Database
WordPress Vulnerability Database (page 1224)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Missing Authorization to Cross-Site Scripting
Social Slider Feed – Social Media Feed & Gallery Widgets
≤2.0.4Update to 2.0.5
- Medium6.1Reflected Cross-Site Scripting
WP phpMyAdmin
≤5.2.0.3Update to 5.2.0.4
- Medium6.1Reflected Cross-Site Scripting
Social Slider Feed – Social Media Feed & Gallery Widgets
≤2.0.4Update to 2.0.5
- Medium5.4Tab Nabbing
Auto-hyperlink URLs
≤5.4.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Profile & Dashboard fields [Modify/Disable/Remove]
≤1.03Update to 1.04
- Medium6.1Reflected Cross-Site Scripting
Debug Bar – Enable WP_DEBUG from admin dashboard
≤1.85Update to 1.86
- Medium6.1Reflected Cross-Site Scripting
API info for Plugins & Themes from WP.ORG
≤1.04Update to 1.05
- Medium6.4Authenticated (Scubscriber+) Stored Cross-Site Scripting
Social Slider Feed – Social Media Feed & Gallery Widgets
≤2.0.4Update to 2.0.5
- Medium6.1Reflected Cross-Site Scripting
Built-in Widgets Query extend (Custom Post Types & more)
≤1.05Update to 1.06
- High8.8Cross-Site Request Forgery to Plugin Setting Update
LinkWorth Plugin
≤3.3.3Update to 3.3.4
- High7.5Information Disclosure
Ninja Job Board
≤1.3.2Update to 1.3.3
- High8.8Cross-Site Request Forgery
SEO Redirection Plugin – 301 Redirect Manager
≤8.9Update to 9.1
- High8.8Cross-Site Request Forgery to Plugin Settings Update
Yotpo Reviews for WooCommerce (Unofficial)
2.0.4 – 2.0.4No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Student Result or Employee Database
≤1.7.4Update to 1.7.5
- High8.8Cross-Site Request Forgery
Ask Me - Responsive Questions & Answers WordPress
≤6.8.3Update to 6.8.4
- High7.5Information Disclosure
Simple Job Board
≤2.9.6Update to 2.9.10
- Medium6.1Reflected Cross-Site Scripting
Download buttons for Youtube videos
≤1.03Update to 1.04
- Medium6.1Reflected Cross-Site Scripting
Highlight Searched Terms in Results
≤1.03Update to 1.04
- High8.8Cross-Site Request Forgery
WP Edit Menu
≤1.5.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Fast Flow
≤1.2.12Update to 1.2.13
- Medium4.8Authenticated Stored Cross-Site Scripting
Floating Div
≤3.0No patch available
- Medium6.4Shortcode-Based Cross-Site Scripting
MaxButtons – Create buttons
≤9.2Update to 9.3
- Medium5.4Missing Authorization
ЮKassa для WooCommerce
≤2.3.0Update to 2.3.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Simple SEO
≤1.7.91Update to 1.7.92
- High8.8Cross-Site Request Forgery to Settings Update
ЮKassa для WooCommerce
≤2.3.0Update to 2.3.1
- High7.5WordPress Team Member Showcase Plugin <= 4.1.1 - Directory Traversal to Arbitrary File Read/Deletion
Team – Team Members Showcase Plugin
≤4.1.1Update to 4.1.2
- Medium6.8Authenticated (Administrator+) Local File Inclusion
VR Calendar
≤2.4.4Update to 2.4.5
- Medium5.4Authenticated (Contributor+) Cross-Site Scripting
BxSlider WP
≤2.0.0No patch available
- High8.8Authenticated (Contributor+) Arbitrary File Deletion
Download Manager
≤3.2.50Update to 3.2.51
- Critical9.8Unauthenticated Backup Download
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.4.7Update to 1.4.7.1