Database
WordPress Vulnerability Database (page 1216)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.9Authenticated (Admin+) Path Traversal
Download Manager
<3.2.55Update to 3.2.55
- Critical9.8Unauthenticated Arbitrary File Upload
Scripts Organizer
<3.0Update to 3.0
- High7.2Authenticated (Administrator+) Arbitrary File Upload
CM Download Manager – Organize, Protect & Share Files in WordPress
≤2.8.5Update to 2.8.6
- Medium4.3Missing Authorization to Plugin Settings Update
WP Shamsi – افزونه تاریخ شمسی و فارسی ساز وردپرس
≤4.1.1Update to 4.2.0
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Slider Hero with Video Background, Animation
≤8.4.3Update to 8.4.4
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
SVG Support
≤2.4.2Update to 2.5
- Medium5.3IP Spoofing to Protection Mechanism Bypass
Login Block IPs
all versionsNo patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
SEO Smart Links
≤3.0.1No patch available
- High8.8Cross-Site Request Forgery to Settings Update
Mega Addons For WPBakery Page Builder
≤4.3.1Update to 4.4.0
- Medium5.3User Enumeration Bypass
WP Cerber Security, Anti-spam & Malware Scan
≤9.0Update to 9.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Torro Forms
≤1.0.16No patch available
- High7.5Information Disclosure via Arbitrary File Read
Welcart e-Commerce
2.6.0 – 2.7.7Update to 2.7.8
- Medium5.4Privilege Escalation
Pop-up
≤1.1.5Update to 1.1.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Meet My Team
≤2.0.5No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
History Timeline for Biography, Company History & Event Timeline
≤1.0.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Easy Org Chart
≤3.1No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
CallRail Phone Call Tracking
≤0.4.9Update to 0.4.10
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting
Word Search Puzzles game
≤2.0.1No patch available
- High8.8Cross-Site Request Forgery to Plugin Settings Update
Captcha Code
≤2.7Update to 2.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Blossom Recipe Maker
≤1.0.7Update to 1.0.8
- Medium4.3Race Condition
Rate My Post – Star Rating Plugin by FeedbackWP
≤3.3.4Update to 3.3.5
- High8.8Cross-Site Request Forgery
MP3-jPlayer
≤2.7.3No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WHA Crossword
≤1.1.10No patch available
- High8.8Cross-Site Request Forgery
GetResponse for WordPress
≤5.5.19Update to 5.5.21
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
WHA Crossword
≤1.1.10No patch available
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Word Search Puzzles game
≤2.0.1No patch available
- Medium6.5Access Bypass via IP Spoofing
Restricted Site Access
<7.3.2Update to 7.3.2
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WordLift – AI powered SEO – Schema
≤3.37.1Update to 3.37.2
- Medium4.3Race Condition
WP-PostRatings
≤1.89Update to 1.90
- Critical9.8Missing Authentication to Settings Change and Order Deletion
WP Shop
≤3.9.6No patch available