Database
WordPress Vulnerability Database (page 1165)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
WP BaiDu Submit
≤1.2.1No patch available
- Medium5.4Cross-Site Request Forgery to Cart Changes
CartSuite – Cart All In One For WooCommerce
≤1.1.10Update to 1.1.11
- Critical9.8Unauthenticated SQL Injection
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤2.5.7Update to 2.5.7.1
- Medium4.9Authenticated(Admin+) Directory Traversal
All-In-One Security (AIOS) – Security and Firewall
≤5.1.4Update to 5.1.5
- Medium5.4Cross Site Request Forgery
Better Robots.txt – AI-Ready Crawl Control & Bot Governance
≤1.4.5Update to 1.4.6
- Medium4.3Cross-Site Request Forgery
WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress
≤8.2.7Update to 8.2.8
- Medium5.5Authenticated(Admin+) Stored Cross-Site Scripting
Interactive Image Map Builder
≤1.0Update to 1.1
- Medium4.3Cross-Site Request Forgery to User Earnings Deletion
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤2.5.6Update to 2.5.7
- Medium4.3Cross-Site Request Forgery to Ticket Post Status Change
Tickera – Sell Tickets & Manage Events
≤3.5.1.0Update to 3.5.1.1
- Medium5.5Authenticated(Admin+) Stored Cross-Site Scripting
WP Prayer
≤1.9.6Update to 1.9.7
- High7.3Missing Authorization
Quick PayPal Payments: Payment Button & Form
≤5.7.25Update to 5.7.26
- High7.2Unauthenticated Stored Cross Site Scripting
Quick PayPal Payments: Payment Button & Form
<5.7.26Update to 5.7.26
- Medium5.4Cross-Site Request Forgery
Conditional Payments for WooCommerce
≤2.3.1Update to 2.3.2
- Medium6.1Reflected Cross-Site Scripting via page
WPGlobus Translate Options
≤2.1.0Update to 2.2.0
- Medium6.5Authenticated (Subscriber+) Arbitrary Post Access
Ocean Extra
≤2.1.2Update to 2.1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ocean Extra
≤2.1.2Update to 2.1.3
- Medium5.4Cross-Site Request Forgery to Order Information Disclosure
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce
≤1.0.21Update to 1.0.22
- Critical9.8Type Juggling to Authentication Bypass in check_ota
WatchTowerHQ
≤3.6.16Update to 3.6.17
- Medium4.3Cross Site Request Forgery via bulk_delete
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
≤2.5.8Update to 2.5.9
- Medium4.3Cross-Site Request Forgery leading to Post Thumbnail Change
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤3.28Update to 3.29
- High7.2Unauthenticated Stored Cross-Site Scripting
Multi Rating
≤5.0.5Update to 5.0.6
- Medium5.5Authenticated(Admin+) Stored Cross-Site Scripting
Quick Event Manager
≤9.6.4Update to 9.6.5
- Medium6.3Missing Authorization to Order Information Disclosure
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce
≤1.0.21Update to 1.0.22
- Medium4.3Cross Site Request Forgery in grab
Locatoraid Store Locator
≤3.9.11Update to 3.9.12
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Google Analytics Opt-Out
≤2.3.4Update to 2.3.5
- Critical9.8Unauthenticated Arbitrary File Upload
WooCommerce Checkout Field Manager
≤17.3Update to 18.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Download Attachments
≤1.2.24Update to 1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Radius Portfolio – Filterable Grid, Gallery & Slider Portfolio
≤2.8.10Update to 2.8.11
- Medium6.4Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode
Cost Calculator
≤1.8No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WPaudio MP3 Player
≤4.0.2No patch available