Database
WordPress Vulnerability Database (page 1250)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams
≤1.3.7Update to 1.3.8
- Medium4.3Cross-Site Request Forgery
Yoo Slider – Image Slider & Video Slider
≤2.0.0Update to 2.1.0
- Medium4.3Cross-Site Request Forgery
Yoo Slider – Image Slider & Video Slider
≤2.0.0Update to 2.1.0
- Medium4.8Authenticated Stored Cross-Site Scripting
Responsive Tabs
≤4.0.5Update to 4.0.6
- Critical9.8Unauthenticated SQL injection
Master Elements
≤8.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Easy Social Feed – All In One Social Feed Plugin for WordPress
≤6.2.6Update to 6.2.7
- High7.2Authenticated Arbitrary File Upload
Import WP – CSV & XML Import Export for WordPress
≤2.4.5Update to 2.4.6
- Medium5.5Authenticated Stored Cross-Site Scripting via Advert Names
AdRotate Banner Manager
<5.8.23Update to 5.8.23
- Medium5.5Authenticated Stored Cross-Site Scripting via Group Names
AdRotate Banner Manager
<5.8.23Update to 5.8.23
- Medium5.5Stored Cross-Site Scripting
Import and export users and customers
<1.19.2.1Update to 1.19.2.1
- Medium6.1Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.6.3Update to 1.6.3
- High7.2Authenticated (Admin+) Arbitrary File Upload
One Click Demo Import
<3.1.0Update to 3.1.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Page Security & Membership
≤1.5.15No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
SearchIQ – The Search Solution
≤3.8Update to 3.9
- High8.8SQL Injection
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.6.3Update to 1.6.3
- Medium5.3Unauthenticated Sensitive Information Disclosure
RSVP and Event Management
≤2.7.7Update to 2.7.8
- Medium5.5Admin+ Stored Cross-Site Scripting
LayerSlider
≤7.1.1Update to 7.1.2
- High8.1Server Side Request Forgery
HubSpot All-In-One Marketing – Forms, Popups, Live Chat
<8.8.15Update to 8.8.15
- Medium5.5Admin+ Cross-Site Scripting
Easy Social Icons
≤3.1.4Update to 3.2.0
- Medium5.5Admin+ Cross-Site Scripting
Easy Social Icons
≤3.2.2Update to 3.2.3
- High8.8Cross-Site Request Forgery to Data Modification
Visual Form Builder
<3.0.8Update to 3.0.8
- High7.3Authenticated (Admin+) Cross-Site Scripting and Missing Authorization Checks
Easy Social Icons
≤3.2.0Update to 3.2.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Good & Bad comments
≤1.0.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Anti-Malware Security and Brute-Force Firewall
<4.20.96Update to 4.20.96
- Medium6.1Open Redirect and Reflected Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<4.4.11Update to 4.4.11
- Medium6.5Information Disclosure
WooCommerce
<5.6.1Update to 4.0.3 or 4.1.3 or 4.2.4 or 4.3.5 or 4.4.3 or 4.5.4 or 4.6.4 or 4.7.3 or 4.8.2 or 4.9.4 or 5.0.2 or 5.1.2 or 5.2.4 or 5.3.2 or 5.4.3 or 5.5.3 or 5.6.1 or 5.7.0
- Medium5.4Authorization Bypass and Cross-Site Request Forgery
ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
≤3.10.4Update to 3.10.5
- Medium5.4Subscriber+ Arbitrary Affiliate Links Creation
ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
≤3.10.4Update to 3.10.5
- Medium5.5Cross-Site Scripting
Opensea
≤1.0.2Update to 1.0.3
- High8.8Cross-Site Request Forgery
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<2.11.6Update to 2.11.6