Database
WordPress Vulnerability Database (page 1176)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Image and Video Lightbox, Image PopUp
≤2.1.5Update to 2.1.6
- High8.8Authenticated (Subscriber+) SQL Injection
WP Yelp Review Slider
≤7.0Update to 7.1
- High8.8Authenticated (Subscriber+) SQL Injection
WP Airbnb Review Slider
≤3.2Update to 3.3
- Medium5.4Reflected Cross-Site Scripting
Parsi Date | بسته فارسی ساز وردپرس و ووکامرس پارسی دیت
≤4.0.1Update to 4.0.2
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
WP Terms Popup – Terms and Conditions and Privacy Policy WordPress Popups
≤2.6.0Update to 2.6.1
- Medium4.3Cross-Site Request Forgery
PixelYourSite – Your smart PIXEL (TAG) & API Manager
≤9.3.0Update to 9.3.1
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WPBot – ChatBot Conversational Forms
≤1.1.6Update to 1.1.7
- Medium4.3Cross Site Request Forgery
Bubble Menu – Floating Button Menu with Sticky Navigation
≤3.0.1Update to 3.0.2
- Medium5.5Authenticated (Admin+) Cross Site Scripting
VikRentCar Car Rental Management System
≤1.3.0Update to 1.3.1
- Medium5.3Missing Authorization to Unauthenticated Content Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤5.1.9.2Update to 5.1.9.3
- Medium5.3Improper Authorization to Price Change
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤5.1.9.2Update to 5.1.9.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
WPMobile.App – Android and iOS App Builder
≤11.13Update to 11.14
- Medium4.3Cross-Site Request Forgery
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)
≤2.0.8Update to 2.0.9
- Critical9.8Unauthenticated Local File Inclusion
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.1.7.3.2Update to 4.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Social Comments by Heateor
≤1.6.1Update to 1.6.2
- Medium4.3Cross-Site Request Forgery
Responsive Vertical Icon Menu
≤1.5.8Update to 1.5.9
- Medium5.5Authenticated (Admin+) Stored Cross Site Scripting
Social Like Box and Page by WpDevArt
≤0.8.39Update to 0.8.40
- Medium4.3Missing Access Control leading to Authenticated (Subscriber+) Sensitive Information Disclosure
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤3.4.10Update to 3.4.11
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Media Library Categories
≤1.9.9Update to 2.0.0
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
WP Smart Preloader
≤1.15Update to 1.15.1
- Medium4.3Cross Site Request Forgery
Participants Database
≤2.4.5Update to 2.4.6
- High7.2Authenticated (Subscriber+) SQL Injection
RapidLoad AI – Optimize Web Vitals Automatically
≤1.6.35Update to 1.6.36
- Medium6.3Cross-Site Request Forgery
Quick Event Manager
≤9.7.4Update to 9.7.5
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Responsive Vertical Icon Menu
≤1.5.8Update to 1.5.9
- Medium4.3Cross Site Request Forgery
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
≤2.5.0Update to 2.5.1
- Critical9.8Unauthenticated SQL Injection
FL3R FeelBox
≤8..1No patch available
- Medium4.3Cross-Site Request Forgery
WP Airbnb Review Slider
≤3.2Update to 3.3
- High7.1Cross-Site Request Forgery
Pods – Custom Content Types and Fields
≤2.9.10.2Update to 2.9.11
- Low3.8Authenticated (Admin+) Stored Cross Site Scripting
WP Time Slots Booking Form
≤1.1.81Update to 1.1.82
- Medium5.5Authenticated (Admin+) Cross Site Scripting
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
1.2.54.0 – 1.2.54.0Update to 1.2.54.1