Database
WordPress Vulnerability Database (page 1180)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Missing Authorization to Plugin Settings Change
MainWP Clone Extension
≤4.0.2Update to 4.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Judge.me Product Reviews for WooCommerce
≤1.3.20Update to 1.3.21
- Medium5.4Missing Authorization to Arbitrary Plugin Activation
MainWP Page Speed Extension
≤4.0.2Update to 4.0.3
- Medium5.4Missing Authorization to Arbitrary Plugin Activation
MainWP Staging Extension
≤4.0.3Update to 4.0.4
- Medium5.4Missing Authorization to Arbitrary Plugin Activation
MainWP WordPress SEO Extension
≤4.0.1Update to 4.0.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
TemplatesNext ToolKit
≤3.2.7Update to 3.2.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Responsive Gallery Grid
≤2.3.8Update to 2.3.9
- Medium6.4Missing Authorization to Plugin Settings Change
MainWP Code Snippets Extension
≤4.0.2Update to 4.0.3
- High7.1Missing Authorization to Arbitrary Page/Post Deletion
MainWP Post Plus Extension
≤4.0.3Update to 4.1.1
- Medium6.5Missing Authorization to Information Disclosure
WP FullCalendar
≤1.4.1Update to 1.5
- Medium6.4Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
WidgetShortcode
≤0.3.5No patch available
- Medium6.4Authenticaterd (Contributor+) Stored Cross-Site Scripting via Shortcode
YaMaps for WordPress Plugin
≤0.6.25Update to 0.6.26
- High8.8Authenticated (Subscriber+) SQL Injection
Lasso Lite – Affiliate Link Manager, URL Shortener & Link Tracking
≤114Update to 115
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
MainWP File Uploader Extension
≤4.1Update to 4.1.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Widget Shortcode
≤0.3.5No patch available
- Medium6.4Missing Authorization to Plugin Settings Change
MainWP Wordfence Extension
≤4.0.7Update to 4.0.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Rich Table of Contents
≤1.3.8Update to 1.3.9
- Medium5.4Missing Authorization to Authenticated (Subscriber+) Plugin Options Update
Kraken.io Image Optimizer – Compress, Convert to WebP & AVIF, Resize & Bulk Optimize
≤2.6.7Update to 2.6.8
- Medium5.4Missing Authorization to Arbitrary Plugin Activation
MainWP Buddy Extension
≤4.0.1Update to 4.0.2
- High8.8Authenticated (Author+) Arbitrary File Upload
Enable Media Replace
≤4.0.1Update to 4.0.2
- Medium6.4Missing Authorization to Plugin Settings Change
MainWP Maintenance Extension
≤4.1.1Update to 4.1.2
- High8.8Authenticated (Subscriber+) SQL Injection
MainWP Google Analytics Extension
≤4.0.4Update to 4.0.5
- Medium5.4Missing Authorization to Arbitrary Plugin Activation
MainWP Rocket Extension
≤4.0.3Update to 4.0.4
- Medium6.1Reflected Cross-Site Scripting
PDF Generator for WordPress
≤1.1.1Update to 1.1.2
- Medium4.3Missing Authorization to Sensitive Information Disclosure
Stream – Activity Log & Audit Trail
≤3.9.1Update to 3.9.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Simple Tooltips
≤2.1.3Update to 2.1.4
- Medium4.4Authenticated(Admin+) Stored Cross-Site Scripting
WP Private Content Plus
≤3.4Update to 3.5
- Medium5.5Authenticated (Administrator+) Cross-Site Scripting
Launchpad – Coming Soon & Maintenance Mode Plugin
≤1.0.13No patch available
- High8.8Cross-Site Request Forgery
Mediamatic – Media Library Folders
≤2.8.1Update to 3.0
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
No API Amazon Affiliate
≤4.2.2Update to 4.4.0