Database
WordPress Vulnerability Database (page 1237)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
ClimateClick: Climate Action for all
≤1.0.9.21Update to 1.0.9.22
- Medium6.1Reflected Cross-Site Scripting
Visualizer – Tables & Charts Manager with Built-in AI Generator
≤3.7.6Update to 3.7.7
- Medium6.1Reflected Cross-Site Scripting
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤5.5.8Update to 5.5.9
- Medium6.1Open Redirect
WPSID Shortcode
≤1.0.9.2No patch available
- High8.8Cross-Site Request Forgery
Tiny Contact Form
≤0.7No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
More Featured Images
≤1.0.0No patch available
- High7.2Stored Cross-Site Scripting via IP
PPC Tracker WordPress Plugin
≤2.0No patch available
- High7.2CSV Injection
Exports and Reports
≤0.9.1Update to 0.9.2
- Medium6.1Reflected Cross-Site Scripting and Cross-Site Request Forgery
Cookie Params
≤0.2No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Smartkit
≤1.0No patch available
- Medium6.1Cross-Site Scripting
BuddyPress & BuddyBoss Member Profile Forms
≤1.4.21Update to 1.4.22
- Medium6.1Cross-Site Request Forgery
MailPress
≤7.2.1No patch available
- Critical9.6Cross-Site Request Forgery
OpenBook Book Data
≤3.5.2No patch available
- High8.8Cross-Site Request Forgery
Clean-Contact
≤1.6No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Custom Colors for Real Estate Manager
≤1.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Zengo Custom Thumbnail Image Gallery
≤1.0.4No patch available
- Medium6.1Reflected Cross-Site Scripting
Spectra Legacy – Gutenberg Blocks
≤1.25.5Update to 1.25.6
- Medium5.5Stored Cross-Site Scripting via Content Element ID
GTM4WP – A Google Tag Manager (GTM) plugin for WordPress
≤1.15.1Update to 1.15.2
- Medium6.1Reflected Cross-Site Scripting
Video Conferencing with Zoom
≤3.9.2Update to 3.9.3
- Medium6.1Reflected Cross-Site Scripting
Automatic Domain Changer
≤2.0.2Update to 2.0.3
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
WPMK Ajax Finder
≤1.0.1No patch available
- Medium6.1Cross-Site Request Forgery
WP Post Styling
≤1.3.0Update to 1.3.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Weberino Timed Quiz
≤0.6.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Germanized for WooCommerce
≤3.9.4Update to 3.9.5
- High8.8Cross-Site Request Forgery
WP Sentry
≤1.0No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Mobile browser color select
≤1.0.1No patch available
- Medium6.1Reflected Cross-Site Scripting
CURCY – Multi Currency for WooCommerce
≤2.1.17Update to 2.1.18
- High8.8Cross-Site Request Forgery to Settings Update
Rotating Posts
≤1.11No patch available
- Medium6.4SQL Injection
Restaurant Reservations
≤1.7Update to 1.8
- High8.8Cross-Site Request Forgery to Settings Update
Running Line
≤1.2No patch available