Database
WordPress Vulnerability Database (page 1230)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
NextScripts: Social Networks Auto-Poster
≤4.3.25Update to 4.3.26
- Medium4.8Admin+ Arbitrary File Upload
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
≤3.6.7Update to 3.6.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
ND Shortcodes
≤6.5Update to 6.6
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.6.8Update to 1.6.9
- Medium6.1Reflected Cross-Site Scripting
Yellow Yard Searchbar
≤2.7.27Update to 2.8.12
- Medium6.8Authenticated (Admin+) Stored Cross-Site Scripting
Music Player for WooCommerce
≤1.0.172Update to 1.0.173
- Medium6.1Reflected Cross-Site Scripting
WP Video Lightbox
≤1.9.4Update to 1.9.5
- High8.8Cross-Site Request Forgery
Featured Image from URL (FIFU)
≤3.9.9Update to 4.0.0
- Critical9.8Unauthenticated Arbitrary Options Update
Accordion – Multiple Accordion or FAQs Builder
≤2.0.2Update to 2.0.3
- Medium6.1Administrator+ Cross-Site Scripting
Form – Contact Form
≤1.2.0Update to 1.2.1
- High8.8Cross-Site Request Forgery to Settings Update
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤4.1.11Update to 4.1.12
- High7.2Admin+ Malicious File Upload
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
≤3.6.7Update to 3.6.8
- Critical9.8Unauthenticated Arbitrary Options Update
Shortcode Addons- with Visual Composer, Divi, Beaver Builder and Elementor Extension
≤3.0.2Update to 3.0.3
- Medium6.1Cross-Site Scripting
Memory Usage, Memory Limit, PHP and Server Memory Health Check and Provide Suggestions
≤2.43Update to 2.44
- Medium6.1Reflected Cross-Site Scripting
WP Popular Posts
≤5.5.1Update to 6.0.0
- High8.8Cross-Site Request Forgery to Local File Inclusion
CAPTCHA 4WP – Antispam CAPTCHA solution for WordPress
≤7.0.6.1Update to 7.1.0
- Medium6.1Cross-Site Scripting
Unyson
≤2.7.26Update to 2.7.27
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
WP Maintenance
≤6.0.7Update to 6.0.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Request a Quote – Quote Forms for Any WordPress Site
≤2.3.7Update to 2.3.8
- Medium6.3Subscriber+ Settings Update
Custom Product Tabs for WooCommerce
≤1.7.7Update to 1.7.8
- High8.1Arbitrary File Modification
Ad Inserter Pro
≤2.7.15Update to 2.7.16
- Critical9.1Authenticated (Administrator+) Arbitrary Code Execution
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
≤3.6.7Update to 3.6.8
- High8.3CSV Injection
Request a Quote – Quote Forms for Any WordPress Site
≤2.3.8Update to 2.3.9
- Medium6.1Reflected Cross-Site Scripting
Dropdown Menu Widget
≤1.9.7No patch available
- High8.8Cross-Site Request Forgery
Name Directory
≤1.25.3Update to 1.25.4
- Medium5.3Sensitive File Disclosure
SP Project & Document Manager
≤4.57Update to 4.58
- Medium6.1Authenticated (Admin+) Stored Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.6.7Update to 1.6.8
- Medium5.5Cross-Site Scripting
Bulk Page Generator and Mass Page Builder – Page Generator
≤1.6.4Update to 1.6.6
- Medium5.5Authenticated Stored Cross-Site Scripting
Accept Stripe Payments
≤2.0.63Update to 2.0.64
- Critical9.8Remote Code Execution
The School Management Pro
≤9.9.6Update to 9.9.7