≤1.1.3Update to 1.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Saan World Clock
≤1.8No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Job Postings
≤2.5.10.2Update to 2.5.11
- Medium4.3Authenticated (Subscriber+) Arbitrary Client Deletion (wo_ajax_remove_client)
WP OAuth Server (OAuth Authentication)
≤4.2.5Update to 4.3.0
- Medium4.3Missing Authorization in 'deleteRedirect' function
Redirection
≤1.1.3Update to 1.1.4
- Medium4.3Missing Authorization in 'addRedirect' function
Redirection
≤1.1.3Update to 1.1.4
- Medium4.3Missing Authorization in 'redirectionPageContent' function
Redirection
≤1.1.3Update to 1.1.4
- Medium4.3Cross-Site Request Forgery via 'saveRedirectSettings' function
Redirection
≤1.1.3Update to 1.1.4
- High8.8Cross-Site Request Forgery
Booking Ultra Pro Appointments Booking Calendar Plugin
≤1.1.6Update to 1.1.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Shipyaari Shipping Management
≤1.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross Site Scripting
wpDataTables (Premium)
≤2.1.49Update to 2.1.50
- High7.2Stored Cross-Site Scripting
Real Estate 7 WordPress
≤3.3.1Update to 3.3.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
WP Table Builder – Drag & Drop Table Builder
≤1.4.6Update to 1.4.7
- Medium6.3Cross-Site Request Forgery
CSS JS Manager, Async JavaScript, Defer Render Blocking CSS
≤2.4.49Update to 2.4.49.1
- Medium5.4Cross-Site Request Forgery
WP Dynamic Keywords Injector
≤2.3.15Update to 2.3.16
- Medium5.4Cross Site Request Forgery
Community by PeepSo – Download from PeepSo.com
≤6.0.2.0Update to 6.0.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Scripting via Shortcode
Ditty – Responsive News Tickers, Sliders, and Lists
≤3.0.32Update to 3.0.33
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
Editor Blocks by Download Manager
≤2.1.8Update to 2.1.9
- Medium4.4Authenticated (Admin+) Cross-Site Scripting
Protected Posts Logout Button
≤1.4.5Update to 1.4.6
- Critical9.8Unauthenticated SQL Injection via Multiple Parameters
10Web Map Builder for Google Maps
≤1.0.72Update to 1.0.73
- Medium6.3Cross-Site Request Forgery
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO
≤3.3.9Update to 3.3.10
- Medium4.4Authenticated (Admin+) Stored Cross Site Scripting
Clio Grow Form
≤1.0.0Update to 1.0.1
- Medium4.4Authenticated(Admin+) Stored Cross-Site Scripting
Exquisite PayPal Donation
≤2.0.0No patch available
- Medium4.4Authenticated (Admin+) Stored Cross Site Scripting
Video Gallery – YouTube Gallery, Vimeo, Video Portfolio, Image Portfolio and Image Gallery
≤1.7.6Update to 1.7.7
- Medium4.3Cross-Site Request Forgery
Theme Tweaker
≤5.20No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤3.9.4Update to 3.9.5
- Medium4.4Authenticated(Admin+) Stored Cross-Site Scripting
Stock market charts from finviz
≤1.0.1Update to 1.0.2
- Medium4.3Cross-Site Request Forgery in add_to_favorite
Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg
≤3.1.20Update to 3.2.21
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Admin Settings
Circles Gallery
≤1.0.10No patch available