Database
WordPress Vulnerability Database (page 1200)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.42.5.1 - Insecure Plugin Defaults to Cross-Site Scripting
SVG Support
2.5 – 2.5.1Update to 2.5.2
- Medium5.4Missing Authorization
Rich Showcase for Google Reviews
≤2.2.2Update to 2.2.3
- High8.8Cross-Site Request Forgery
Rich Showcase for Google Reviews
≤2.2.2Update to 2.2.3
- High8.8Cross-Site Request Forgery
Permalink Manager Lite
≤2.2.20.1Update to 2.2.20.2
- Medium6.1Reflected Cross-Site Scripting
Plug your WooCommerce into the largest catalog of customized print products from Helloprint
≤1.4.6Update to 1.4.7
- Medium5.3Authorization Bypass
Transposh WordPress Translation
≤1.0.9.6No patch available
- High8.8Cross-Site Request Forgery to Settings update
Feed Them Social – Social Media Feeds, Video, and Photo Galleries
≤2.9.9Update to 3.0.1
- High8.8Cross-Site Request Forgery
Becustom
≤1.0.5.2Update to 1.0.5.3
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Photospace Gallery
≤2.3.5No patch available
- Critical9.1Authenticated (Administrator+) SQL Injection
Comic Book Management System
<2.2.0Update to 2.2.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Feed Them Social – Social Media Feeds, Video, and Photo Galleries
≤2.9.9Update to 3.0.1
- High7.2Chaty <= 3.0.2 - Authenticated (Administrator+) SQL Injection
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
≤3.0.2Update to 3.0.3
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Follow Me Plugin
≤3.1.1No patch available
- High8.8Cross-Site Request Forgery
Advanced Import
≤1.3.7Update to 1.3.8
- Medium5.4Insecure Direct Objection Reference to Private Message Disclosure
Workreap - Freelance Marketplace and Directory WordPress Theme
<2.6.3Update to 2.6.3
- Critical9.1Algorithm Confusion
JWT Auth – WordPress JSON Web Token Authentication
≤2.1.0Update to 2.1.1
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Chameleon
≤1.4.3Update to 1.4.4
- High7.2Authenticated (Administrator+) Arbitrary File Upload
PostmagThemes One click Demo Import for WordPress Site
≤1.0.7Update to 1.0.8
- High7.1Missing Authorization
YITH WooCommerce Wishlist
≤3.14.0Update to 3.15.0
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Broken Link Checker
≤1.11.19Update to 1.11.20
- Medium5.4Missing Authorization
Activity Reactions For Buddypress
≤1.0.22No patch available
- High8.8Cross-Site Request Forgery
AdRotate Banner Manager
≤5.9Update to 5.9.1
- Medium4.3Cross-Site Request Forgery
YITH WooCommerce Wishlist
≤3.14.0Update to 3.15.0
- Medium6.5Missing Authorization Checks to Settings Update
Multi Location Marker
≤1.2Update to 1.3
- High8.8Cross-Site Request Forgery
Multi Location Marker
≤1.2Update to 1.3
- High8.8Cross-Site Request Forgery
Activity Reactions For Buddypress
≤1.0.22No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Add Comments
≤1.0.1No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WPUpper Share Buttons
≤3.42Update to 3.43
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Page Builder
≤1.2.8No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Uji Countdown
≤2.3Update to 2.3.1