Database
WordPress Vulnerability Database (page 1196)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Super Progressive Web Apps
≤2.2.8Update to 2.2.9
- Medium4.7Reflected Cross-Site Scripting via Cookie Value
Simple:Press Forum
≤6.8Update to 6.8.1
- High8.1Authenticated (Subscriber+) Path Traversal to Arbitrary File Deletion
Simple:Press Forum
≤6.8Update to 6.8.1
- High7.7CSV Injection
WP CSV Exporter
≤1.3.6Update to 1.3.7
- High7.2Unauthenticated Stored Cross-Site Scripting via Forum Replies
Simple:Press Forum
≤6.8Update to 6.8.1
- Low3.8Authenticated (Admin+) Path Traversal to Arbitrary File Modification
Simple:Press Forum
≤6.8Update to 6.8.1
- Medium6.1Refleced Cross-Site Scripting
Download Manager
≤3.2.59Update to 3.2.60
- High7.2Unauthenticated Server-Side Request Forgery
Paytm Payment Gateway
≤2.7.0Update to 2.7.3
- High7.5Authenticated (Author+) SQL Injection via option_id
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤19.1.4.1Update to 19.1.5
- Medium6.5Missing Authorization to Arbitrary Popup Deletion
Popup Manager
≤1.6.6No patch available
- High8.8Cross-Site Request Forgery
Welcart e-Commerce
≤2.8.3Update to 2.8.4
- Critical9.8Local File Inclusion
InPost Gallery
≤2.1.4Update to 2.1.4.1
- High8.8Cross-Site Request Forgery
Better Click To Share – Shareable Quote Boxes for X (Twitter)
≤5.10.3Update to 5.10.4
- Medium6.5Missing Authorization to Arbitrary User Deletion
Pie Register – User Registration, Profiles & Content Restriction
≤3.8.1.2Update to 3.8.1.3
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.2Update to 1.8.3
- Medium4.3Missing Authorization
FlyingPress
≤3.9.6Update to 3.9.7
- Medium4.9Authenticated (Administrator+) Arbitrary File Download
Wholesale Market for WooCommerce
≤1.0.7Update to 1.0.8
- Medium6.5Missing Authorization to Arbitrary Plugin Deactivation
WP Shamsi – افزونه تاریخ شمسی و فارسی ساز وردپرس
≤4.1.0Update to 4.1.1
- High7.2Unauthenticated Stored Cross-Site Scripting
Popup Manager
≤1.6.6No patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
External Media
≤1.0.35Update to 1.0.36
- Medium6.4Authenticated (Subscriber+) Cross-Site Scripting
Wholesale Suite – B2B, Dynamic Pricing & WooCommerce Wholesale Prices
≤2.1.5Update to 2.1.5.1
- Medium6.5Missing Authorization
Better Click To Share – Shareable Quote Boxes for X (Twitter)
≤5.10.3Update to 5.10.4
- High7.5Unauthenticated Arbitrary File Download
Wholesale Market for WooCommerce
≤1.0.6Update to 1.0.7
- Medium6.5Missing Authorization
Theme and plugin translation for Polylang (TTfP)
≤3.2.16Update to 3.2.17
- Medium4.3Authenticated (Subscriber+) Sensitive Information Disclosure
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤7.4.3Update to 7.4.4
- Critical9.8Unauthenticated Arbitrary File Upload
JobBoardWP – Job Board Listings and Submissions
≤1.2.1Update to 1.2.2
- Critical9.8Unauthenticated SQL Injection
JoomSport – for Sports: Team & League, Football, Hockey & more
≤5.2.7Update to 5.2.8
- Medium4.7Open Redirect
Age Gate
<2.13.5Update to 2.13.5
- Medium6.3Insecure Direct Object Reference to Forum Privacy Change
wpForo Forum
≤2.0.5Update to 2.0.6
- High8.8Cross-Site Request Forgery
Organization chart
1.4.1 – 1.4.1Update to 1.4.2