Database
WordPress Vulnerability Database (page 1175)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Product Slider, Product Grid, Product Masonry
≤1.13.41Update to 1.13.42
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
YouTube Embed, Playlist and Popup by WpDevArt
≤2.6.3Update to 2.6.4
- High8.8Authenticated Arbitrary File Upload
Corsa
≤1.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Spotlight Social Photo Feed
≤1.4.2Update to 1.4.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Zoho Forms – Drag & Drop Form Builder for Websites – Contact Forms, Payment Forms, Order Forms & More
3.0.0 – 3.0.0Update to 3.0.1
- Medium5.4Missing Authorization to Captcha Setting Update
Spectra Legacy – Gutenberg Blocks
≤2.3.1Update to 2.3.2
- Medium5.4Cross-Site Request Forgery to WPForm/Blocks Import
Spectra Legacy – Gutenberg Blocks
≤2.3.1Update to 2.3.2
- Medium6.5HTML Injection in Emails
Spectra Legacy – Gutenberg Blocks
≤2.3.1Update to 2.3.2
- High8.8Authenticated (Subscriber+) SQL Injection
WP Google Review Slider
≤11.7Update to 11.8
- High8.8Authenticated (Subscriber+) SQL Injection
WP TripAdvisor Review Slider
≤10.7Update to 10.8
- High8.8Authenticated (Subscriber+) SQL Injection
WP Yelp Review Slider
≤7.0Update to 7.1
- Critical9.1Unauthenticated Local File Inclusion
Extensive VC Addons for WPBakery Page Builder
≤1.9Update to 1.9.1
- Medium5.4Reflected Cross-Site Scripting
Parsi Date | بسته فارسی ساز وردپرس و ووکامرس پارسی دیت
≤4.0.1Update to 4.0.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Popups – WordPress Popup builder
≤2.1.4.8Update to 2.1.4.9
- Medium5.3Captcha Bypass
Spectra Legacy – Gutenberg Blocks
≤2.3.1Update to 2.3.2
- High8.1Authenticated (Subscriber+) Local File Inclusion
Customer Reviews for WooCommerce
≤5.15.0Update to 5.16.0
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
WP Terms Popup – Terms and Conditions and Privacy Policy WordPress Popups
≤2.6.0Update to 2.6.1
- Medium5.3Email Spoofing
Spectra Legacy – Gutenberg Blocks
≤2.3.1Update to 2.3.2
- High7.5Denial of Service
Autopost for X (formerly Autoshare for Twitter)
≤1.2.1Update to 1.3.0
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Modal Dialog
≤3.5.9Update to 3.5.10
- Medium4.3Cross Site Request Forgery
Name Directory
≤1.27.1Update to 1.27.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Image and Video Lightbox, Image PopUp
≤2.1.5Update to 2.1.6
- High8.8Authenticated (Subscriber+) SQL Injection
WP Airbnb Review Slider
≤3.2Update to 3.3
- High7.1Cross-Site Request Forgery
Material Design Icons for Page Builders
≤1.4.2Update to 1.4.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Lightweight Accordion
≤1.5.14Update to 1.5.15
- Medium5.4Missing Authorization
Ultimate Addons for Beaver Builder (UABB)
≤1.5.4Update to 1.5.5
- High8.8Authenticated (Subscriber+) SQL Injection
WP Review Slider
≤12.1Update to 12.2
- Medium5.4Cross-Site Request Forgery
Ultimate Addons for Beaver Builder (UABB)
≤1.5.4Update to 1.5.5
- High8.8Authenticated (Subscriber+) SQL Injection
Pinpoint Booking System – Legacy version
≤2.9.9.2.8Update to 2.9.9.2.9
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Upfrontwp
≤1.0No patch available