Database
WordPress Vulnerability Database (page 1252)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Stored Cross-Site Scripting
WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters
<1.2.3Update to 1.2.3
- Medium6.4Authenticated (Author) Stored Cross-Site Scripting
Real Media Library: Media Library Folder & File Manager
≤4.14.1Update to 4.14.2
- High8.1Cross-Site Request Forgery to Arbitrary Post Deletion and Modification
Nested Pages
≤3.1.15Update to 3.1.16
- Critical9.8Authentication Bypass
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤5.4.3Update to 5.4.4
- Medium5.4Authenticated Stored Cross-Site Scripting
Recipe Card Blocks Lite
<2.8.3Update to 2.8.3
- Critical9.8Unauthenticated SQL Injection
Podlove Podcast Publisher
<3.5.6Update to 3.5.6
- Medium6.1Reflected Cross-Site Scripting
Recipe Card Blocks Lite
<2.8.1Update to 2.8.1
- High8.1Subscriber+ Arbitrary File/Folder Deletion
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤4.5.3Update to 4.5.4
- Medium4.8Authenticated Stored Cross-Site Scripting
Post Views Counter
≤1.3.4Update to 1.3.5
- Medium5.4Authenticated Stored Cross-Site Scripting
SimpLy Gallery
<2.2.1Update to 2.2.1
- Medium4.3Unauthorised Event TimeSlot Deletion
Timetable and Event Schedule by MotoPress
≤2.4.1Update to 2.4.2
- High7.2Authenticated (Admin+) Arbitrary File Upload
Simple Schools Staff Directory
≤1.1No patch available
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Shortcodes Ultimate – Content Elements
<5.10.2Update to 5.10.2
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting via blockType arguments
Fonts Plugin | Google Fonts, Adobe Fonts & Upload Fonts
<3.0.3Update to 3.0.3
- Medium6.4Unauthorised Event TimeSlot Update
Timetable and Event Schedule by MotoPress
≤2.4.1Update to 2.4.2
- Medium5.4Author+ Stored Cross-Site Scripting
Timetable and Event Schedule by MotoPress
≤2.3.18Update to 2.3.19
- Medium6.5Arbitrary User's Hashed Password/Email/Username Disclosure
Timetable and Event Schedule by MotoPress
≤2.3.19Update to 2.4.0
- Critical9.1Unauthenticated Path Traversal in REST API
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
≤4.5.3Update to 4.5.4
- Medium4.3Arbitrary Comment Deletion via Cross-Site Request Forgery
Comment Link Remove and Other Comment Tools
≤2.1.4Update to 2.1.6
- Medium6.1Stored Cross-Site Scripting
Limit Login Attempts
<4.0.50Update to 4.0.50
- Medium5.4Contributor+ Stored Cross-Site Scripting
WP Video Lightbox
≤1.9.2Update to 1.9.3
- High7.2Authenticated (Admin+) SQL Injection
WP Domain Redirect
≤1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
RESPONSIVE 3D SLIDER
≤1.2No patch available
- High8.8Authenticated (Admin+) SQL Injection
WordPress Page Contact
≤1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
MicroCopy
≤1.1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
The Sorter
≤1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
Display Users
≤2.0.0No patch available
- High7.2Authenticated SQL Injection via product_id Parameter
Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More
<3.3.1.0Update to 3.3.1.0
- High7.2Authenticated (Admin+) SQL Injection
GSEOR – WordPress SEO Plugin
≤1.3No patch available
- High8.8Authenticated (Admin+) SQL Injection
WP-Board
≤1.1(Beta)No patch available