Database
WordPress Vulnerability Database (page 1248)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.3Unauthenticated Server-Side Request Forgery
Avada (Fusion) Builder
<3.6.2Update to 3.6.2
- High7.2Arbitrary File Upload
AGIL(Automatic Grid Image Listing)
≤1.0No patch available
- Medium6.4Authenticated (Subscriber+) Blind Server-Side Request Forgery
External Media without Import
≤1.1.2No patch available
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
≤1.16.4Update to 1.16.5
- Medium6.1Reflected Cross-Site Scripting
Advanced Image Sitemap
≤1.2No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Custom TinyMCE Shortcode Button
≤1.1No patch available
- Medium5.5Stored Cross-Site Scripting
th23 Social
≤1.2.0No patch available
- Medium6.1Stored Cross-Site Scripting
BulletProof Security
<6.1Update to 6.1
- Medium5.5Cross-Site Scripting
Bulk Edit and Create User Profiles – WP Sheet Editor
<1.5.14Update to 1.5.14
- Medium5.3Sensitive Information Exposure
VikBooking Hotel Booking Engine & PMS
≤1.5.3Update to 1.5.4
- Critical9.8Arbitrary File Upload
VikBooking Hotel Booking Engine & PMS
≤1.5.3Update to 1.5.4
- Medium6.5Unauthenticated SQL Injection
Ubigeo de Perú para Woocommerce y WordPress
<3.6.4Update to 3.6.4
- High7.3SQL Injection
MapSVG
<6.2.20Update to 6.2.20
- Critical9.8Unauthenticated SQL Injection
Personal Dictionary – Vocabulary Games, Memory Games
<1.3.4Update to 1.3.4
- Medium5.5Editor+ Cross-Site Scripting
Slide Anything – Responsive Content / HTML Slider and Carousel
<2.3.44Update to 2.3.44
- Medium5.3Sensitive Information Disclosure
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
<1.10.9Update to 1.10.9
- High8.5PHP Object Injection via Shortcode
Booking Calendar
≤9.1Update to 9.1.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Event List
≤0.8.7Update to 0.8.8
- Critical9.8Unauthenticated SQL Injection
SiteSuperCharger
≤5.1.10Update to 5.2.0
- Medium6.1Reflected Cross-Site Scripting
Open Close Store for WooCommerce – Business Hours & Order Scheduling
≤4.3.0Update to 4.3.1
- Medium4.7Multiple Unauthenticated Stored Cross-Site Scripting
KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin
≤1.5.5Update to 1.5.6
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Maintenance
≤6.0.5Update to 6.0.6
- Medium5.4Cross-Site Request Forgery
Simple Ajax Chat – Add a Fast, Secure Chat Box
≤20220115Update to 20220216
- Medium5.3Sensitive Information Disclosure
Simple Ajax Chat – Add a Fast, Secure Chat Box
≤20220115Update to 20220216
- Medium6.3Cross-Site Request Forgery
WP EasyCart: Shopping Cart and eCommerce Store
≤5.2.6Update to 5.3.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Easy Appointment Booking & Scheduling Plugin – Webba Booking Calendar
≤4.2.21Update to 4.2.22
- High7.2Admin+ Blind SSRF
EXMAGE – WordPress Image Links
≤1.0.6Update to 1.0.7
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Fancy Product Designer
≤4.7.5Update to 4.7.6
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Modern Events Calendar Lite
≤6.5.1Update to 6.5.2
- High7.5Unauthenticated SQL Injection
Product Filter For WooCommerce Product
≤1.3.0No patch available