Database
WordPress Vulnerability Database (page 1217)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Missing Authentication to Settings Change and Order Deletion
WP Shop
≤3.9.6No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting via Video Link
Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )
≤9.7.3Update to 9.8.0
- Medium4.9Authenticated (Admin+) Arbitrary File Read via Directory Traversal
Ajax Load More – Infinite Scroll, Load More, & Lazy Load
≤5.5.4Update to 5.5.4.1
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Generate PDF using Contact Form 7
≤3.5Update to 3.6
- Medium6.4Authenticated Stored Cross-Site Scripting via Title & Description
Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )
≤9.7.3Update to 9.8.0
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Bitcoin / Altcoin Faucet
≤1.6.0No patch available
- Medium4.3Race Condition
WP-PostRatings
≤1.89Update to 1.90
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WordLift – AI powered SEO – Schema
≤3.37.1Update to 3.37.2
- Medium4.9Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function
WordPress
≤6.0.1Update to 3.7.39 or 3.8.39 or 3.9.37 or 4.0.36 or 4.1.36 or 4.2.33 or 4.3.29 or 4.4.28 or 4.5.27 or 4.6.24 or 4.7.24 or 4.8.20 or 4.9.21 or 5.0.17 or 5.1.14 or 5.2.16 or 5.3.13 or 5.4.11 or 5.5.10 or 5.6.9 or 5.7.7 or 5.8.5 or 5.9.4 or 6.0.2
- High8.0Authenticated SQL Injection
WordPress
≤6.0.1Update to 3.7.39 or 3.8.39 or 3.9.37 or 4.0.36 or 4.1.36 or 4.2.33 or 4.3.29 or 4.4.28 or 4.5.27 or 4.6.24 or 4.7.24 or 4.8.20 or 4.9.21 or 5.0.17 or 5.1.14 or 5.2.16 or 5.3.13 or 5.4.11 or 5.5.10 or 5.6.9 or 5.7.7 or 5.8.5 or 5.9.4 or 6.0.2
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Add User Role
≤0.0.1No patch available
- Medium4.4Stored Cross-Site Scripting via Plugin Deactivation and Deletion Errors
WordPress
≤6.0.1Update to 3.7.39 or 3.8.39 or 3.9.37 or 4.0.36 or 4.1.36 or 4.2.33 or 4.3.29 or 4.4.28 or 4.5.27 or 4.6.24 or 4.7.24 or 4.8.20 or 4.9.21 or 5.0.17 or 5.1.14 or 5.2.16 or 5.3.13 or 5.4.11 or 5.5.10 or 5.6.9 or 5.7.7 or 5.8.5 or 5.9.4 or 6.0.2
- Medium6.4Authenticated Stored Cross-Site Scripting via Caption - On Hover
Beaver Builder Page Builder – Drag and Drop Website Builder
≤2.5.5.2Update to 2.5.5.3
- Medium6.4Authenticated Stored Cross-Site Scripting via 'Text Block'
Visual Composer Website Builder
≤45.0Update to 45.0.1
- Medium6.1Reflected Cross-Site Scripting
Zephyr Project Manager
<3.2.5Update to 3.2.5
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Form Builder CP
≤1.2.31Update to 1.2.32
- Medium6.4Authenticated Stored Cross-Site Scripting via Text Editor
Beaver Builder Page Builder – Drag and Drop Website Builder
≤2.5.5.2Update to 2.5.5.3
- Medium6.4Authenticated Stored Cross-Site Scripting via 'Title'
Visual Composer Website Builder
≤45.0Update to 45.0.1
- Medium6.5CSV Injection
Ultimate SMS Notifications for WooCommerce
≤1.4.1Update to 1.4.2
- Critical9.8Unauthenticated SQL Injection
Zephyr Project Manager
≤3.2.42Update to 3.2.5
- Medium6.4Authenticated Stored Cross-Site Scripting via 'caption'
Beaver Builder Page Builder – Drag and Drop Website Builder
≤2.5.5.2Update to 2.5.5.3
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Slickr Flickr
≤2.8.1No patch available
- Medium5.3Maintenance Mode Bypass
Site Offline Or Coming Soon Or Maintenance Mode
≤1.4.9Update to 1.5.3
- Medium6.5Authenticated (Administrator+) Arbitrary File Deletion
WPvivid — Backup, Migration & Staging
0.9.76 – 0.9.76Update to 0.9.77
- High7.2Missing Authorization to Cross-Site Scripting
Zephyr Project Manager
≤3.2.42Update to 3.2.5
- Medium6.4Authenticated Stored Cross-Site Scripting via Image URL
Beaver Builder Page Builder – Drag and Drop Website Builder
≤2.5.5.2Update to 2.5.5.3
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Gettext override translations
≤1.0.1Update to 2.0.0
- Medium6.5CSV Injection
WP Users Exporter
≤1.4.2No patch available
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Better Delete Revision
≤1.6.1No patch available
- Medium6.5Missing Authorization to Plugin Options Update
Better Font Awesome
2.0.1 – 2.0.1Update to 2.0.2