Database
WordPress Vulnerability Database (page 1215)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Top Bar
≤3.0.3Update to 3.0.4
- High8.8Cross-Site Request Forgery
wpForo Forum
≤2.0.5Update to 2.0.6
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Culture Object
≤4.0.1Update to 4.1.1
- High8.1Cross-Site Request Forgery to Arbitrary File Download
3DPrint
≤3.5.6.9No patch available
- High8.8Authenticated (Subscriber+) SQL Injection
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤13.2.5Update to 13.2.6
- High7.2Missing Authorization to Cross-Site Scripting
Zephyr Project Manager
<3.2.55Update to 3.2.55
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Mega Forms – Drag & Drop Form Builder with Multi-Step & Conditional Logic
≤1.2.4Update to 1.2.5
- High8.8Cross-Site Request Forgery
wpForo Forum
≤2.0.5Update to 2.0.6
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Export Post Info
≤1.1.0Update to 1.2.0
- Medium6.5Missing Authorization
Frontend File Manager Plugin
≤21.2Update to 21.3
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Donation Thermometer
≤2.1.2Update to 2.1.3
- Medium4.3Information Disclosure
WP Statistics – Simple, privacy-friendly Google Analytics alternative
13.2.5 – 13.2.5Update to 13.2.6
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Frontend File Manager Plugin
≤21.2Update to 21.3
- Medium5.4Cross-Site Request Forgery
Booking Calendar
≤9.2.1Update to 9.2.2
- High7.2Unauthenticated Stored Cross-Site Scripting
Ketchup Restaurant Reservations
≤1.0.0No patch available
- High7.58.7.4.1 - Arbitrary File Download
BackupBuddy
8.5.8.0 – 8.7.4.1Update to 8.7.5
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Wordfence Security – Firewall, Malware Scan, and Login Security
≤7.6.0Update to 7.6.1
- High8.8Cross-Site Request Forgery to Plugin Settings Update
Frontend File Manager Plugin
≤21.3Update to 21.4
- High8.8Cross-Site Request Forgery to Plugin Settings Update
WordPress Countdown Widget
≤3.1.9.1Update to 3.1.9.2
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WordPress Countdown Widget
≤3.1.9.1Update to 3.1.9.2
- Critical9.8Unauthenticated SQL Injection
Ketchup Restaurant Reservations
≤1.0.0No patch available
- Medium4.0All known versions - Unauthenticated Blind Server Side Request Forgery
WordPress
4.1.30 – 6.1.1No patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Goolytics – Simple Google Analytics
≤1.1.1Update to 1.1.2
- High8.8Cross-Site Request Forgery to Plugin Settings Update
Login Block IPs
≤1.0.0No patch available
- High7.3Missing Authorization
Ldap WP Login / Active Directory Integration
<3.0.2Update to 3.0.2
- High8.8Cross-Site Request Forgery
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
≤4.2.3.1Update to 4.2.4
- Medium4.9Authenticated (Admin+) Path Traversal
Download Manager
<3.2.55Update to 3.2.55
- Critical9.8Unauthenticated Arbitrary File Upload
Scripts Organizer
<3.0Update to 3.0
- High7.5Missing Authorization and Cross-Site Request Forgery
WP Popup Builder – Popup Forms and Marketing Lead Generation
≤1.2.9Update to 1.3.0
- High7.2Authenticated (Administrator+) PHP Objection Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.6.12Update to 3.6.13