Database
WordPress Vulnerability Database (page 1221)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Advanced Order Export For WooCommerce
≤3.3.1Update to 3.3.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤5.8Update to 5.9
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Social Slider Feed – Social Media Feed & Gallery Widgets
≤2.0.6Update to 2.0.7
- Medium5.3Payment Bypass
WooPayments: Integrated WooCommerce Payments
≤4.5.0Update to 3.9.4 or 4.0.3 or 4.1.1 or 4.2.2 or 4.3.1 or 4.4.1 or 4.5.1
- High7.2Authenticated (Administrator+) Arbitrary File Upload
WPIDE – File Manager & Code Editor
≤2.6Update to 3.0
- High8.8Authenticated (Author+) SQL Injection
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤17.0.4Update to 17.0.5
- High7.3Missing Authorization
Floating Action Button
≤1.2Update to 1.2.1
- Medium4.9Authenticated (Administrator+) Arbitrary File Read
WPIDE – File Manager & Code Editor
≤2.6Update to 3.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
amCharts: Charts and Maps
≤1.4Update to 1.5
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Simply Schedule Appointments
≤1.5.7.5Update to 1.5.7.7
- Medium5.3Protection Mechanism Bypass
Stop Spam Comments
≤0.2.1.2No patch available
- High7.2Authentciated (Admin+) SQL Injection via orderby
JoomSport – for Sports: Team & League, Football, Hockey & more
≤5.2.5Update to 5.2.6
- Medium5.3Unauthenticated Sensitive Information Exposure
Simply Schedule Appointments
≤1.5.7.5Update to 1.5.7.7
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Netroics Blog Posts Grid
≤1.0No patch available
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting
BuddyForms Advanced Custom Fields
≤1.3.8Update to 1.3.9
- High7.2Authenticated (Admin+) SQL Injection via orderby
JoomSport – for Sports: Team & League, Football, Hockey & more
≤5.2.5Update to 5.2.6
- Medium6.1Reflected Cross-Site Scripting
WP Taxonomy Import
≤1.0.5No patch available
- High7.1Missing authorization to Settings Change
Pop-up
≤1.1.1Update to 1.1.2
- High7.2Authenticated (Admin+) SQL Injection
Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)
≤3.12.4Update to 3.12.5
- High7.6Missing Authorization Checks
Jupiter X Core
≤2.0.9Update to 2.1.0
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Announcement Bar, Notification Bar & Banner – Bulletin
≤3.5.2Update to 3.5.3
- Medium6.5Arbitrary File Deletion
Export All URLs
≤4.3Update to 4.4
- High8.8Cross-Site Request Forgery to PHAR Deserialization
String locator
≤2.5.0Update to 2.6.0
- Medium6.1Reflected Cross-Site Scripting
WP Hide & Security Enhancer
≤1.7.9.2Update to 1.8
- High8.8Cross-Site Request Forgery
Resize Image After Upload
≤1.8.5Update to 1.8.6
- Medium5.5Authenticated (Store Manager+) Stored Cross-Site Scripting
Custom Product Tabs Lite for WooCommerce
≤1.7.6Update to 1.7.7
- Critical9.8SQL Injection
Mobile Assistant Connector
2.2.2 – 2.2.2Update to 2.2.3
- High7.1Missing Authorization to Settings Change
WordPress HTTPS (SSL)
≤3.4.0No patch available
- Medium5.3Sensitive Information Disclosure
User Private Files – Secure File Sharing and Client Portal Plugin
≤1.1.0Update to 1.1.1
- Medium6.3Missing Authorization
User Private Files – Secure File Sharing and Client Portal Plugin
≤1.1.1Update to 1.1.2