Database
WordPress Vulnerability Database (page 1234)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Missing Authorization to Settings Update
Shortcut Macros
≤1.3No patch available
- Medium6.1Reflected Cross-Site Scripting
Awin Data Feed
≤1.7Update to 1.8
- Medium5.4Cross-Site Request Forgery to Plugin Settings Change
Photo Gallery by Supsystic – Image Gallery, Masonry, Albums & Lightbox
≤1.15.5Update to 1.15.6
- High8.8Cross-Site Request Forgery to Settings Update & Cross-Site Scripting
Sharebar
≤1.4.1No patch available
- High8.8Cross-Site Request Forgery to Settings Update and Cross-Site Scripting
Pagebar2
≤2.65Update to 2.66
- High7.5Unauthenticated Post Export
Export to Text
≤2.4No patch available
- Critical9.8SQL Injection
Premium Courses & eLearning with Paid Memberships Pro for LearnDash, LifterLMS, Sensei LMS & TutorLMS
≤1.0.5Update to 1.1
- Medium6.3Missing Authorization on AJAX Actions
OnePress Opt-In Panda
≤2.6.2No patch available
- Medium5.3Missing Authorization to Mail Relay & Cross-Site Request Forgery
Lana Email Tester
≤1.0.0Update to 1.1.0
- Critical9.8Code Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.6.10Update to 3.0.34.2 or 3.1.10 or 3.2.28 or 3.3.21.4 or 3.4.34.2 or 3.5.8.4 or 3.6.11
- Medium6.4Missing Capabilities Check
Popup | Custom Popup Builder
≤1.3.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
XO Slider
≤3.3.2Update to 3.3.3
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Dynamic Team Manager – Team Member Showcase with grid, slider, table Elementor widget & shortcode
≤2.0.0Update to 2.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Travel Management
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Gravity PDF
≤6.3.0Update to 6.3.1
- Medium5.4Incorrect Authorization
Qubely – Advanced Gutenberg Blocks
1.8.0 – 1.8.0Update to 1.8.1
- Medium6.1Reflected Cross-Site Scripting
Checkout Field Manager (Checkout Manager) for WooCommerce
≤5.5.6Update to 5.5.7
- Medium6.1Reflected Cross-Site Scripting
Easy Testimonials
≤3.8Update to 3.9
- Medium6.1Reflected Cross-Site Scripting
Weight Based Shipping Table Rate for WooCommerce – Flexible Shipping
≤4.11.8Update to 4.11.9
- Medium6.1Reflected Cross-Site Scripting
Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer
≤2.0.4Update to 2.0.5
- Medium6.1Reflected Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.1.6.5Update to 4.1.6.6
- Medium6.1Reflected Cross-Site Scripting
Real Cookie Banner: GDPR & ePrivacy Cookie Consent
≤2.18.1Update to 2.18.2
- Medium6.1Unauthenticated DOM-based Reflected Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤3.5.5Update to 3.5.6
- Medium4.8Cross-Site Scripting via field label
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.6.9Update to 3.6.10
- Medium6.1Reflected Cross-Site Scripting
Yampi Checkout
≤1.0.3Update to 1.0.4
- Medium6.1Reflected Cross-Site Scripting
Gallery – Image and Video Gallery with Thumbnails
≤1.9.9Update to 2.0.0
- Medium4.8Stored Cross-Site Scripting
WP Contact Slider – Contact Form Slider Widget
≤2.4.6Update to 2.4.7
- High8.8Arbitrary File Upload
eaSYNC Booking – Hotels, Restaurants & Car Rentals
≤1.1.15Update to 1.1.16
- High7.2Cross-Site Scripting via Data Import
Age Gate
≤2.17.0Update to 2.17.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via import
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.6.10Update to 3.6.11