Database
WordPress Vulnerability Database (page 1199)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Image Hover Effects – WordPress Plugin
≤5.4Update to 5.5
- High8.8Cross-Site Request Forgery
Address Autocomplete Using Google Place Api
≤1.0.0No patch available
- Medium5.4Missing Authorization to Plugin Deactivation
10Web Booster – Website speed optimization, Cache & Page Speed optimizer
≤2.8.34Update to 2.8.35
- High8.8Authenticated (Subscriber+) PHP Object Injection
Betheme
≤26.5.1.4Update to 26.6
- Medium6.5Missing Authorization to Arbitrary Plugin Installation
Car Dealer (Dealership) and Vehicle sales
≤3.04Update to 3.05
- Medium6.5Missing Authorization to Arbitrary Plugin Installation
Memory Usage, Memory Limit, PHP and Server Memory Health Check and Provide Suggestions
≤2.45Update to 2.46
- Medium6.5Missing Authorization to Arbitrary Plugin Installation
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
≤7.23Update to 7.24
- Medium6.5Missing Authorization to Select Plugin Installation
WP Tools Debug Log, Repair, Javascript errors, Jquery errors, Increase Maximum Limits, File Permissions, Transients, Error Log
≤3.42Update to 3.43
- Medium5.3Unauthenticated Views Changes
WP Popular Posts
≤6.0.5Update to 6.1.0
- Medium5.4Missing Authorization
WooSwipe WooCommerce Gallery
≤3.0.2Update to 3.0.3
- Medium6.1Reflected Cross-Site Scripting
ULTIMATE TABLES
≤1.6.5No patch available
- Medium5.4Authorization Bypass
Crowdsignal Dashboard – Polls, Surveys & more
≤3.0.9Update to 3.0.10
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
iFeature Slider
≤1.2No patch available
- High7.2PHP Objection Injection
Shortcodes and extra features for Phlox theme
≤2.10.5Update to 2.10.7
- Medium6.1Reflected Cross-Site-Scripting
Essential Real Estate
≤3.9.5Update to 3.9.6
- Critical9.8Missing Authorization to Stored Cross-Site Scripting
Ezoic
≤2.8.8Update to 2.8.9
- Medium5.5Authenticated (Admininstrator+) Stored Cross-Site Scripting
News Announcement Scroll
≤8.8.8Update to 9.0.0
- Medium6.1Reflected Cross-Site Scripting
FlatPM – Ad Manager, AdSense and Custom Code
≤2.661Update to 2.662
- Medium6.3Authenticated (Subscriber+) CSV Injection
ProfileGrid – User Profiles, Groups and Communities
≤5.1.7Update to 5.1.8
- High7.2Authenticated (Administrator+) SQL Injection
buddybadges
≤1.0.0No patch available
- High8.8Authenticated (Subscriber+) PHP Object Injection
Betheme
≤26.5.1.4Update to 26.6
- High8.8Cross-Site Request Forgery
All-In-One Security (AIOS) – Security and Firewall
≤5.1.0Update to 5.1.1
- High7.2Authenticated (Admin+) Stored Cross-Site Scripting
Ezoic
≤2.8.8Update to 2.8.9
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Anthologize
≤0.8.0Update to 0.8.1
- High8.8Cross-Site Request Forgery
Welcart e-Commerce
≤2.8.3Update to 2.8.4
- Medium5.4Missing Authorization
Rich Showcase for Google Reviews
≤2.2.2Update to 2.2.3
- Medium6.42.5.1 - Insecure Plugin Defaults to Cross-Site Scripting
SVG Support
2.5 – 2.5.1Update to 2.5.2
- High8.8Cross-Site Request Forgery
Rich Showcase for Google Reviews
≤2.2.2Update to 2.2.3
- High8.8Cross-Site Request Forgery
Permalink Manager Lite
≤2.2.20.1Update to 2.2.20.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
DPD Baltic Shipping
≤1.2.8Update to 1.2.11