Database
WordPress Vulnerability Database (page 1179)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
TemplatesNext ToolKit
≤3.2.8Update to 3.2.9
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
MainWP Article Uploader Extension
≤4.0.2Update to 4.0.3
- Medium6.5Missing Authorization
MainWP UpdraftPlus Extension
≤4.0.6Update to 4.0.7
- Critical9.8Unauthenticated PHP Object Injection
MainWP Links Manager Extension
≤2.1No patch available
- Medium4.3Cross-Site Request Forgery
Custom 404 Pro
≤3.7.1Update to 3.7.2
- Medium6.5Authenticated (Subscriber+) Arbitrary Plugin Installation
MainWP Favorites Extension
≤4.0.10Update to 4.0.11
- Critical9.8Unauthenticated Arbitrary File Upload
MainWP File Uploader Extension
≤4.1Update to 4.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
Better Font Awesome
≤2.0.3Update to 2.0.4
- High8.8Authenticated (Subscriber+) PHP Code Injection
MainWP Code Snippets Extension
≤4.0.2Update to 4.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting
teachPress
≤8.1.8Update to 8.1.9
- Medium5.4Missing Authorization to Arbitrary Plugin Activation
MainWP Page Speed Extension
≤4.0.2Update to 4.0.3
- Medium6.1Reflected Cross-Site Scripting
Lasso Lite – Affiliate Link Manager, URL Shortener & Link Tracking
≤114Update to 115
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
TemplatesNext ToolKit
≤3.2.7Update to 3.2.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WP Visitor Statistics (Real Time Traffic)
≤6.4Update to 6.5
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
oopspam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA)
≤1.1.35Update to 1.1.36
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Judge.me Product Reviews for WooCommerce
≤1.3.20Update to 1.3.21
- Medium6.4Missing Authorization to Plugin Settings Change
MainWP Maintenance Extension
≤4.1.1Update to 4.1.2
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
WidgetShortcode
≤0.3.5No patch available
- High8.8Authenticated (Subscriber+) SQL Injection
MainWP Google Analytics Extension
≤4.0.4Update to 4.0.5
- Medium5.4Missing Authorization to Arbitrary Plugin Activation
MainWP WordPress SEO Extension
≤4.0.1Update to 4.0.3
- High8.8Authenticated (Subscriber+) SQL Injection
Lasso Lite – Affiliate Link Manager, URL Shortener & Link Tracking
≤114Update to 115
- Medium5.4Missing Authorization to Arbitrary Plugin Activation
MainWP Buddy Extension
≤4.0.1Update to 4.0.2
- Medium5.4Missing Authorization to Arbitrary Plugin Activation
MainWP Staging Extension
≤4.0.3Update to 4.0.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Widget Shortcode
≤0.3.5No patch available
- Medium6.4Authenticaterd (Contributor+) Stored Cross-Site Scripting via Shortcode
YaMaps for WordPress Plugin
≤0.6.25Update to 0.6.26
- Medium6.4Missing Authorization to Plugin Settings Change
MainWP Wordfence Extension
≤4.0.7Update to 4.0.8
- Medium6.4Missing Authorization to Plugin Settings Change
MainWP Code Snippets Extension
≤4.0.2Update to 4.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Responsive Gallery Grid
≤2.3.8Update to 2.3.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
TemplatesNext ToolKit
≤3.2.7Update to 3.2.8
- Medium5.4Missing Authorization to Arbitrary Plugin Activation
MainWP iThemes Security Extension
4.1.1. – 4.1.1.Update to 4.0.3