Database
WordPress Vulnerability Database (page 1220)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
Affiliates Manager
≤2.9.13Update to 2.9.14
- Medium5.3CAPTCHA Bypass via Whitelisted IP Address Spoofing
Login No Captcha reCAPTCHA
≤1.6.11Update to 1.7
- High8.8Cross-Site Request Forgery
Affiliates Manager
≤2.9.13Update to 2.9.14
- Medium6.1Reflected Cross-Site Scripting
Affiliates Manager
≤2.9.13Update to 2.9.14
- Medium5.3Unauthenticated CSS Injection
Gallery by Visual Portfolio
≤2.17.1Update to 2.18.0
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
All-in-One WP Migration and Backup
≤7.62Update to 7.63
- High7.3Multiple Unprotected AJAX Actions
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤3.8.11.8Update to 3.8.12
- High8.2Local File Inclusion
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤3.8.11.8Update to 3.8.12
- Medium6.1Reflected Cross-Site Scripting
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤3.8.11.8Update to 3.8.12
- Medium6.1Reflected Cross-Site Scripting
Fast Flow
≤1.2.11Update to 1.2.12
- Medium4.3Contributor+ CSS Injection
Gallery by Visual Portfolio
≤2.18.0Update to 2.19.0
- Medium4.8Authorization Bypass
Protect Uploads
≤0.3Update to 0.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Notification Bar for WordPress
≤1.1.8No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Alpine PhotoTile for Pinterest
≤1.3.1No patch available
- Medium5.3Authorization Bypass
THE Leads Management System: 59sec LITE
≤3.4.1No patch available
- Medium5.5Authenticated Stored Cross-Site Scripting
Uploading SVG, WEBP and ICO files
≤1.0.1Update to 1.2.0
- Medium5.4Server-Side Request Forgery
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
≤1.0.95Update to 1.0.95.1
- High7.2Arbitrary File Upload
Uploading SVG, WEBP and ICO files
≤1.0.1Update to 1.2.0
- High7.3Missing Authorization
reSmush.it : The original free image compressor and optimizer plugin
≤0.4.3Update to 0.4.4
- Medium6.1Reflected Cross-Site Scripting
SP Project & Document Manager
≤4.59Update to 4.62
- Medium6.4Authenticated Options Change to Stored Cross-Site Scripting
AS – Create Pinterest Pinboard Pages
≤1.0No patch available
- High7.2Authenticated (Admin+) PHAR Deserialization
WPvivid — Backup, Migration & Staging
≤0.9.74Update to 0.9.75
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Gallery PhotoBlocks
≤1.2.6Update to 1.2.7
- High7.2Unauthenticated Stored Cross-Site Scripting
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management
≤4.2.0Update to 4.2.1
- Critical9.8PHP Object Injection
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤3.0.1Update to 3.0.2
- Medium6.1Reflected Cross-Site Scripting
SP Project & Document Manager
≤4.59Update to 4.62
- Medium6.1Reflected Cross-Site Scripting
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management
≤4.2.0Update to 4.2.1
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.7.0Update to 1.7.1
- High7.5Sensitive Information Disclosure
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤7.3.0Update to 7.3.1
- High8.8Cross-Site Request Forgery
Gallery PhotoBlocks
≤1.2.8Update to 1.2.9