Database
WordPress Vulnerability Database (page 1251)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Admin+ Stored Cross-Site Scripting
Text Hover
≤4.1Update to 4.2
- Medium6.1Reflected Cross-Site Scripting
Maintenance Mode by Supsystic
≤1.7.5Update to 1.7.6
- High8.8Cross-Site Request Forgery
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<2.11.6Update to 2.11.6
- Medium6.1Reflected Cross-Site Scripting
Easy Google Maps by Supsystic – Custom Markers, Clustering & Map Themes
≤1.9.31Update to 1.9.32
- Medium6.4Reflected Cross-Site Scripting
Menubar
≤5.7.2Update to 5.8
- Medium5.5Admin+ Stored Cross-Site Scripting
Social comments by WpDevArt
≤2.4.9Update to 2.5.0
- Medium5.5Admin+ Stored Cross-Site Scripting
Thank Me Later
≤3.3.4No patch available
- Medium5.5Admin+ Stored Cross-Site Scripting
Page and Post Restriction
≤1.2.6Update to 1.2.7
- Medium5.4Missing Authorization Checks
DW Question Answer Pro
≤1.3.6Update to 1.3.7
- High7.2Unauthenticated Open Redirect
English WordPress Admin
≤1.5.1.1Update to 1.5.2
- Medium6.1Reflected Cross-Site Scripting
Nimble Page Builder
<3.2.2Update to 3.2.2
- Medium5.4Cross-Site Request Forgery
DW Question Answer Pro
≤1.3.6Update to 1.3.7
- Medium6.4SQL Injection
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress
≤1.0.13Update to 1.0.14
- High7.2Cross-Site Scripting
Brevo – Email, SMS, Web Push, Chat, and more.
≤3.1.39Update to 3.1.40
- High8.8Subscriber+ Blind SQL injection
Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress
<6.1.6Update to 6.1.6
- Medium4.8Admin+ Stored Cross-Site Scripting
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
≤2.8.3Update to 2.8.5
- Medium4.8Stored Cross-Site Scripting
Plausible Analytics
≤1.2.2Update to 1.2.3
- Medium4.9Authenticated Arbitrary File Read
WPvivid — Backup, Migration & Staging
≤0.9.70Update to 0.9.71
- Medium6.1Reflected Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
<2.7.12Update to 2.7.12
- High7.8Prototype Pollution
Insert Special Characters
≤1.0.4Update to 1.0.5
- Medium5.5Admin+ Cross-Site Scripting
Visual Form Builder
<3.0.7Update to 3.0.7
- Medium6.1UpdraftPlus WordPress Backup Plugin < 1.22.9 Reflected Cross-Site Scripting
UpdraftPlus Premium
<1.22.9Update to 1.22.9
- High8.1Authorization Weakness to Authentication Bypass
Security Optimizer – The All-In-One Protection Plugin
≤1.2.5Update to 1.2.6
- Medium5.4Unauthorized Setting Update
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams
≤1.3.7Update to 1.3.8
- Critical9.8Authentication Bypass via 2FA Setup
Security Optimizer – The All-In-One Protection Plugin
≤1.2.5Update to 1.2.6
- Medium6.1Reflected Cross-Site Scripting
Content Egg – Affiliate Product Importer & Price Comparison
<5.3.0Update to 5.3.0
- High7.2Cross-Site Scripting
Unify
≤3.2.5Update to 3.3.0
- Medium4.8Authenticated (Author+) Stored Cross-Site Scripting
Pricing Table
≤1.5.2No patch available
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
WP-Appbox
≤4.3.20Update to 4.3.21
- Medium6.1Reflected Cross-Site Scripting
Domain Replace
≤1.3.8No patch available