Database
WordPress Vulnerability Database (page 1249)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery to Arbitrary Ban Deletion
Ad Invalid Click Protector (AICP)
≤1.2.5.2Update to 1.2.7
- Critical9.8Unauthenticated SQL Injection
Daily Prayer Time
<2022.03.01Update to 2022.03.01
- Medium4.8Stored Cross-Site Scripting
Easily Generate Rest API Url
≤1.0.0No patch available
- Medium6.5Missing Authorization to Order Disclosure
Tipsacarrier
<1.5.0.5Update to 1.5.0.5
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Autolinks
≤1.0.1No patch available
- Medium6.5Unauthenticated SQL Injection
Multiple Shipping Address Woocommerce
<2.0Update to 2.0
- Critical9.8Unauthenticated SQL Injection
Documentor – Create Product Documentation
≤1.5.3Update to 1.5.4
- High8.83.6.2 - Missing Authorization to Remote Code Execution
Elementor Website Builder – more than just a page builder
3.6.0 – 3.6.2Update to 3.6.3
- Medium5.4Cross-Site Scripting
Fast Flow
≤1.2.10Update to 1.2.11
- Critical9.8SQL Injection
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤13.1.0.5Update to 13.1.0.6
- High8.8Cross-Site Request Forgery
Custom Cart Link for WooCommerce
≤1.0.2Update to 1.1.0
- Medium5.4Insecure Direct Object Reference
WP 2FA – Two-factor authentication for WordPress
≤2.1.0Update to 2.2.0
- Critical9.8Unauthenticated SQL Injection
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
≤3.1.0No patch available
- Medium6.3Arbitrary Plugin Installation, Activation and Deactivation
Wbcom Designs – BuddyPress Activity Social Share
<3.3.0Update to 3.3.0
- Critical9.8Unauthenticated SQL Injection
BadgeOS
≤3.7.0Update to 3.7.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
IgniteUp – Coming Soon and Maintenance Mode
≤3.4.1Update to 3.4.2
- Medium6.1Reflected Cross-Site Scripting
LifterLMS Paypal
<1.4.0Update to 1.4.0
- Medium6.5IP Address Spoofing
RSFirewall!
≤1.1.24Update to 1.1.25
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Books & Papers
≤0.20210223Update to 0.20220219
- Medium6.1Reflected Cross-Site Scripting
Admin Menu Editor
≤1.0.4No patch available
- Medium6.5SQL Injection
WP Video Gallery
≤1.7.1No patch available
- Critical9.8SQL Injection
SEMA API
≤3.64Update to 4.02
- Critical9.8Unauthenticated SQL Injection
Build 5 Star Reviews on Google Reviews, Yelp, Facebook… easily and risk-free | RRatingg
≤1.2.53Update to 1.2.54
- High7.4Unauthenticated Arbitrary File Access
Web To Print Shop : uDraw
≤3.3.3Update to 3.4.0
- Medium4.8Admin+ Cross-Site Scripting
WP Social Buttons
≤2.1Update to 2.2
- Medium6.5Unauthenticated Arbitrary Options Update
Sitemap by click5
≤1.0.35Update to 1.0.36
- Medium6.1Cross-Site Request Forgery
CalderaWP License Manager
≤1.2.11No patch available
- Medium6.1Reflected Cross-Site Scripting
Themify Post Type Builder (PTB) Search Addon
≤1.3.9Update to 1.4.0
- Medium6.5Unauthenticated SQL Injection
StackWC Order Notification for WooCommerce – Get Instant Audio Alert on new Orders
<3.2.2Update to 3.2.2
- Medium4.3Cross-Site Request Forgery
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams
≤1.3.8Update to 1.3.9