Database
WordPress Vulnerability Database (page 1181)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WP Better Emails
≤0.4No patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WP-OliveCart
≤1.1.3No patch available
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting
ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
≤7.12.0Update to 7.12.1
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
No API Amazon Affiliate
≤4.2.2Update to 4.4.0
- Medium5.4Cross-Site Request Forgery leading to Unused Image Deletion and Database Image Access
DNUI
≤2.8.1No patch available
- High8.8Cross Site Request Forgery
Online Exam Software : eExamhall
≤4.0No patch available
- High7.4Missing Authorization Checks leading to Authenticated (Subscriber+) Stored Cross-Site Scripting
YourChannel: Everything you want in a YouTube plugin.
≤1.2.1Update to 1.2.2
- Medium4.3Improper Authorization
Advanced Custom Fields: Image Crop Add-on
≤1.4.12No patch available
- High7.2Authenticated (Administrator+) SQL Injection
Custom 404 Pro
≤3.7.0Update to 3.7.1
- Medium5.5Authenticated (Administrator+) Stored Cross Site Scripting
alfred24 Click & Collect
≤1.1.7No patch available
- High7.2Authenticated (Administrator+) SQL Injection
Security Optimizer – The All-In-One Protection Plugin
≤1.3.0Update to 1.3.1
- High7.2Cross-Site Scripting
MagicForm
≤0.1No patch available
- High8.8Cross Site Request Forgery
ipBlockList
≤1.0No patch available
- Low3.7Information Disclosure
Freesoul Deactivate Plugins – Disable plugins on individual WordPress pages
≤1.9.4.0Update to 1.9.4.1
- High8.8Missing Authorization
Dashicons + Custom Post Types
≤1.0.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)
≤8.12.0Update to 8.12.1
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WP Super Popup
≤1.1.2No patch available
- High8.8Cross-Site Request Forgery
Crayon Syntax Highlighter
≤2.8.4No patch available
- High8.8Cross-Site Request Forgery
Extra Block Design, Style, CSS for ANY Gutenberg Blocks
≤0.2.6Update to 0.2.7
- High8.8Cross-Site Request Forgery
Hover Image
≤1.4.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Map Multi Marker
≤3.2.1No patch available
- High8.8Cross Site Request Forgery
Superior FAQ
≤1.0.2No patch available
- High8.8Authenticated (Subscriber+) Remote Code Execution
WP Booklet
≤2.1.8No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'yrc_lang[Videos]'
YourChannel: Everything you want in a YouTube plugin.
≤1.2.1Update to 1.2.2
- High8.8Cross-Site Request Forgery
Universal Star Rating
≤2.1.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Blocks
Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms
≤1.21.1Update to 1.22.0
- Critical9.8Unauthenticated SQL Injection
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
≤2.9.7Update to 2.9.8
- High8.8Authenticated (Subscriber+) SQL Injection
Survey Maker by AYS
≤3.1.1Update to 3.1.2
- Medium5.4Cross-Site Request Forgery
GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
≤2.5.0Update to 2.5.1
- High7.2Authenticated (Admin+) SQL Injection
Simple Membership WP user Import
≤1.7Update to 1.8