Database
WordPress Vulnerability Database (page 1189)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Authenticated (Admin+) PHP Object Injection
Anti-Malware Security and Brute-Force Firewall
≤4.21.85Update to 4.21.86
- Critical9.1Missing Authorization to Arbitrary File Deletion
Images Optimize and Upload CF7
≤2.1.4Update to 2.2.1
- Medium4.3Cross-Site Request Forgery
RD Order Modifier for WooCommerce
≤1.0.5Update to 1.0.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Seriously Simple Podcasting
≤2.19.0Update to 2.19.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Page scroll to id
≤1.7.5Update to 1.7.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Social Sharing Plugin – Sassy Social Share
≤3.3.44Update to 3.3.45
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Meteor Slides
≤1.5.6Update to 1.5.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Click to Chat – HoliThemes
≤3.18Update to 3.18.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Mesmerize Companion
≤1.6.133Update to 1.6.135
- Medium6.1Reflected Cross-Site Scripting
Post Status Notifier Lite
≤1.10.0Update to 1.10.1
- High8.8Authenticated (Subscriber+) SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.1.7.3.2Update to 4.2.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
≤4.1.5Update to 4.1.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
FOX – Currency Switcher Professional for WooCommerce
≤1.3.9.2Update to 1.3.9.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Ibtana – WordPress Website Builder
≤1.1.8.7Update to 1.1.8.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
FOX – Currency Switcher Professional for WooCommerce
≤1.3.9.3Update to 1.3.9.4
- Medium5.5Authenticated (Administrator+) Stored Stored Cross-Site Scripting
Metricool – Social media and site statistics
≤1.17Update to 1.18
- Medium4.1CSV Injection
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.2.19Update to 2.2.20
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Download Manager
≤3.2.61Update to 3.2.62
- Medium6.5Cross-Site Request Forgery
ActiveCampaign for WooCommerce
≤1.9.7Update to 1.9.8
- Medium4.3Cross-Site Request Forgery leading to Arbitrary Options Update
Mautic Integration for WooCommerce
<1.0.3Update to 1.0.3
- Critical9.8Authenticated (Admin+) SQL Injection
WP Pipes
≤1.33Update to 1.4.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
≤5.4.4Update to 5.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WP Recipe Maker
≤8.6.0Update to 8.6.1
- High7.2Authenticated (Administrator+) Arbitrary File Upload
WPtouch – Make your WordPress Website Mobile-Friendly
≤4.3.44Update to 4.3.45
- Medium6.4Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode
iPages – FlipBook Image & PDF Viewer
≤1.4.6Update to 1.4.7
- High7.2Unauthenticated Stored Cross-Site Scripting
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤4.9.2Update to 4.9.3
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Sidebar Widgets by CodeLights
≤1.4No patch available
- High7.2Authenticated (Administrator+) PHP Object Injection
WPtouch – Make your WordPress Website Mobile-Friendly
≤4.3.44Update to 4.3.45
- Medium5.5Reflected Cross-Site Scripting
connectDaily Events Calendar Plugin
≤1.4.4Update to 1.4.5
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Multi Step Form
≤1.7.7Update to 1.7.8