Database
WordPress Vulnerability Database (page 1210)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Missing Authorization to Table Modification
Table Generator
≤1.3.0No patch available
- Medium6.1Reflected Cross-Site Scripting
IP Blacklist Cloud
≤5.00No patch available
- Medium6.1Reflected Cross-Site Scripting
FontMeister – The Font Management Plugin
≤1.08No patch available
- Medium6.8Authenticated (Subscriber+) Server-Side Request Forgery
Blog2Social: Social Media Auto Post & Scheduler
≤6.9.9Update to 6.9.10
- Medium6.8Authenticated (Author+) CSV Injection
Post to CSV by BestWebSoft
≤1.3.8Update to 1.3.9
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Quick Restaurant Menu
≤2.0.0Update to 2.0.1
- High8.81.5.3 - Remote Code Execution
Bricks
1.2 – 1.5.3Update to 1.5.4
- High7.2Authenticated (Administrator+) SQL Injection
Anti-Spam, Spam FireWall by CleanTalk
≤5.185Update to 5.185.1
- Medium6.1Reflected Cross-Site Scripting
Related Posts for WordPress
≤2.1.1Update to 2.1.2
- High8.8Authenticated Remote Code Execution
WP All Export Pro
≤1.7.8Update to 1.7.9
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Retain Live Chat
≤0.1No patch available
- Medium6.5Unauthenticated Cache Poisoning
WP Super Cache
≤1.8Update to 1.9
- Medium6.51.5.3 - Missing Authorization to Arbitrary Content Creation/Modification
Bricks
1.0 – 1.5.3Update to 1.5.4
- High8.8Authenticated (Subscriber+) SQL Injection
Blog2Social: Social Media Auto Post & Scheduler
≤6.9.9Update to 6.9.10
- Medium6.4Authenticated Stored Cross-Site Scripting
BuddyForms Moderation ( Former: Review Logic )
≤1.4.16Update to 1.4.17
- Critical9.8Unauthenticated PHP Object Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.1.7.1Update to 4.1.7.2
- Medium4.3Unauthorized File Upload via ACF
Beebee Mini
≤1.2.0Update to 1.3.0
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Casso Flow – Tự động xác nhận thanh toán chuyển khoản ngân hàng
≤2.8.6Update to 2.8.7
- High8.8Authenticated SQL Injection
WP All Export Pro
≤1.7.8Update to 1.7.9
- High8.8Cross-Site Request Forgery
Shortcodes Ultimate – Content Elements
≤5.12.0Update to 5.12.1
- High8.8OpenStreetMap <= 6.0 - Cross-Site Request Forgery
OSM – OpenStreetMap
≤6.0Update to 6.0.1
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Contact Bank – Contact Form Builder for WordPress
≤3.0.30No patch available
- High8.8Cross-Site Request Forgery
Media Library Folders
≤7.1.1Update to 7.1.2
- High8.8Lite <= 3.1 - Cross-Site Request Forgery
WZone – Lite Version
≤3.1No patch available
- High7.2PHP Object Injection
Kadence WooCommerce Email Designer
≤1.5.6Update to 1.5.7
- Medium6.55.0.7 - Protection Bypass via IP Spoofing
All-In-One Security (AIOS) – Security and Firewall
5.0.0 – 5.0.7Update to 5.0.8
- Medium6.1Reflected Cross-Site Scripting
CRM Perks Forms – WordPress Form Builder
≤1.1.0Update to 1.1.1
- High8.8Cross-Site Request Forgery
Plugin LBstopattack
≤1.1.2Update to 1.1.3
- Medium5.3Missing Authorization to Data Reset
HREFLANG Tags Lite
≤2.0.0No patch available
- Medium5.4Insecure Direct Object Reference
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.3.4Update to 7.3.5