Database
WordPress Vulnerability Database (page 1170)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
FV Flowplayer Video Player
≤7.5.30.7210Update to 7.5.31.7212
- Medium5.3Missing Authorization
Album and Image Gallery Plus Lightbox
≤1.6.2.Update to 1.6.3
- High8.8Cross Site Request Forgery
PHP Execution
≤1.0.0No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Real Media Library: Media Library Folder & File Manager
≤4.18.28Update to 4.18.29
- Medium6.1Reflected Cross-Site Scripting
Print Invoice & Delivery Notes for WooCommerce
≤4.7.1Update to 4.7.2
- Medium4.4Authenticated (Admin+) Stored Cross Site Scripting
Usersnap
≤4.16Update to 4.17
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
avalex – Automatisch sichere Rechtstexte
<3.0.4Update to 3.0.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.7.1Update to 2.7.1.1
- Medium6.0Authenticated (Subscriber+) CSV Injection
Simple History – Track, Log, and Audit WordPress Changes
≤3.3.1Update to 3.4.0
- Medium5.5Authenticated (Subscriber+) CSV Injection
Posts and Users Stats
≤1.1.3Update to 1.1.4
- Medium6.5Unauthenticated CSV Injection
Commenter Emails
≤2.6.1No patch available
- Medium4.4Authenticated (Administrator+) Cross Site Scripting
CC Custom Taxonomy
≤1.0.1No patch available
- Medium4.3Cross-Site Request Forgery via aalDeleteLink function
Auto Affiliate Links
≤6.3Update to 6.3.0.1
- Medium6.1Reflected Cross-Site Scripting
Custom Add User
≤2.0.2No patch available
- Medium4.3Cross Site Request Forgery
Flexible Editor Panel for Elementor
≤2.3.8Update to 2.3.9
- High7.2Caption Hover with Carousel <= 2.8 - Unauthenticated Stored Cross Site Scripting
Image Hover Effects for Elementor with Lightbox and Flipbox
≤2.8Update to 3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Shortcodes by Angie Makes
≤1.67No patch available
- Medium4.4Authenticated (Admin+) Stored Cross Site Scripting
EZP Coming Soon Page
≤1.0.73Update to 1.0.74
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Two-factor authentication (formerly IP Vault)
≤2.0Update to 2.1
- Medium4.3Authenticated (Subscriber+) Arbitrary Plugin Activation
Magazine Edge
≤1.13No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤3.1.2Update to 3.2.0
- Medium4.3Missing Authorization
We’re Open!
≤1.44Update to 1.45
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting via Shortcodes
Wufoo Shortcode
≤1.51Update to 1.52
- High7.1Cross-Site Request Forgery
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤5.5.6Update to 5.5.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Donation Block For PayPal
≤2.0.0Update to 2.1.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Opening Hours
≤2.3.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Ocean Extra
≤2.1.1Update to 2.1.2
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Plugin Options Update
Kraken.io Image Optimizer – Compress, Convert to WebP & AVIF, Resize & Bulk Optimize
≤2.6.9Update to 2.7.0
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Arigato Autoresponder and Newsletter
≤2.1.7.1Update to 2.1.7.2
- High7.3Missing Authorization to Settings Update
Beautiful Cookie Consent Banner
≤2.10.0Update to 2.10.1