Database
WordPress Vulnerability Database (page 1241)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery to Settings Update
New User Email Set Up
≤0.5.2No patch available
- Medium5.5Authenticated Stored Cross-Site Scripting
WP Admin Style
≤0.1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Keep Backup Daily
≤2.0.2Update to 2.0.3
- High7.2Captcha Bypass
VS Contact Form
≤11.5Update to 11.6
- Medium6.1Multiple Cross-Site Scripting
WowStore – Store Builder & Product Blocks for WooCommerce
≤2.2.5Update to 2.2.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Promotion Slider
≤3.3.4No patch available
- Medium5.5Cross-Site Scripting via pwdms_csv_category parameter
Passwords Manager
≤1.4.4Update to 1.4.5
- Critical9.0Authenticated SQL Injection
WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel
≤1.3.4Update to 1.3.5
- Medium6.1Reflected Cross-Site Scripting via Site Search
GTM4WP – A Google Tag Manager (GTM) plugin for WordPress
≤1.15Update to 1.15.1
- High8.8SQL Injection
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
≤3.72Update to 3.73
- Medium4.7Reflected Cross-Site Scripting
Code Snippets
≤2.14.3Update to 2.14.4
- High8.8Arbitrary Settings Update via Cross-Site Request Forgery
Email Users
≤4.8.8No patch available
- High7.5Sensitive Information Disclosure
Log WP_Mail
≤0.1No patch available
- High8.8Cross-Site Request Forgery to Arbitrary Settings Update and Stored Cross-Site Scripting
Quick Subscribe
≤1.7.1No patch available
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Carousel CK
≤1.1.0No patch available
- Medium6.1Stored Cross-Site Scripting via organization_id
Second Street
≤3.1.6Update to 3.1.7
- Medium6.5Authenticated Arbitrary Plugin Deletion
Jupiter
≤6.10.1Update to 6.10.2
- Medium5.4Cross-Site Scripting
Event RSVP and Simple Event Management Plugin
≤3.8.4Update to 3.8.5
- Critical9.9Authenticated Privilege Escalation
Jupiter
≤6.10.1Update to 6.10.2
- Medium6.5Information Exposure
HC Custom WP-Admin URL
≤1.4No patch available
- Medium5.5Authenticated Stored Cross-Site Scripting
Slideshow CK
≤1.4.9Update to 1.4.10
- High8.8Arbitrary Settings Update via Cross-Site Request Forgery
Latest Tweets Widget
≤1.1.4No patch available
- Critical9.6Cross-Site Request Forgery
HC Custom WP-Admin URL
≤1.4No patch available
- High7.2Authenticated (Admin+) Arbitrary File Upload
WP SVG Icons
≤3.2.3No patch available
- Medium6.3Information Disclosure, Modification, and Denial of Service
Jupiter X Core
≤2.0.6Update to 2.0.7
- Medium6.1Stored Cross-Site Scripting
Custom Share Buttons with Floating Sidebar
≤4.1Update to 4.2
- High7.2CSV injection
WP-CRM – Customer Relations Management for WordPress
≤1.2.1No patch available
- Medium6.1Signup forms <= 1.5.3 - Reflected Cross-Site Scripting
MailerLite – Signup forms (official)
≤1.5.3Update to 1.5.4
- Medium6.1WooCommerce Product Filter <= 1.3.7 - Reflected Cross-Site Scripting
Themify – WooCommerce Product Filter
≤1.3.7Update to 1.3.8
- Medium6.5Authenticated Arbitrary Plugin Deactivation and Settings Modification
JupiterX
≤2.0.6Update to 2.0.7