Database
WordPress Vulnerability Database (page 1211)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via 'notice' parameter
Accordion – Multiple Accordion or FAQs Builder
≤2.0.3Update to 2.1.0
- Medium5.3Information Disclosure
Media Library Assistant
≤3.00Update to 3.01
- Medium6.4Stored Cross-Site Scripting
Booking Ultra Pro Appointments Booking Calendar Plugin
≤1.1.8Update to 1.1.9
- High8.8Cross-Site Request Forgery
Booking Ultra Pro Appointments Booking Calendar Plugin
≤1.1.6Update to 1.1.7
- Medium5.3Missing Authorization
Redirection for Contact Form 7
≤2.4.0Update to 2.7.0
- High8.8Cross-Site Request Forgery
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.6.4Update to 3.6.5
- High8.8Cross-Site Request Forgery
Booking Ultra Pro Appointments Booking Calendar Plugin
≤1.1.6Update to 1.1.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via 'layouts' parameter
Accordion – Multiple Accordion or FAQs Builder
≤2.0.3Update to 2.1.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via 'rawdata' parameter
Accordion – Multiple Accordion or FAQs Builder
≤2.0.3Update to 2.1.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via 'pages' parameter
Accordion – Multiple Accordion or FAQs Builder
≤2.0.3Update to 2.1.0
- High8.8Missing Authorization
Booking Ultra Pro Appointments Booking Calendar Plugin
≤1.1.5Update to 1.1.6
- High7.2Authenticated (Administrator+) SQL Injection
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.15.5Update to 1.15.6
- Medium4.3Authenticated Arbitrary Options Update
Accordion – Multiple Accordion or FAQs Builder
≤2.0.3Update to 2.1.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via 'license' parameter
Accordion – Multiple Accordion or FAQs Builder
≤2.0.3Update to 2.1.0
- High8.8Cross-Site Request Forgery
AdminPad
≤2.1Update to 2.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting in post_oxi_settings function
Accordion – Multiple Accordion or FAQs Builder
≤2.0.3Update to 2.1.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via 'pages' parameter
Accordion – Multiple Accordion or FAQs Builder
≤2.0.3Update to 2.1.0
- Medium5.3Missing Authorization to Data Reset
HREFLANG Tags Lite
≤2.0.0No patch available
- Medium5.4Insecure Direct Object Reference
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.3.4Update to 7.3.5
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Agile Store Locator
≤1.4.5Update to 1.4.6
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
wp-Monalisa
≤6.1Update to 6.2
- High8.8Cross-Site Request Forgery
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
≤3.6.5Update to 3.6.6
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Advanced Ads – Ad Manager & AdSense
≤1.31.1Update to 1.32.0
- Medium6.1Reflected Cross-Site Scripting
Asset CleanUp: Page Speed Booster
≤1.3.8.4Update to 1.3.8.5
- High8.8Unauthenticated CSV Injection
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.1.0.1.1Update to 3.1.0.2
- Medium4.1Missing Authorization to Authenticated (Subscriber+) Settings Update
Blog2Social: Social Media Auto Post & Scheduler
≤6.9.11Update to 6.9.12
- Medium6.5Missing Authorization to Plugin Settings Change
Advance Product Search- Voice & Ajax Search for WooCommerce
≤1.1.4Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting
Sabai Discuss
≤1.4.13Update to 1.4.14
- Medium5.3Missing Authorization to Plugin Settings Reset
Advance Product Search- Voice & Ajax Search for WooCommerce
≤1.1.4Update to 1.1.5
- High8.8Cross-Site Request Forgery to Plugin Options Update
Manage Notification E-mails
≤1.8.2Update to 1.8.3