Database
WordPress Vulnerability Database (page 1166)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Content Deletion
Social Login, Social Sharing by miniOrange
≤7.6.0Update to 7.6.1
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Twitch Player
≤2.1.0Update to 2.1.1
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Simple Yearly Archive
≤2.1.8Update to 2.1.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WordPress Shortcodes
≤1.6.36No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode
Cost Calculator
≤1.8No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WPaudio MP3 Player
≤4.0.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
i2 Pros & Cons
≤1.3.1No patch available
- Critical9.8Insecure Password Reset Mechanism
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.9.0Update to 3.9.1
- Low3.8Authenticated (Administrator+) Stored Cross-Site Scripting
DupeOff
≤1.6No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Product GTIN (EAN, UPC, ISBN) for WooCommerce
≤1.1.1No patch available
- Medium6.5Sensitive Information Disclosure via Shortcode
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.9.0Update to 3.9.1
- High7.2Authenticated (Admin+) SQL Injection via $email value
RSVPMaker
≤9.9.3Update to 9.9.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
UpQode Google Maps
≤1.0.5No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Resume Builder
≤3.1.1Update to 3.2
- Medium6.4Authenticated (Contributor+) Stored Cross Site Scripting via Shortcode
Advanced Recent Posts
≤0.6.14No patch available
- Medium6.3Missing Authorization
Shoppable Images (Lookbook) for WooCommerce
≤1.2.3Update to 1.2.4
- Medium4.3Missing Authorization to User Points Updates
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤2.5.6Update to 2.5.7
- Critical9.8Unauthenticated Arbitrary File Upload
WooCommerce Checkout Field Manager
≤17.3Update to 18.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Download Attachments
≤1.2.24Update to 1.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Radius Portfolio – Filterable Grid, Gallery & Slider Portfolio
≤2.8.10Update to 2.8.11
- Medium4.3Cross-Site Request Forgery in void_cf7_opt_in_user_data_track
Void Contact Form 7 Widget For Elementor Page Builder
≤2.1.1Update to 2.2
- Medium4.3Cross-Site Request Forgery via admin_action_install_weglot
Under Construction
≤3.96Update to 3.97
- Medium6.5Authenticated (Subscriber+) Arbitrary File Read via Shortcode
Shortcodes Ultimate – Content Elements
≤5.12.6Update to 5.12.7
- Medium4.3Cross-Site Request Forgery
Podlove Podcast Publisher
≤3.8.3Update to 3.8.4
- Medium4.3Cross-Site Request Forgery via admin_action_ucp_dismiss_notice
Under Construction
≤3.96Update to 3.97
- Medium5.5Authenticated(Admin+) Stored Cross-Site Scripting
Link Juice Keeper
≤2.0.2Update to 2.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross Site Scripting
Shortcodes Ultimate – Content Elements
≤5.12.6Update to 5.12.7
- Medium6.5Authenticated (Subscriber+) Server-Side Request Forgery
Shortcodes Ultimate – Content Elements
≤5.12.6Update to 5.12.7
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Quick PayPal Payments: Payment Button & Form
≤5.7.25Update to 5.7.26
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Block Options
Scriptless Social Sharing
≤3.2.1Update to 3.2.2