Database
WordPress Vulnerability Database (page 1185)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Video Sidebar Widgets
≤6.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Show-Hide / Collapse-Expand
≤1.2.5Update to 1.3.0
- Medium4.7Cross-Site Request Forgery leading to Stored Cross-Site Scripting
FL3R FeelBox
≤8.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Post Category Image With Grid and Slider
≤1.4.7Update to 1.4.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Lightbox Gallery
≤0.9.4Update to 0.9.5
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
My YouTube Channel
≤3.0.12.1Update to 3.23.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
≤4.1.0Update to 4.1.1
- Medium5.4Insecure Direct Object Reference
Eway Payments for Woo
≤3.5.0Update to 3.5.1
- Medium5.4Cross-Site Request Forgery to Arbitrary Media Deletion and Creation
Logaster Logo Generator
≤1.3No patch available
- Critical9.8Reflected File Download
Amazon Affiliate
≤3.12.2Update to 3.12.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
List Pages Shortcode
≤1.7.5Update to 1.7.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Product Slider and Carousel with Category for WooCommerce
≤2.7.1Update to 2.8
- Medium5.4Missing Authorization
Show-Hide / Collapse-Expand
≤1.2.6Update to 1.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Pricing Table WordPress Plugin – Easy Pricing Tables
≤3.2.2Update to 3.2.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Youtube Channel Gallery
≤2.4No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
PixCodes
≤2.3.6Update to 2.3.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Simple Sitemap – Responsive HTML Sitemap for WordPress
≤3.5.7Update to 3.5.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Accordion Shortcodes
≤2.4.2No patch available
- Medium4.3Missing Authorization & Cross-Site Request Forgery
Analytify – Google Analytics 4 Tracking and Reporting in WordPress
≤4.2.3Update to 4.3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
MediaElement.js – HTML5 Video & Audio Player
≤4.2.8No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Block
Knowledge Base
≤2.1.1Update to 2.1.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Icon Widget
≤1.2.6Update to 1.3.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Survey Maker by AYS
≤3.1.3Update to 3.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Bold Timeline Lite
≤1.1.4Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting
Bitcoin Payments – Blockonomics
≤3.5.7Update to 3.5.8
- Medium5.5Self Cross-Site Scripting
Members Import
≤1.4.2No patch available
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Mailjet Email Marketing
≤5.3Update to 5.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
PowerFolio – Portfolio & Image Gallery for Elementor
≤2.3Update to 2.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
CPT Bootstrap Carousel
≤1.12Update to 1.13
- High7.1Cross-Site Request Forgery
My Calendar – Accessible Event Manager
≤3.3.24.1Update to 3.3.25