Database
WordPress Vulnerability Database (page 1235)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated (Subscriber+) SQL Injection
Social Share Buttons by Supsystic
≤2.2.6Update to 2.2.7
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
ToolBar to Share
≤2.0No patch available
- Medium6.4Stored Cross-Site Scripting via Media Upload
Gallery Bank – WordPress Photo Gallery Plugin
≤4.0.50No patch available
- Medium6.4Stored Cross-Site Scripting via Gallery Description
Gallery Bank – WordPress Photo Gallery Plugin
≤4.0.50No patch available
- Medium6.3Missing Authorization
Social Share Buttons by Supsystic
≤2.2.3Update to 2.2.4
- Medium5.4Cross-Site Request Forgery
API KEY for Google Maps
≤1.2.1Update to 1.2.2
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Copify
≤1.3.0No patch available
- Medium5.5Authenticated (Admin+) Cross-Site Scripting via label
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.6.9Update to 3.6.10
- High7.2Unauthenticated Server-Side Request Forgery
Skitter Slideshow
≤2.5.2No patch available
- Medium6.1Reflected Cross-Site Scripting
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring
≤3.1.1Update to 3.1.2
- Medium6.1Reflected Cross-Site Scripting
WP Menu Cart
≤2.11.0Update to 2.12.0
- Medium6.1Cross-Site Scripting
PDF Invoices & Packing Slips for WooCommerce
2.14.5 – 2.14.5Update to 2.15
- High8.8Multiple Cross-Site Request Forgery Vulnerabilities
wp-championship
≤9.2Update to 9.3
- High7.53.5.1 - Sensitive Information Disclosure
Co-Authors Plus
3.5 – 3.5.1Update to 3.5.2
- Medium6.1Reflected Cross-Site Scripting
Menu Cart for WooCommerce
≤2.11.0Update to 2.12.0
- Medium6.1Reflected Cross-Site Scripting
WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel
≤1.3.5Update to 1.3.6
- High8.8Cross-Site Request Forgery to Field Import and PHP Object Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.6.9Update to 3.6.10
- Medium5.4Missing Authorization
Qubely – Advanced Gutenberg Blocks
≤1.7.8Update to 1.7.9
- Medium4.8Stored Cross-Site Scripting
Nested Pages
<3.1.21Update to 3.1.21
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
SAML IDP (Identity Provider) – Login with Website Users
≤1.13.3Update to 1.13.4
- Medium4.8Cross-Site Scripting
Login with TOTP (Google Authenticator, Microsoft Authenticator)
≤1.0.7Update to 1.0.8
- Medium4.8Administrator+ Cross-Site Scripting
Limit Login Attempts
≤4.0.71Update to 4.0.72
- Critical9.6Cross-Site Request Forgery to Settings Update and Cross-Site Scripting
Site Offline or Coming Soon
≤1.6.6No patch available
- Medium4.8Cross-Site Scripting
Malware Scanner
≤4.5.1Update to 4.5.2
- Medium4.8Authenticated (Admin+) Cross-Site Scripting
NextCellent Gallery – NextGEN Legacy
≤1.9.35No patch available
- High8.8Cross-Site Request Forgery to Settings Update
MyCSS
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Modula Image Gallery – Photo Grid & Video Gallery
≤2.6.6Update to 2.6.7
- Critical9.6Cross-Site Request Forgery to Cross-Site Scripting
Login with TOTP (Google Authenticator, Microsoft Authenticator)
≤1.0.4Update to 1.0.5
- Medium6.1Admin+ Stored Cross-Site Scripting
WordPress Security – Firewall, Malware Scanner, Secure Login and Backup
≤4.2Update to 4.2.1
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
≤5.5.5Update to 5.5.6