Database
WordPress Vulnerability Database (page 1169)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Authenticated (Subscriber+) Plugin Settings Change
Auto Affiliate Links
≤6.2.1.5Update to 6.2.1.6
- Medium6.4Authenticated(Contributor+) Cross-Site Scripting via Shortcode
Icegram Collect – Easy Contact Form, Subscription Form & Lead Collection Plugin for WordPress
≤1.3.8Update to 1.3.9
- Medium4.3Cross-Site Request Forgery via cpdexbccf_feedback
Booking Calendar Contact Form
≤1.2.34Update to 1.2.35
- Medium5.4Missing Authorization via ajax_unassign_folders
Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types
≤2.18.16Update to 2.18.17
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Feedback Form Submission
Booking Calendar Contact Form
≤1.2.34Update to 1.2.35
- High7.2Unauthenticated Stored Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.7.1Update to 2.7.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Gallery – Image and Video Gallery with Thumbnails
≤2.0.1Update to 2.0.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Podlove Podcast Publisher
≤3.8.2Update to 3.8.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
VK All in One Expansion Unit
≤9.85.0.1Update to 9.86.0.0
- Medium5.4Cross-Site Request Forgery
Auto YouTube Importer
≤1.0.3Update to 1.0.4
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Similar Posts – Best Related Posts Plugin for WordPress
≤3.1.6No patch available
- Medium5.3IP Address Spoofing
User Activity
≤1.0.1No patch available
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
WebinarIgnition – AI & MCP Webinar Builder on Your WordPress: Live, Automated & Evergreen, WooCommerce Upsells Inside
≤2.14.2Update to 2.14.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
GS Insever Portfolio
≤1.4.4Update to 1.4.5
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Watu Quiz
≤3.3.8Update to 3.3.8.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.7.1Update to 2.7.1.1
- Medium5.5Authenticated (Subscriber+) CSV Injection
Posts and Users Stats
≤1.1.3Update to 1.1.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Real Media Library: Media Library Folder & File Manager
≤4.18.28Update to 4.18.29
- Medium6.0Authenticated (Subscriber+) CSV Injection
Simple History – Track, Log, and Audit WordPress Changes
≤3.3.1Update to 3.4.0
- Medium4.4Authenticated (Admin+) Stored Cross Site Scripting
Usersnap
≤4.16Update to 4.17
- Medium6.1Reflected Cross-Site Scripting
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization
≤3.6.1Update to 3.6.2
- Medium6.1Reflected Cross-Site Scripting
Print Invoice & Delivery Notes for WooCommerce
≤4.7.1Update to 4.7.2
- High8.8Cross Site Request Forgery
PHP Execution
≤1.0.0No patch available
- Medium4.3Cross-Site Request Forgery via aalDeleteLink function
Auto Affiliate Links
≤6.3Update to 6.3.0.1
- Medium4.4Authenticated (Administrator+) Cross Site Scripting
CC Custom Taxonomy
≤1.0.1No patch available
- Medium6.5Unauthenticated CSV Injection
Commenter Emails
≤2.6.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Shortcodes by Angie Makes
≤1.67No patch available
- Medium6.1Reflected Cross-Site Scripting
Custom Add User
≤2.0.2No patch available
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Two-factor authentication (formerly IP Vault)
≤2.0Update to 2.1
- Medium4.3Authenticated (Subscriber+) Arbitrary Plugin Activation
Magazine Edge
≤1.13No patch available