Database
WordPress Vulnerability Database (page 1232)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Authentication Bypass
Login with Cognito
≤1.4.6Update to 1.4.7
- Medium5.5Administrator+ Cross-Site Scripting
404s
≤3.4.9Update to 3.5.1
- High8.8Cross-Site Request Forgery
Freshdesk (official)
≤2.3.6Update to 2.4.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Stape Conversion Tracking
≤1.1.1Update to 1.1.2
- Medium6.5Unprotected AJAX Actions
eBay Dropshipping and Affiliate by Wooshark
≤1.5.6No patch available
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Post Comments as bbPress Topics
≤2.2.3Update to 2.2.4
- Medium5.4Authenticated Stored Cross-Site Scripting via Element URL
Brizy – Page Builder
<2.4.2Update to 2.4.2
- Medium6.4Contributor+ Cross-Site Scripting
Download Manager
≤3.2.46Update to 3.2.47
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Power BI Embedded for WordPress
1.1.3 – 1.1.3Update to 1.1.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Very Simple Breadcrumb
≤1.0No patch available
- Medium5.4Authenticated Stored Cross-Site Scripting via Element Content
Brizy – Page Builder
<2.4.2Update to 2.4.2
- Medium6.1Reflected Cross-Site Scripting
Import CSV Files
≤1.0No patch available
- Medium4.3Cross-Site Request Forgery
MainWP Dashboard: Self-hosted WordPress Management for Agencies
≤4.2.4.1Update to 4.2.5
- Medium6.1Multiple Cross-Site Scripting
CDI – Collect and Deliver Interface for Woocommerce
≤5.1.9Update to 5.1.10
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
LinkedIn Company Updates
≤1.5.3No patch available
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
Simple Contact Form Plugin for WordPress – WP Easy Contact
≤3.7.3Update to 3.8
- Medium5.4Missing Authorization
Cache Images
≤3.1Update to 3.2.1
- Medium5.5Authenticated (Admin+) HTML Injection
WooCommerce
<6.6.0Update to 6.6.0
- High8.8Cross-Site Request Forgery
LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
≤2.4.4Update to 2.4.5
- Medium6.1Stored Cross Site Scripting
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
<3.1.28Update to 3.1.28
- Medium5.4Reflected Cross-Site-Scripting
Shortcodes and extra features for Phlox theme
<2.9.8Update to 2.9.8
- Medium6.1Reflected Cross-Site Scripting
Analytify – Google Analytics 4 Tracking and Reporting in WordPress
≤4.2.0Update to 4.2.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Bold Page Builder
<4.3.3Update to 4.3.3
- Medium5.5Authenticated (Admin+) Stored Cross Site Scripting
WP Duplicate Page
<1.3Update to 1.3
- Medium4.3Cross-Site Request Forgery to Post Status Update
Admin Management Xtended
<2.4.5Update to 2.4.5
- Medium6.1Reflected Cross-Site Scripting via wahi
WP Accessibility Helper (WAH)
<0.6.0.7Update to 0.6.0.7
- High8.8Cross-Site Request Forgery to Settings Update
WP Opt-in
≤1.4.1No patch available
- High8.8Cross-Site Request Forgery to Image Upload
Cache Images
≤3.1Update to 3.2.1
- Medium6.3Unprotected AJAX Actions
Print My Blog – Print, PDF, & eBook Converter WordPress Plugin
≤3.15.8Update to 3.15.9
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤4.1.10Update to 4.1.11