Database
WordPress Vulnerability Database (page 1228)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8SQL Injection
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
≤1.1.9Update to 1.2.0
- High7.2Authenticated (Admin+) SQL Injection
Melapress File Monitor
≤1.8.2Update to 1.8.3
- Medium4.9Authenticated Arbitrary File Read
GiveWP – Donation Plugin and Fundraising Platform
≤2.20.2Update to 2.21.0
- Medium5.5Authenticated Arbitrary File Creation
GiveWP – Donation Plugin and Fundraising Platform
≤2.20.2Update to 2.21.0
- Critical9.8Arbitrary File Deletion
Dynamic Font Replacement DFR4WP EN
≤1.3 ENNo patch available
- Critical9.8Unauthenticated PHAR Deserialization
Feed Them Social – Social Media Feeds, Video, and Photo Galleries
≤2.9.8.5Update to 2.9.8.6
- Medium5.3Domain Bypass
WSM Downloader
≤1.4.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
weForms – Easy Drag & Drop Contact Form Builder For WordPress
≤1.6.13Update to 1.6.14
- Critical9.8Cross-Site Request Forgery to Plugin Settings Update
Feed Them Social – Social Media Feeds, Video, and Photo Galleries
≤2.9.8.5Update to 2.9.8.6
- Medium6.1Reflected Cross-Site Scripting
Simple SEO
≤1.7.91Update to 1.7.92
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Shortcodes and extra features for Phlox theme
≤2.9.8Update to 2.9.14
- High8.8Cross-Site Request Forgery to Username Change
Easy Username Updater
≤1.0.3Update to 1.0.4
- Medium6.1Reflected Cross-Site Scripting
Feed Them Social – Social Media Feeds, Video, and Photo Galleries
≤2.9.9Update to 3.0.1
- Medium6.3Social Questions and Answers WordPress Theme <= 4.9 - Missing Authorization
Discy - Social Questions and Answers WordPress Theme
≤4.9Update to 5.0
- High7.5Arbitrary File Download
WSM Downloader
≤1.4.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Event Timeline – Vertical Timeline
≤1.1.6No patch available
- Medium5.3IP Spoofing via X-Forwarded-For header
YOP Poll
≤6.4.2Update to 6.4.3
- High7.5Sensitive Information Disclosure
YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports
2.2 – 2.2Update to 2.2.1
- Medium6.5Missing Authorization to Sensitive Information Exposure
YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports
≤2.2Update to 2.2.1
- High8.8Subscriber+ Arbitrary File Upload
User Private Files – Secure File Sharing and Client Portal Plugin
≤1.1.2Update to 1.1.3
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
≤2.21.2Update to 2.21.3
- High8.8Cross-Site Request Forgery to Settings/Options Update
Ecwid by Lightspeed Ecommerce Shopping Cart
≤6.10.23Update to 6.10.24
- Critical9.8Unauthenticated Backup Download
WordPress project source code download
≤1.0.0No patch available
- Medium5.4Insufficient Access Control on Multiple AJAX Actions
Ecwid by Lightspeed Ecommerce Shopping Cart
≤6.10.22Update to 6.10.23
- High7.2SQL Injection
Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress
≤1.2Update to 1.2.1
- High8.8Cross-Site Request Forgery
Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress
≤1.2Update to 1.2.1
- Medium4.3Cross-Site Request Forgery
GiveWP – Donation Plugin and Fundraising Platform
≤2.21.2Update to 2.21.3
- Medium6.1Reflected Cross-Site Scripting
Copyright Proof
≤4.16No patch available
- Medium6.1Reflected Cross-Site Scripting
Keep Backup Daily
≤2.0.3Update to 2.0.4
- Medium5.5Authenticated Stored Cross-Site Scripting
Microsoft Advertising Universal Event Tracking (UET)
≤1.0.3Update to 1.0.4