Database
WordPress Vulnerability Database (page 1197)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Missing Authorization
Organization chart
≤1.4.1Update to 1.4.2
- High8.1Missing Authorization
Authenticator
≤1.3.0Update to 1.3.1
- High8.8Cross-Site Request Forgery
Uncanny Toolkit for LearnDash
≤3.6.3Update to 3.6.4
- Medium5.4Open Redirect
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.7Update to 1.8.8
- High8.8Cross-Site Request Forgery
Organization chart
1.4.1 – 1.4.1Update to 1.4.2
- Medium5.5Authenticated (Administrator+) Stored Cross Site Scripting
Community Events
≤1.4.8Update to 1.4.9
- High8.8Arbitrary File Upload
Return Refund and Exchange For WooCommerce
≤4.0.8Update to 4.0.9
- High7.3Missing Authorization
Kenta Blocks – Responsive Blocks and block templates library
≤1.0.7Update to 1.1.0
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Content Repeater – Custom Posts Simplified
≤1.1.13No patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WP Clictracker
≤1.0.5No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Content Repeater – Custom Posts Simplified
≤1.1.3No patch available
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting
WHA Puzzle
≤1.0.9Update to 1.1.0
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Quizlord
≤2.0No patch available
- Medium4.3Race Condition
WP ULike – Like Buttons, Voting & Engagement Analytics
≤4.6.4Update to 4.6.5
- Medium5.4Missing Authorization
ShareThis Dashboard for Google Analytics
≤3.1.4Update to 3.1.5
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Activello
≤1.4.6Update to 1.4.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Smart Slider 3
≤3.5.1.9Update to 3.5.1.11
- Medium6.4Reflected Cross-Site Scripting
Activello
≤1.4.6Update to 1.4.7
- High8.8Authenticated (Contributor+) PHP Object Injection
Smart Slider 3
≤3.5.1.9Update to 3.5.1.11
- High7.5Sensitive Information Disclosure
Defender Security – Malware Scanner, Login Security & Firewall
≤3.3.2Update to 3.3.3
- Medium6.5Authenticated (Contributor+) Arbitrary File Read
WP-FormAssembly
≤2.0.5Update to 2.0.6
- High8.8Cross-Site Request Forgery
Image Map Pro – Drag-and-drop Builder for Interactive Images
<5.6.9Update to 5.6.9
- High7.5Sensitive Data Exposure of Multifactor Backup Codes
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
≤5.6.1Update to 5.6.2
- High8.8Cross-Site Request Forgery
Image Map Pro – Drag-and-drop Builder for Interactive Images
<5.6.9Update to 5.6.9
- Medium6.1Cross-Site Scripting
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤13.1.0.9Update to 14.0.0
- High7.2Unauthenticated Cross-Site Scripting
Contact Form, Survey, Quiz & Popup Form Builder – ARForms
≤1.5.6Update to 1.5.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Videojs HTML5 Player
≤1.1.8Update to 1.1.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Responsive Lightbox2
≤1.0.3Update to 1.0.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Easy Video Player
≤1.2.2.2Update to 1.2.2.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WP Stripe Checkout
≤1.2.2.20Update to 1.2.2.21