Database
WordPress Vulnerability Database (page 1213)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery
3D Tag Cloud
≤3.8Update to 3.9
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WP Custom Cursors | WordPress Cursor Plugin
≤3.0Update to 3.0.1
- High8.8Cross-Site Request Forgery
FavIcon Switcher
≤1.2.11No patch available
- Medium6.5Missing Authorization
Image Zoom
≤1.8.8No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
demon image annotation
1.0 – 4.7Update to 4.8
- High8.8Cross-Site Request Forgery to Cursor Manipulation
WP Custom Cursors | WordPress Cursor Plugin
≤3.0Update to 3.0.1
- High8.8Cross-Site Request Forgery
Avada | Website Builder For WordPress & WooCommerce
≤7.8.1Update to 7.8.2
- Medium6.1Reflected Cross-Site Scripting
No Page Comment
≤1.1Update to 1.2
- Medium5.3Insecure Password Storage to Sensitive Data Exposure
Passster – Password Protect Pages and Content
≤3.5.5.5.1Update to 3.5.5.5.2
- High7.2Authenticated (Administrator+) SQL Injection
WP Custom Cursors | WordPress Cursor Plugin
≤3.0.2Update to 3.0.3
- Medium5.3Sensitive Information Disclosure
Tidio – Live Chat & AI Chatbots
≤5.2.0Update to 5.3.0
- High7.2Authenticated (Administrator+) SQL Injection
Search Logger – Know What Your Visitors Search
≤0.9No patch available
- Medium5.4Missing Authorization
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤6.5.7Update to 6.5.8
- High8.8Cross-Site-Request Forgery to Settings Change
No Page Comment
≤1.1Update to 1.2
- High7.2Authenticated (Administrator+) SQL Injection
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤6.5.7Update to 6.5.8
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
We’re Open!
≤1.41Update to 1.42
- High8.8Cross-Site Request Forgery
Image Zoom
≤1.8.8No patch available
- Medium6.5Authenticated (Subscriber+) Order Modification
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤5.6.2Update to 5.6.3
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Social Rocket – Social Sharing Plugin
≤1.3.2Update to 1.3.3
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
MemberPress Downloads
≤1.2.5Update to 1.2.6
- Medium6.8Authenticated (Administrator+) Arbitrary File Access via Path Traversal
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
≤1.7.5.3Update to 1.7.5.5
- Medium5.5Authenticated (Administrator+) Cross-Site Scripting
reSmush.it : The original free image compressor and optimizer plugin
≤0.4.5Update to 0.4.6
- Medium6.1Reflected Cross-Site Scripting
Simple File List
≤4.4.11Update to 4.4.12
- High8.8Cross-Site Request Forgery to Page Creation
Simple File List
≤4.4.12Update to 4.4.13
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WordPress Countdown Widget
≤3.1.9.2Update to 3.1.9.3
- Medium4.3Cross-Site Request Forgery via import_json_settings
Breeze Cache
≤2.0.8Update to 2.0.9
- Medium6.8Authenticated (Administrator+) Arbitrary File Download
Download Monitor
≤4.5.97Update to 4.5.98
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
GetYourGuide Ticketing
≤1.0.2Update to 1.0.3
- Medium6.3Missing Authorization
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
≤5.5.82Update to 5.6.0
- Medium5.5Authenticated (Administrator+) Cross-Site Scripting
Database Browser
≤1.4.4No patch available