Database
WordPress Vulnerability Database (page 1184)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WP Social Widget
≤2.2.3Update to 2.2.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scriptiong via Shortcode
Post List Designer – Category Post, Recent Post, Post List
≤3.1Update to 3.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Custom User Profile Fields for User Registration & Member Frontend Profiles with Paid Memberships Pro
≤1.8Update to 1.8.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Simple File Downloader
≤1.0.4No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attribute
Contextual Related Posts
≤3.3.0Update to 3.3.1
- Medium5.4Cross-Site Request Forgery
Social Sharing Plugin – Social Warfare
≤4.3.1Update to 4.4.0
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
CPO Companion
≤1.0.4Update to 1.1.0
- Medium6.4Authenticated (Contributor+) Stored XSS
Widgets for Google Reviews
≤9.7.1Update to 9.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
CC Child Pages
≤1.42Update to 1.43
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WP Extended Search
≤2.1.1Update to 2.1.2
- Medium5.4Missing Authorization
Social Sharing Plugin – Social Warfare
≤4.3.0Update to 4.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Video Sidebar Widgets
≤6.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Themify Shortcodes
≤2.0.7Update to 2.0.8
- Medium4.3Missing Authorization
My YouTube Channel
≤3.0.12.1Update to 3.23.0
- Medium4.3Cross-Site Request Forgery leading to Plugin Settings Reset
FL3R FeelBox
≤8.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Social Sharing Toolkit
≤2.6No patch available
- Medium5.4Missing Authorization to Arbitrary Media Deletion and Creation
Logaster Logo Generator
≤1.3No patch available
- Medium5.4Cross-Site Request Forgery to Settings Update
JetWidgets For Elementor
≤1.0.12Update to 1.0.13
- Critical9.1Missing Authorization to Arbitrary Options Update
WooCommerce Chained Products
<2.12.0Update to 2.12.0
- Medium6.4Post and Widget <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Blog Designer – Post and Widget
≤2.3Update to 2.4
- Medium4.3Cross-Site Request Forgery
RSS Feed Retriever
≤1.6.7Update to 1.6.8
- Medium6.6Authenticated (Admin+) PHP Object Injection
Revive Social – Social Media Auto Post and Scheduling Automation Plugin
≤9.0.10Update to 9.0.11
- Medium5.4Missing Authorization
RSS Feed Retriever
≤1.6.7Update to 1.6.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
MDTF – Meta Data and Taxonomies Filter
≤1.3.0.1Update to 1.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Video.js – HTML5 Video Player for WordPress
≤4.5.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Twitter Cards Meta – Best Twitter Card Plugin for WordPress
≤2.9.1No patch available
- Critical9.8Reflected File Download
Amazon Affiliate
≤3.12.2Update to 3.12.3
- Medium5.4Missing Authorization
Show-Hide / Collapse-Expand
≤1.2.6Update to 1.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Pricing Table WordPress Plugin – Easy Pricing Tables
≤3.2.2Update to 3.2.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Lightbox Gallery
≤0.9.4Update to 0.9.5