Database
WordPress Vulnerability Database (page 1219)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Cerber Security, Anti-spam & Malware Scan
≤9.0Update to 9.1
- High7.5Missing Authorization to Settings Update
WP Hotel Booking
≤2.0.0Update to 2.0.1
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Currency Switcher for WooCommerce by WBW
≤1.6.5Update to 1.6.6
- Medium6.5Authorization Bypass
Analytify – Google Analytics 4 Tracking and Reporting in WordPress
≤4.2.2Update to 4.2.3
- Medium6.1Reflected Cross-Site Scripting
Classified Listing Pro - Classified ads & Business Directory Plugin
<2.0.20Update to 2.0.20
- High7.5Cross-Site Request Forgery to PHAR Deserialization
Ajax Load More – Infinite Scroll, Load More, & Lazy Load
≤5.5.3Update to 5.5.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
MashShare – Social Media Share Buttons, Social Share Icons
≤3.8.3Update to 3.8.4
- High7.4Server Side Request Forgery
Craw Data
≤1.0.0No patch available
- Medium5.5Stored Cross-Site Scripting
BuddyPress xProfile Checkout Manager for WooCommerce
≤1.3.5Update to 1.3.6
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WP Server Health Stats
≤1.6.10Update to 1.7.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
≤2.1.3Update to 2.1.4
- Medium5.8Open Mailer
OneTone Companion
≤1.1.1No patch available
- Medium5.3IP Spoofing to Protection Bypass
Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter
≤7.3.0Update to 7.3.1
- High8.8Authenticated (Contributor+) PHAR Deserialization
Download Manager
≤3.2.49Update to 3.2.50
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Accordions
≤2.2.40Update to 2.2.43
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Scroll To Top
≤1.4.0Update to 1.4.1
- High7.52.6.0 - Arbitrary File Download & Server-Side Request Forgery
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
2.5.8 – 2.6.0Update to 2.6.1
- Low2.7Authenticated (Administrator+) CSV Injection
Mobile Events Manager
≤1.4.7Update to 1.4.8
- High8.8Missing Authorization to Arbitrary Options Update
Make Connector
≤1.5.1Update to 1.5.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Float to Top Button
≤2.3.6No patch available
- Medium5.4Missing Authorization Checks
Gallery PhotoBlocks
≤1.2.8Update to 1.2.9
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups
≤2.9.17Update to 2.9.18
- Medium6.0Authenticated (Admin+) Directory Traversal
WPvivid — Backup, Migration & Staging
≤0.9.75Update to 0.9.76
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤5.8.3Update to 5.9
- High7.2Cross-Site Scripting
ElasticPress Debugging Add-On
≤2.1.0Update to 2.1.1
- High7.2Missing Authorization to Stored Cross-Site Scripting
CP Multi View Events Calendar
≤1.4.06Update to 1.4.07
- Medium4.3Authorization Bypass to Repeat Voting
Helpful
≤4.5.14Update to 4.5.15
- Medium6.1Reflected Cross-Site Scripting
Corner Ad
≤1.0.53Update to 1.0.54
- Critical9.0CSV Injection
Affiliates Manager
≤2.9.13Update to 2.9.14
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Affiliates Manager
≤2.9.13Update to 2.9.14