Database
WordPress Vulnerability Database (page 1164)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery in admin_widgets_welcome function
VikBooking Hotel Booking Engine & PMS
≤1.5.12Update to 1.6.0
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting via Create Link
Campaign URL Builder
≤1.8.1Update to 1.8.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
WP BaiDu Submit
≤1.2.1No patch available
- Medium5.4Cross-Site Request Forgery in saveconfig function
VikBooking Hotel Booking Engine & PMS
≤1.5.12Update to 1.6.0
- Medium5.4Cross-Site Request Forgery in savetmplfile function
VikBooking Hotel Booking Engine & PMS
≤1.5.12Update to 1.6.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Eyes Only: User Access Shortcode
≤1.8.2No patch available
- High7.5Missing Authorization via geturlcron_action_handle
Cron Setup and Monitor – Get URL Cron
≤1.4.7Update to 1.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
vSlider Multi Image Slider for WordPress
≤4.1.2No patch available
- Medium4.3Cross-Site Request Forgery in multiple functions in admin/controller.php
VikBooking Hotel Booking Engine & PMS
≤1.6.1Update to 1.6.2
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Zeno Font Resizer
≤1.7.9Update to 1.8.0
- High7.2Unauthenticated Arbitrary Media Deletion
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤8.0.8Update to 8.0.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Olevmedia Shortcodes
≤1.1.9No patch available
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Sticky Ad Bar Plugin
≤1.3.1No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Easy Panorama
≤1.1.4Update to 1.1.5
- Medium4.3Cross-Site Request Forgery in listenTosFieldSavingTask function
VikBooking Hotel Booking Engine & PMS
≤1.6.1Update to 1.6.2
- Medium4.3Missing Authorization via fi_add_rule and fi_delete_webfont_php
Fontiran
≤2.1No patch available
- High7.1Cross-Site Request Forgery
Archivist – Custom Archive Templates
≤1.7.4Update to 1.7.5
- Medium5.4Cross-Site Request Forgery via save function
Podlove Subscribe button
≤1.3.7Update to 1.3.9
- Medium4.4Wp-Insert <= 2.5.0 Authenticated (Admin+) Stored Cross Site Scripting
Wp-Insert
≤2.5.0Update to 2.5.1
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Nooz
≤1.6.0Update to 1.7.0
- Medium5.4Cross-Site Request Forgery in savetranslation function
VikBooking Hotel Booking Engine & PMS
≤1.5.12Update to 1.6.0
- Medium4.3Cross-Site Request Forgery in exec_admin_widget function
VikBooking Hotel Booking Engine & PMS
≤1.5.12Update to 1.6.0
- Medium5.4Cross-Site Request Forgery via process_form function
Podlove Subscribe button
≤1.3.7Update to 1.3.9
- Medium4.3Cross-Site Request Forgery via admin_options
Wallet for WooCommerce
≤1.3.24Update to 1.4.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Service Area Postcode Checker
≤2.0.8No patch available
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Upload File Type Settings Plugin
≤1.1No patch available
- High8.8Cross-Site Request Forgery
Social Login, Social Sharing by miniOrange
≤7.5.14Update to 7.5.15
- Medium6.4Authenticated (Contributor+) Stored Cross Site Scripting
Ultimate WP Query Search Filter
≤1.0.10No patch available
- Medium5.4Cross-Site Request Forgery in savetranslationstay function
VikBooking Hotel Booking Engine & PMS
≤1.5.12Update to 1.6.0
- Medium5.4Cross-Site Request Forgery
Meta Slider and Carousel with Lightbox
≤1.6.2Update to 1.7