Database
WordPress Vulnerability Database (page 1252)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.5PHP Object Injection
Blog2Social: Social Media Auto Post & Scheduler
≤6.9.3Update to 6.9.4
- High7.5Directory Traversal
ElasticPress
≤4.1.0Update to 4.2.0
- Critical9.8Unauthenticated SQL Injection
Tipsacarrier
<1.5.0.5Update to 1.5.0.5
- Medium6.1Reflected Cross-Site Scripting
Domain Replace
≤1.3.8No patch available
- High7.2Unauthenticated Cross-Site Scripting
Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress
≤5.0.8Update to 6.0.0
- Medium6.4Stored Cross-Site Scripting
Shortcode for Current Date
≤2.1.4Update to 2.1.5
- Medium6.4Cross-Site Scripting
Lucky Wheel for WooCommerce – Spin a Sale
≤1.0.10Update to 1.0.11
- Medium6.1Reflected Cross-Site Scripting and Cross-Site Request Forgery
Ad Invalid Click Protector (AICP)
≤1.2.5.2Update to 1.2.7
- Medium5.5Authenticated Stored Cross-Site Scripting
Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress
≤1.7.4Update to 1.7.5
- Medium4.1Authenticated (Editor+) Stored Cross-Site Scripting
Testimonial Slider – Free Testimonials Slider Plugin
≤3.5.8.3Update to 3.5.8.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
wpDataTables (Premium)
≤2.1.27Update to 2.1.28
- Medium6.4Stored Cross-Site Scripting
FV Flowplayer Video Player
≤7.5.18.727Update to 7.5.19.728
- Medium5.4Authorization Bypass
Weblizar Pin It Button On Image Hover And Post
<3.4Update to 3.4
- Medium4.3Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
<2.4.3.1Update to 2.4.3.1
- Medium5.5Admin+ Stored Cross-Site Scripting
amr users
<4.59.4Update to 4.59.4
- High8.8Arbitrary Plugin Installation and Activation
Event Countdown for The Events Calendar
≤1.3.1Update to 1.4
- Medium6.5Missing Authorization
Quick Adsense – Ad Manager & AdSense Ads
<2.8.2Update to 2.8.2
- Medium6.1Reflected Cross-Site Scripting
WP YouTube Live
≤1.7.21Update to 1.7.22
- Medium6.4Stored Cross-Site Scripting
ULeak Security & Monitoring Plugin
≤1.2.3No patch available
- Medium5.4Cross-Site Request Forgery to API Key Deactivation
Use Any Font | Custom Font Uploader
≤6.1.7Update to 6.1.8
- Medium6.4Cross-Site Scripting
Animate It!
<2.4.0Update to 2.4.0
- Medium6.5Authenticated Information Disclosure
Advanced Custom Fields (ACF®)
<5.12.1Update to 5.12.1
- Medium6.1Reflected Cross-Site Scripting via AJAX call of check_country_selector
WordPress Country Selector
≤1.6.5Update to 1.6.6
- Medium6.1Reflected Cross-Site Scripting
Anti-Spam, Spam FireWall by CleanTalk
≤5.173Update to 5.174.1
- Medium5.3Sensitive Information Exposure
Be POPIA Compliant
≤1.1.5Update to 1.1.16
- Medium6.1Reflected Cross-Site Scripting
Anti-Spam, Spam FireWall by CleanTalk
≤5.173Update to 5.174.1
- Critical9.8Unauthenticated Local File Inclusion
Videos sync PDF
≤1.7.4No patch available
- Medium5.9Admin+ Stored Cross-Site Scripting
Clipr
≤1.2.3No patch available
- Medium6.5Unauthenticated Maintenance Mode Enabled/Disable
Curtain
<1.0.2Update to 1.0.2
- Critical9.8Unauthenticated SQL Injection
Donations
≤1.8No patch available