Database
WordPress Vulnerability Database (page 1202)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Seed Social
≤2.0.2Update to 2.0.3
- High7.2Authenticated (Admin+) SQL Injection
WP User Merger
≤1.5.2Update to 1.5.3
- Medium4.3Insecure Direct Object Reference to (Subscriber+) Ticket Export
Awesome Support – WordPress HelpDesk & Support Plugin
≤6.1.1Update to 6.1.2
- High7.2Authenticated (Admin+) SQL Injection
WP User Merger
≤1.5.2Update to 1.5.3
- High8.8Authenticated (Author+) SQL Injection
WPSmartContracts
≤1.3.11Update to 1.3.12
- Medium5.3Missing Authorization to Settings Changes
LoginPress | wp-login Custom Login Page Customizer
≤1.6.2Update to 1.6.3
- High8.8Cross-Site Request Forgery
Testimonial Slider
≤1.3.1Update to 1.3.2
- High7.2Authenticated (Admin+) SQL Injection
WP User Merger
≤1.5.2Update to 1.5.3
- Medium5.5Authenticated (Administrator+) Cross-Site Scripting
WP Admin UI Customize
≤1.5.12Update to 1.5.13
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Donations via PayPal
≤1.9.8Update to 1.9.9
- High8.8Cross-Site Request Forgery to Arbitrary Content Replacement
Find and Replace All
≤1.3No patch available
- High8.8Cross-Site Request Forgery to Reflected Cross-Site Scripting
Find and Replace All
≤1.3No patch available
- Medium5.4Authorization Bypass
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
≤2.5.6Update to 2.5.7
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Responsive Lightbox & Gallery
≤2.4.1Update to 2.4.2
- High8.6Unauthenticated Authorization Bypass
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
≤2.5.6Update to 2.5.7
- Medium4.8CSV Injection
PiWeb Export Customers Users & Guest customer to CSV for WooCommerce
≤2.0.67Update to 2.0.69
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Beautiful Cookie Consent Banner
≤2.9.0Update to 2.9.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Analytics for WP
≤1.5.1No patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Image Hover Effects Css3
≤4.5No patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
reCAPTCHA
≤1.6No patch available
- Medium6.5Missing Authorization
001 Prime Strategy Translate Accelerator
≤1.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.8.0Update to 1.8.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Fancier Author Box by ThematoSoup
≤1.4No patch available
- Medium5.5Cross-Site Request Forgery to Cross-Site Scripting
Showing URL in QR Code
≤0.0.1No patch available
- High8.8Cross-Site Request Forgery
VR Calendar
≤2.3.3Update to 2.3.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Google Forms
≤0.95No patch available
- High8.8Cross-Site Request Forgery
Jeeng Push Notifications
≤2.0.3Update to 2.0.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Jeeng Push Notifications
≤2.0.3Update to 2.0.4
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Find and Replace All
1.2 – 1.2Update to 1.3
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scritping
Accessibility
≤1.0.2Update to 1.0.3