Database
WordPress Vulnerability Database (page 1195)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Missing Authorization
Post Teaser
≤4.1.5No patch available
- Medium6.1Reflected Cross-Site Scripting via datef
Chained Quiz
≤1.3.2Update to 1.3.2.1
- Medium5.4Cross-Site Request Forgery to Arbitrary Quiz Deletion and Copying
Chained Quiz
≤1.3.2.4Update to 1.3.2.5
- Medium6.6Authenticated (Admin+) PHP Object Injection
Kadence Starter Templates — Predesigned Website Templates
≤1.2.16Update to 1.2.17
- High8.8Cross Site Request Forgery
Advanced Booking Calendar
≤1.7.1No patch available
- Medium6.5Missing Authorization to Unauthenticated Arbitrary Content Deletion
Attorney
≤3No patch available
- Critical9.8Privilege Escalation
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
≤5.5.1Update to 5.6
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Login for Google Apps by WPAuth
≤3.4.4Update to 3.4.5
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Eventify – Events, Lists and Calendar
<2.2.0Update to 2.2.0
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Slider by 10Web – Responsive Image Slider
≤1.2.52Update to 1.2.53
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
1app Business Forms
≤1.0.0No patch available
- High8.8Missing Authorization leading to Authenticated (Subscriber+) Authorization Bypass
WP Tools Debug Log, Repair, Javascript errors, Jquery errors, Increase Maximum Limits, File Permissions, Transients, Error Log
≤3.41Update to 3.43
- Medium6.5Authenticated (Admin+) Arbitrary File Deletion
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more
≤1.5.1Update to 1.5.2
- High7.2Authenticated (Admin+) Remote Code Execution
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more
≤1.5.1Update to 1.5.2
- High8.8Cross-Site Request Forgery
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤5.6.8Update to 6.0.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Apptivo Business Site
≤3.0.12Update to 3.0.14
- Medium6.0Authenticated (Subscriber+) CSV Injection
Export Users Data CSV
≤2.1Update to 2.2
- Low2.7Authenticated (Admin+) Directory Traversal
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more
≤1.5.1Update to 1.5.2
- Critical9.8Geo Form Fields <= 1.0 - Unauthenticated SQL Injection
IWS – Geo Form Fields
≤1.0No patch available
- High7.5Information Disclosure via Arbitrary File Read
Welcart e-Commerce
2.6.10 – 2.8.4Update to 2.8.5
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Paytium: Mollie payment forms & donations
≤4.3.6Update to 4.3.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier
≤1.3.320Update to 1.3.321
- Medium5.8CSV Injection
Appointment Hour Booking – Booking Calendar
≤1.3.72Update to 1.3.73
- High7.2Unauthenticated iFrame Injection via Paragraph and Short Answer
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤8.0.4Update to 8.0.5
- High7.2Authenticated (Admin+) Remote Code Execution
Menu Item Visibility Control
≤0.5No patch available
- High7.2Unauthenticated iFrame Injection via Appointment Form
Appointment Hour Booking – Booking Calendar
≤1.3.72Update to 1.3.73
- Medium4.7Reflected Cross-Site Scripting via Cookie Value
Simple:Press Forum
≤6.8Update to 6.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Forum Replies
Simple:Press Forum
≤6.8Update to 6.8.1
- High7.5Authenticated (Author+) SQL Injection via cg_activate and cg_deactivate
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤19.1.4.1Update to 19.1.5
- Medium4.3Missing Authorization
Super Progressive Web Apps
≤2.2.8Update to 2.2.9