Database
WordPress Vulnerability Database (page 1227)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Student Result <= 1.0.4 - Cross-Site Request Forgery to Arbitrary File Upload
E Unlocked – Student Result
≤1.0.4No patch available
- High7.2Authenticated (Admin+) Stored Cross-Site Scripting
Rough Chart
≤1.0.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Inspiro PRO
≤7.2.2Update to 7.2.3
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Better Tag Cloud
≤0.99.5No patch available
- High7.2Authenticated (Admin+) PHAR Deserialization
Broken Link Checker
≤1.11.16Update to 1.11.17
- High7.5Arbitrary File Read
MultiSafepay plugin for WooCommerce
≤4.15.0Update to 4.16.0
- Critical9.8SQL Injection
WPDating
≤7.4.0Update to 7.4.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Auto More Tag
≤4.0.0No patch available
- High7.3Authentication Bypass
WP OAuth2 Server
≤1.0.1No patch available
- Medium5.5Administrator+ Stored Cross-Site Scripting
My Calendar – Accessible Event Manager
≤3.3.16Update to 3.3.17
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
mTouch Quiz
≤3.1.3Update to 3.1.4
- Medium5.3Unauthorized Settings Change
Transposh WordPress Translation
≤1.0.9.6No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Google Maps Anywhere
≤1.2.6.3No patch available
- Medium6.1Reflected Cross-Site Scripting
Crowdsignal Dashboard – Polls, Surveys & more
≤3.0.7Update to 3.0.8
- Medium6.4Stored Cross-Site Scripting
YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports
<2.2.1Update to 2.2.1
- High7.2Authenticated (Admin+) Arbitrary File Upload
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤7.2.2Update to 7.2.3
- Medium5.3Sensitive Information Disclosure
Transposh WordPress Translation
≤1.0.9.6No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP DS Blog Map
≤3.1.3No patch available
- Medium5.5Administrator+ Stored Cross-Site Scripting
Social Chat – Click To Chat App Button
≤6.0.4Update to 6.0.5
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Thinkific Uploader
≤1.0.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports
≤2.2.1Update to 2.2.2
- Medium6.3Unauthorized Settings Update
Name Directory
≤1.25.4Update to 1.25.5
- Critical9.8PHP Object Injection
Advanced Post Manager
≤4.5.1Update to 4.5.2
- Medium5.4Subscriber+ Stored Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
2.4.0 – 2.4.0Update to 2.4.1
- Medium5.3Regular Expression Denial of Service
Block for Apple Maps
≤1.0.3Update to 1.1.0
- Medium6.3Missing Authorization
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
≤2.1.1Update to 2.1.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Comments Extra Fields For Post,Pages and CPT
≤4.0Update to 4.1
- Low3.7Denial of Service
ElasticPress
≤4.2.2Update to 4.3.0
- High7.5Username Enumeration
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.4.1Update to 2.4.2
- Medium4.3File Upload
Advanced Custom Fields (ACF®)
≤5.12.2Update to 5.12.3