Database
WordPress Vulnerability Database (page 1226)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting via tp_tp
Transposh WordPress Translation
≤1.0.7Update to 1.0.8
- High7.2Remote Code Execution
Transposh WordPress Translation
≤1.0.9.1Update to 1.0.9.2
- Critical9.8Unauthenticated Remote Code Execution
VR Calendar
≤2.3.1Update to 2.3.2
- Medium6.1Reflected Cross-Site Scripting
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤3.2.15Update to 3.2.16
- Medium4.9Authenticated (Admin+) SQL Injection via 'tp_editor'
Transposh WordPress Translation
≤1.0.9.1Update to 1.0.9.2
- Medium4.3Cross-Site Request Forgery
Transposh WordPress Translation
≤1.0.9.1Update to 1.0.9.2
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Stockists Manager for Woocommerce
≤1.0.2.1No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
≤2.11.0Update to 2.12.0
- Medium6.3Missing Authorization Checks
Transposh WordPress Translation
≤1.0.9.1Update to 1.0.9.2
- Medium6.5Unauthenticated Stored Cross-Site Scripting via 'tp_translation'
Transposh WordPress Translation
≤1.0.7Update to 1.0.8
- Critical9.8Unauthenticated Arbitrary File Upload
GREYD.SUITE
≤1.2.6Update to 1.2.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WordPress Flipbook by Supsystic
≤1.7.3Update to 1.7.4
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
WordPress Flipbook by Supsystic
≤1.7.3Update to 1.7.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
All in One Invite Codes
≤1.0.15Update to 1.1.0
- High7.2Cross-Site Scripting
Ninja Job Board
≤1.3.2Update to 1.3.3
- Medium5.4Missing Authorization
Beaver Builder Page Builder – Drag and Drop Website Builder
≤2.5.4.3Update to 2.5.4.4
- Medium6.4Authenticated (Contibutor+) Stored Cross-Site Scripting
Team
≤1.2.6No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Duplicate Page and Post
≤2.7Update to 2.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Duplicate Page and Post
≤2.7Update to 2.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Team
≤1.2.6No patch available
- High7.5Improper Input Validation
Insert Special Characters
≤1.0.4Update to 1.0.5
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via Critical CSS Settings
Autoptimize
≤3.1.0Update to 3.1.1
- High8.8Student Result <= 1.0.4 - Cross-Site Request Forgery to Arbitrary File Upload
E Unlocked – Student Result
≤1.0.4No patch available
- Medium6.1Elementor <= 1.7 - Reflected Cross-Site Scripting
FormsDB – Save Elementor Forms to Google Sheets & Post Type
≤1.7Update to 1.8.0
- High8.8Authenticated (Subscriber+) SQL Injection
Homepage Product Organizer for WooCommerce
≤1.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Testimonials
≤3.0.1No patch available
- Medium6.5Cross-Site Request Forgery to Settings Update
Web en Mantenimiento
≤1.0.6No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP-UserOnline
≤2.87.6Update to 2.88.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
DW Promobar
≤1.0.4No patch available
- Medium5.3Missing Authorization to Sensitive Information Disclosure
Easy Student Results
≤2.2.8No patch available