Database
WordPress Vulnerability Database (page 1247)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Authenticated SQL Injection
3xSocializer
≤0.98.22No patch available
- Critical9.8Unauthenticated SQL Injection
Pricing Table Plugin
≤3.6Update to 3.6.1
- Medium6.1Cross-Site Scripting
WP Subtitle
≤3.4Update to 3.4.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Gmedia Photo Gallery
<1.20.0Update to 1.20.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
ScrollReveal.js Effects
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
WPCargo Track & Trace
≤6.9.4Update to 6.9.5
- Medium6.1Admin+ Stored Cross Site Scripting
WPCargo Track & Trace
≤6.9.4Update to 6.9.5
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Tracked Tweets
≤0.2.9No patch available
- Medium4.8Admin+ Stored Cross-Site Scripting
WP YouTube Live
≤1.8.2Update to 1.8.3
- High7.5Sensitive Information Disclosure
MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
≤2.1.3Update to 2.1.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Easy Smooth Scroll Links
≤2.23.1No patch available
- Medium6.1Stored Cross-Site Scripting
Advanced Contact form 7 DB
≤1.8.7Update to 1.8.8
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Rara One Click Demo Import
≤1.2.9Update to 1.3.0
- Medium6.4Builder forms Addon For WordPress < 5.2 - Insecure Direct Object Reference to Profile Picture Deletion
WPQA - Builder forms Addon For WordPress
<5.2Update to 5.2
- Medium5.5Admin+ Stored Cross-Site Scripting
VikBooking Hotel Booking Engine & PMS
<1.5.8Update to 1.5.8
- Medium5.4Builder forms Addon For WordPress < 5.2 - Stored Cross-Site Scripting via Profile fields
WPQA - Builder forms Addon For WordPress
<5.2Update to 5.2
- Medium5.5Arbitrary File Upload
VikBooking Hotel Booking Engine & PMS
<1.5.8Update to 1.5.9
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP LESS to CSS
≤1.0No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
VikBooking Hotel Booking Engine & PMS
<1.5.8Update to 1.5.8
- Medium5.3Builder forms Addon For WordPress < 5.2 - Insecure Direct Object Reference to Private Message Disclosure
WPQA - Builder forms Addon For WordPress
<5.2Update to 5.2
- Medium5.4Paid Author Subscriptions, Content, Downloads, Membership <= 1.9.5 - Cross-Site Request Forgery
MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet
≤1.9.5Update to 1.9.6
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Social Stickers
≤2.2.9No patch available
- Medium6.4Stored Cross-Site Scripting
Easy Call With Twilio
<1.1.0Update to 1.1.0
- Medium6.5Unauthenticated Arbitrary File Read
Admin Word Count Column
≤2.2No patch available
- Medium5.5Cross-Site Scripting
Donorbox – Free Recurring Donation Plugin and Fundraising Platform
≤7.1.6Update to 7.1.7
- Medium6.5Unauthenticated Local File Inclusion
Cab fare calculator
≤1.0.3Update to 1.0.4
- Medium6.4Authenticated (Subscriber+) Blind Server-Side Request Forgery
External Media without Import
≤1.1.2No patch available
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.16.4Update to 1.16.5
- Medium5.5Stored Cross-Site Scripting
th23 Social
≤1.2.0No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Custom TinyMCE Shortcode Button
≤1.1No patch available