Database
WordPress Vulnerability Database (page 1223)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Authenticated (Administrator+) SQL Injection
Fluent Support – Helpdesk & Customer Support Ticket System
≤1.5.7Update to 1.5.8
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Banner Cycler
≤1.4No patch available
- Medium4.7Open Redirect
My Calendar – Accessible Event Manager
≤3.3.16Update to 3.3.17
- High8.8Cross-Site Request Forgery
SEO Redirection Plugin – 301 Redirect Manager
≤8.9Update to 9.1
- Medium6.1Reflected Cross-Site Scripting
Download buttons for Youtube videos
≤1.03Update to 1.04
- High8.8Cross-Site Request Forgery to Plugin Settings Update
Yotpo Reviews for WooCommerce (Unofficial)
2.0.4 – 2.0.4No patch available
- High7.5Information Disclosure
Ninja Job Board
≤1.3.2Update to 1.3.3
- Medium5.4Tab Nabbing
Auto-hyperlink URLs
≤5.4.1No patch available
- Medium6.4Authenticated (Scubscriber+) Stored Cross-Site Scripting
Social Slider Feed – Social Media Feed & Gallery Widgets
≤2.0.4Update to 2.0.5
- Medium6.1Reflected Cross-Site Scripting
API info for Plugins & Themes from WP.ORG
≤1.04Update to 1.05
- High8.8Cross-Site Request Forgery
Ask Me - Responsive Questions & Answers WordPress
≤6.8.3Update to 6.8.4
- Medium6.1Reflected Cross-Site Scripting
Images Asynchronous Load
≤1.05Update to 1.06
- Medium6.1Reflected Cross-Site Scripting
Profile & Dashboard fields [Modify/Disable/Remove]
≤1.03Update to 1.04
- Medium6.1Reflected Cross-Site Scripting
Highlight Searched Terms in Results
≤1.03Update to 1.04
- Medium6.1Reflected Cross-Site Scripting
Add Hierarchy (parent) to post
≤3.12Update to 3.13
- Medium5.3IP Blocking Bypass
Download Manager
≤3.2.49Update to 3.2.50
- Medium6.1Reflected Cross-Site Scripting
Social Slider Feed – Social Media Feed & Gallery Widgets
≤2.0.4Update to 2.0.5
- Medium6.1Reflected Cross-Site Scripting
Debug Bar – Enable WP_DEBUG from admin dashboard
≤1.85Update to 1.86
- Medium6.1Reflected Cross-Site Scripting
WP phpMyAdmin
≤5.2.0.3Update to 5.2.0.4
- High7.2Missing Authorization to Cross-Site Scripting
Social Slider Feed – Social Media Feed & Gallery Widgets
≤2.0.4Update to 2.0.5
- High8.8Cross-Site Request Forgery
MailerLite – Signup forms (official)
≤1.5.7Update to 1.5.8
- High8.8Cross-Site Request Forgery
WP Edit Menu
≤1.5.0No patch available
- High7.5Information Disclosure
Simple Job Board
≤2.9.6Update to 2.9.10
- Medium6.1Reflected Cross-Site Scripting
Breadcrumbs Shortcode
≤1.44Update to 1.45
- Medium6.4Authenticated (Contributor+) Arbitrary File Download
Lana Downloads Manager
≤1.7.1Update to 1.8.0
- Medium6.1Reflected Cross-Site Scripting
Require & Limit Categories, Tags, Featured Image and taxonomies
≤1.26Update to 1.27
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Student Result or Employee Database
≤1.7.4Update to 1.7.5
- Medium6.3Missing Authorization to Arbitrary Settings Update
WP Sticky Button – Click to Chat
≤1.4Update to 1.4.1
- High8.8Cross-Site Request Forgery to Plugin Setting Update
LinkWorth Plugin
≤3.3.3Update to 3.3.4
- High7.2Authenticated (Administrator+) SQL Injection
NEX-Forms – Ultimate Forms Plugin for WordPress
≤7.9.6Update to 7.9.7