Database
WordPress Vulnerability Database (page 1212)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.1Missing Authorization to Authenticated (Subscriber+) Settings Update
Blog2Social: Social Media Auto Post & Scheduler
≤6.9.11Update to 6.9.12
- Medium6.5Missing Authorization to Plugin Settings Change
Advance Product Search- Voice & Ajax Search for WooCommerce
≤1.1.4Update to 1.1.5
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Social Media Follow Buttons Bar
≤4.73Update to 5.0
- High8.8Cross-Site Request Forgery to Plugin Options Update
Manage Notification E-mails
≤1.8.2Update to 1.8.3
- Medium5.4Insecure Direct Object Reference to Forum Status Change
wpForo Forum
≤2.0.5Update to 2.0.6
- Medium5.4Unprotected AJAX Actions
WPML Multilingual CMS
≤4.5.10Update to 4.5.11
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Meks Easy Social Share
≤1.2.7Update to 1.2.8
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Tutor LMS – eLearning and online course solution
≤2.0.9Update to 2.0.10
- Medium5.3File Upload Size Limit Bypass
Drag and Drop Multiple File Upload for Contact Form 7
≤1.3.6.4Update to 1.3.6.5
- Medium6.5Authenticated (Subscriber+) Information Disclosure
Make Connector
≤1.5.2Update to 1.5.3
- Medium5.3Country Blocking Bypass
iQ Block Country
≤1.2.18Update to 1.2.19
- High8.8Cross-Site Request Forgery
WP Page Widget
≤3.9Update to 4.0
- Medium5.3Sensitive Information Disclosure
Helpful
≤4.5.25Update to 4.5.26
- High8.3CSV Injection
Activity Log – Monitor User and Agent Changes
≤2.8.3Update to 2.8.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Comment Guestbook
≤0.8.0No patch available
- High8.8Cross-Site Request Forgery to File Upload
Frontend File Manager Plugin
≤21.2Update to 21.3
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.16.8Update to 1.16.9
- High8.8Cross-Site Request Forgery
Seriously Simple Podcasting
≤2.16.0Update to 2.16.1
- Medium6.3Missing Authorization to Sensitive Information Disclosure
Backup Scheduler
≤1.5.13No patch available
- High8.8Cross-Site Request Forgery
Backup Scheduler
≤1.5.13No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.16.8Update to 1.16.9
- Medium6.5Missing Authorization to Plugin Settings Update
Social Login, Social Sharing by miniOrange
7.5.12 – 7.5.12Update to 7.5.13
- Medium5.3Missing Authorization to Cache Deletion
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
≤1.2.49.0Update to 1.2.50.0
- High8.8Cross-Site Request Forgery
Kraken.io Image Optimizer – Compress, Convert to WebP & AVIF, Resize & Bulk Optimize
≤2.6.5Update to 2.6.6
- Medium5.4Cross-Site Request Forgery
Customer Reviews for WooCommerce
≤5.3.5Update to 5.3.6
- Medium4.3Sensitive Data Exposure
Customer Reviews for WooCommerce
≤5.3.5Update to 5.3.6
- Medium6.5Missing Authorization to Plugin Options Update
miniOrange Discord Integration
≤2.1.5Update to 2.1.6
- High7.2Authenticated (Administrator+) Stored Cross-Site Scripting
Tabs – Responsive Tabs with WooCommerce Product Tab Extension
≤3.7.1Update to 3.7.2
- High8.8Cross-Site Request Forgery
3D Tag Cloud
≤3.8Update to 3.9
- Medium5.4Authenticated (Author+) CSV Injection
Export Post Info
≤1.2.0Update to 1.2.1