Database
WordPress Vulnerability Database (page 1205)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.7Authenticated (Admin+) Directory Traversal
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
1.0 – 2.5.0Update to 2.5.1
- High8.8Cross-Site Request Forgery to Plugin Deactivation
Creative Mail – Easier WordPress & WooCommerce Email Marketing
≤1.5.4Update to 1.6.0
- High7.2Authenticated (Admin+) Remote Code Execution via Multi-Select
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.5.0Update to 2.5.1
- High8.8Cross-Site Request Forgery to Settings Disconnect
Creative Mail – Easier WordPress & WooCommerce Email Marketing
≤1.5.4Update to 1.6.0
- High7.2Authenticated (Admin+) Limited Remote Code Execution via um_populate_dropdown_options
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.5.0Update to 2.5.1
- Medium5.4Insecure Direct Object References
Comments – wpDiscuz
≤7.4.2Update to 7.5
- High8.8Cross-Site Request Forgery to Arbitrary SQL Query Execution
My wpdb
<2.5Update to 2.5
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Super Testimonial – Testimonial & Customer Review Slider Plugin for WordPress
≤2.6Update to 2.7
- Medium5.3Missing Authorization to Sensitive Information Disclosure
Syncee for Suppliers
≤1.0.5Update to 1.0.10
- Medium5.4Missing Authorization to Information Exposure
ProfileGrid – User Profiles, Groups and Communities
≤5.0.3Update to 5.0.4
- High7.2CSV Injection
Database Addon for Contact Form 7 – CFDB7
≤1.2.6.3Update to 1.2.6.5
- High8.8Cross-Site Request Forgery
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤5.6.6Update to 5.6.7
- High8.8Cross-Site Request Forgery
Event Monster – Event Manager, Event Booking, Event Ticket & Registration
≤1.1.20Update to 1.2.0
- Medium4.3Missing Authorization.
Syncee Premium Dropshipping & Wholesale
≤1.0.9Update to 1.0.10
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Spacer
≤3.0.6Update to 3.0.7
- High8.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Zoho CRM Lead Magnet
≤1.7.5.8Update to 1.7.5.9
- Medium6.4Authenticated (Contributor+) Stored Stored Cross-Site Scripting
BuddyForms
≤2.7.2Update to 2.7.3
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
JetBackup – Backup, Restore & Migrate
≤1.6.9Update to 1.6.9.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gallery with thumbnail slider
≤6.0Update to 6.1
- Medium6.5Authenticated (Shop Manager+) Information Exposure via Arbitrary File Download
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤5.6.6Update to 5.6.7
- Critical9.6Server Side Request Forgery
Web Stories
≤1.24.0Update to 1.25.0
- High8.8Cross-Site Request Forgery
reSmush.it : The original free image compressor and optimizer plugin
≤0.4.6Update to 0.4.7
- High8.8Cross-Site Request Forgery
Advanced Dynamic Pricing and Discount Rules for WooCommerce
≤4.1.5Update to 4.1.6
- High8.8Cross-Site Request Forgery
SEO Redirection Plugin – 301 Redirect Manager
≤8.9Update to 9.1
- Medium6.3Missing Authorization
Advanced Dynamic Pricing and Discount Rules for WooCommerce
≤4.1.5Update to 4.1.6
- High7.2Authenticated (Admin+) Arbitrary Options Update
Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )
≤9.7.1Update to 9.7.2
- High8.8Authenticated (Contributor+) Arbitrary File Upload
GEO Plugin by Squirrly SEO
≤12.1.10Update to 12.1.11
- High8.8Cross-Site Request Forgery
WPQA - Builder forms Addon For WordPress
<5.9Update to 5.9
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Related Posts for WordPress
≤2.1.2Update to 2.1.3
- High8.8Cross-Site Request Forgery
Simple Website Banner
≤1.7.0.6Update to 1.8.0.0