Database
WordPress Vulnerability Database (page 1203)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery to Settings Reset
a3 Portfolio
≤3.0.1Update to 3.0.2
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scritping
Accessibility
≤1.0.2Update to 1.0.3
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Font Awesome 4 Menus
≤4.7.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Video Thumbnails
≤2.12.3No patch available
- High8.8Authenticated (Contributor+) SQL Injection
OWM Weather
≤5.6.8Update to 5.6.9
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
AM-HiLi
≤1.0No patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
4ECPS Web Forms
≤0.2.17Update to 0.2.18
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Salat Times
≤3.2.1Update to 3.2.2
- Medium6.5Missing Authorization and Sensitive Information Exposure
Download Plugin
≤1.6.2Update to 2.0.0
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Find and Replace All
1.2 – 1.2Update to 1.3
- Critical9.1Unauthenticated Arbitrary File Deletion
WatchTowerHQ
≤3.6.15Update to 3.6.16
- High8.8Cross-Site Request Forgery to Settings Reset
Contact Us Page – Contact People
≤3.6.1Update to 3.6.2
- High8.8Cross-Site Request Forgery
Homepage Pop-up
≤1.2.5No patch available
- Medium6.5Missing Authorization
Permalink Manager Lite
≤2.2.20Update to 2.2.20.1
- Medium5.4Missing Authorization
Soledad
≤8.2.5Update to 8.2.6
- High8.8Cross-Site Request Forgery to Malware Scan Termination
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
≤5.6.1Update to 5.6.2
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Homepage Pop-up
≤1.2.5No patch available
- High8.6Unauthenticated Arbitrary File Download
WatchTowerHQ
≤3.6.15Update to 3.6.16
- Medium4.9Authenticated Directory Traversal to Sensitive Information Exposure
Download Monitor
≤4.7.2Update to 4.7.3
- High8.0Service Hostname Discovery Exploitation
Authorizer
<1.6.0Update to 1.6.0
- Medium6.1Cross-Site Request Forgery
Mantenimiento web
≤0.8Update to 0.9
- High7.2Authenticated (Administrator+) SQL Injection
Event Monster – Event Manager, Event Booking, Event Ticket & Registration
≤1.2.0Update to 1.2.1
- Medium4.3Insecure Direct Object Reference
Wallet for WooCommerce
≤1.4.3Update to 1.4.4
- Medium5.4Missing Authorization
Subscribe to Category
≤2.7.3No patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.16.10Update to 1.16.11
- High8.8Cross-Site Request Forgery
Booster Elite for WooCommerce
<1.1.7Update to 1.1.7
- Medium4.9Authenticated (Admin/Shop Manager+) Arbitrary File Download
Booster Elite for WooCommerce
<1.1.7Update to 1.1.7
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting
Gallery Images Ape
≤2.2.8No patch available
- High8.8Cross-Site Request Forgery to File Deletion
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤5.6.6Update to 5.6.7
- High8.1Privilege Escalation
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤3.5.28Update to 3.5.29