Database
WordPress Vulnerability Database (page 1229)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Progressive License
≤1.1.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Shortcode for Current Date
≤2.1.6Update to 2.1.7
- Critical9.8Membership Privilege Escalation
Simple Membership
≤4.1.2Update to 4.1.3
- Medium6.1Cross-Ste Scripting
MakeStories (for Google Web Stories)
≤2.6.4Update to 2.6.5
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Slide Anything – Responsive Content / HTML Slider and Carousel
≤2.3.46Update to 2.3.47
- Medium5.5Authenticated Stored Cross-Site Scripting
Flexi Quote Rotator
≤0.9.4No patch available
- Critical9.8Unauthenticated SQL Injection
WP Visitor Statistics (Real Time Traffic)
≤5.7Update to 5.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Royal Custom CSS for Page and Post
1.2 – 1.2No patch available
- Medium6.3Missing Authorization Checks
Web and WooCommerce Addons for WPBakery Builder
≤1.4.4.1Update to 1.4.4.2
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Download Manager
≤3.2.48Update to 3.2.49
- High8.8Membership Privilege Escalation
Simple Membership
≤4.1.2Update to 4.1.3
- Medium6.1Cross-Site Scripting
Payment Button for PayPal
≤1.2.3.7Update to 1.2.3.8
- Critical9.8SQL Injection
Social Share Buttons by Supsystic
≤2.2.6Update to 2.2.7
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Flexi Quote Rotator
≤0.9.4No patch available
- Medium6.1Reflected Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.1.6.7Update to 4.1.6.8
- Medium5.4Reflected Cross-Site Scripting
Advanced WordPress Reset – Debug, Recover & Reset WP
≤1.5Update to 1.6
- High8.8Authenticated (Contributor+) PHAR Deserialization
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤3.7.9Update to 3.7.10
- High8.8Authenticated (Contributor+) PHAR Deserialization
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤3.7.9Update to 3.7.10
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
FreeMind WP Browser
≤1.2No patch available
- Medium5.5Stored Cross-Site Scripting
Featured Image from URL (FIFU)
≤4.0.0Update to 4.0.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
OTP Login With Phone Number, OTP Verification
≤1.3.7Update to 1.3.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Invitation Based Registrations
≤2.2.84Update to 2.3.1
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
AnyMind Widget
≤1.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Popups – WordPress Popup
≤1.9.3.8No patch available
- Medium6.1Reflected Cross-Site Scripting
NextScripts: Social Networks Auto-Poster
≤4.3.25Update to 4.3.26
- Medium6.1Reflected Cross-Site Scripting
Ivory Search – WordPress Search Plugin
≤5.4.6Update to 5.4.7
- Medium4.8Authenticated Stored Cross-Site Scripting
WP Video Lightbox
≤1.9.5Update to 1.9.6
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Allow svg files
≤1.1No patch available
- Medium5.3Information Disclosure
Professional Social Sharing Buttons, Icons & Related Posts – Shareaholic
≤9.7.5Update to 9.7.6
- Medium6.1Reflected Cross-Site Scripting
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤5.5.9Update to 5.6.0