Database
WordPress Vulnerability Database (page 1233)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.3Unprotected AJAX Actions
Print My Blog – Print, PDF, & eBook Converter WordPress Plugin
≤3.15.8Update to 3.15.9
- Medium5.3Open Redirect
Safe Redirect Manager
≤1.11.1Update to 2.0.0
- Medium6.1Multiple Cross-Site Scripting
Send PDF for Contact Form 7
≤0.9.1Update to 0.9.2
- Medium4.3Cross-Site Request Forgery
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤4.1.0Update to 4.1.11
- Medium6.1Cross-Site Scripting
Interactive Human Anatomy with Clickable Body Parts
≤2.4Update to 2.6
- Medium6.4Cross-Site Scripting
Dyslexiefont Free
≤0.0.2Update to 1.0.0
- Medium6.1Reflected Cross-Site Scripting
Hot Linked Image Cacher
≤1.16No patch available
- Medium6.1Cross-Site Scripting
WP Multisite Content Copier/Updater
≤1.4.0Update to 1.5.0
- High8.8Cross-Site Request Forgery to Options Update
FLV Embed
≤1.2.1No patch available
- Medium5.3Sensitive Information Disclosure
GiveWP – Donation Plugin and Fundraising Platform
≤2.20.2Update to 2.21.0
- Medium6.1Cross-Site Request Forgery to Settings Update
Page Link Manager
≤1.0bNo patch available
- High8.8Cross-Site Request Forgery
Thumbnail For Excerpts
≤2.1No patch available
- Medium6.1Cross-Site Scripting
WP OER
≤0.9.0Update to 0.9.1
- Medium6.1Cross-Site Scripting
Special Text Boxes
≤5.9.110Update to 6.0.0
- Critical9.6Cross-Site Request Forgery and Cross-Site Scripting
SP Project & Document Manager
≤4.56Update to 4.57
- High8.3Server-Side Request Forgery
iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more
≤3.0.7Update to 3.0.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
MashShare – Social Media Share Buttons, Social Share Icons
≤3.8.1Update to 3.8.2
- High7.3Missing Authorization to Login URL Change
HC Custom WP-Admin URL
≤1.4No patch available
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.6.6Update to 1.6.7
- Medium6.1Reflected Cross-Site Scripting
Awin Data Feed
≤1.7Update to 1.8
- High8.8Cross-Site Request Forgery to Settings Update
Comment License
<1.4.0Update to 1.4.0
- Medium5.4Missing Authorization to Settings Update
Shortcut Macros
≤1.3No patch available
- Medium5.4Reflected Cross-Site Scripting
PDF Invoices & Packing Slips for WooCommerce
≤2.15.0Update to 2.16.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP-Paginate
<2.1.9Update to 2.1.9
- High7.2Unauthenticated Stored Cross-Site Scripting
Awin Data Feed
≤1.7Update to 1.8
- Medium6.1Reflected Cross-Site Scripting
WooCommerce – Product Importer
≤1.5.2Update to 1.5.3
- Critical9.8Unauthenticated SQL Injection
Pricing Deals for WooCommerce
≤2.0.2.02Update to 2.0.3
- Medium6.5Cross-Site Request Forgery & Unauthenticated Settings Change
Rename wp-login.php
≤2.6.0No patch available
- Medium6.5Unauthorized AJAX Actions due to Nonce Bypass
Wbcom Designs – BuddyPress Group Reviews
≤2.8.3Update to 2.8.4
- Medium6.1Cross-Site Scripting
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤2.4.6.1Update to 2.4.7