Database
WordPress Vulnerability Database (page 1194)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Authenticated (Author+) SQL Injection via cg_option_id
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤19.1.4.1Update to 19.1.5
- High8.1Unauthenticated SQL Injection via cg_Fields
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤19.1.4.1Update to 19.1.5
- Medium6.1Reflected Cross-Site-Scripting
Essential Real Estate
≤3.9.6Update to 4.0.0
- High7.5Authenticated (Author+) SQL Injection via wp_user_id
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤19.1.4.1Update to 19.1.5
- Medium4.3Cross-Site Request Forgery
Loginizer
<1.7.6Update to 1.7.6
- High7.5Authenticated (Author+) SQL Injection via cg_id
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤19.1.5Update to 19.1.5.1
- High8.8Cross-Site Request Forgery
Custom Content by Country (by Shield Security)
3.1.2 – 3.1.2Update to 3.1.3
- Medium6.1Stored Cross-Site Scripting via Cross-Site Request Forgery
Supra CSV
≤4.0.3No patch available
- High8.8Cross-Site Request Forgery
WP Mail Log
≤1.0.1Update to 1.0.2
- Medium6.1Reflected Cross-Site Scripting via pointsf
Chained Quiz
≤1.3.2Update to 1.3.2.1
- Medium6.1Reflected Cross-Site Scripting via date
Chained Quiz
≤1.3.2.3Update to 1.3.2.4
- High8.8Cross-Site Request Forgery
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤2.9.13Update to 2.9.14
- Medium5.4Cross-Site Request Forgery to Question Deletion
Chained Quiz
≤1.3.2.4Update to 1.3.2.5
- Medium6.3Missing Authorization
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
≤2.9.13Update to 2.9.14
- Medium6.1Reflected Cross-Site Scripting via ip
Chained Quiz
≤1.3.2.3Update to 1.3.2.4
- Medium5.4Insecure Direct Object Reference
Workreap - Freelance Marketplace and Directory WordPress Theme
≤2.6.3Update to 2.6.4
- Medium6.1Reflected Cross-Site Scripting via ipf
Chained Quiz
≤1.3.2Update to 1.3.2.1
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WP Google Review Slider
≤11.5Update to 11.6
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via Mailchimp API Key
Chained Quiz
≤1.3.2.2Update to 1.3.2.3
- Medium6.1Reflected Cross-Site Scripting
Bulk Delete Users by Email
≤1.2Update to 2.0.0
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Simple Basic Contact Form
≤20220207Update to 20221201
- Medium5.4Missing Authorization
Post Teaser
≤4.1.5No patch available
- High8.8Cross-Site Request Forgery
Bulk Delete Users by Email
≤1.2Update to 2.0.0
- Medium6.1Reflected Cross-Site Scripting via emailf
Chained Quiz
≤1.3.2Update to 1.3.2.1
- Medium5.4Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copying
Chained Quiz
≤1.3.2.4Update to 1.3.2.5
- Medium6.1Reflected Cross-Site Scripting via datef
Chained Quiz
≤1.3.2Update to 1.3.2.1
- Medium6.1Reflected Cross-Site Scripting via dnf
Chained Quiz
≤1.3.2Update to 1.3.2.1
- Medium5.5Authenticated (Admin+) Stored XSS
ImageInject
≤1.18No patch available
- High7.2Authenticated (Administrator+) SQL Injection
Plugin Logic
≤1.0.7Update to 1.0.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via Facebook App ID
Chained Quiz
≤1.3.2.2Update to 1.3.2.3