Database
WordPress Vulnerability Database (page 1253)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Missing Authorization
FloLaunch
<2.4.1Update to 2.4.1
- Critical9.8Unauthenticated SQL Injection
Donations
≤1.8No patch available
- Medium6.5Missing Authorization
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
<2.4.4Update to 2.4.4
- Medium6.1Reflected Cross-Site Scripting via cf-api
Caldera Forms – More Than Contact Forms
<1.9.7Update to 1.9.7
- Medium6.5Unauthenticated Remote Code Execution
Tatsu
≤3.3.12Update to 3.3.13
- Medium5.5Admin+ Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<2.11.6Update to 2.11.6
- Medium6.5Cross-Site Request Forgery to Settings Update
WP EasyCart: Shopping Cart and eCommerce Store
≤5.2.4Update to 5.2.5
- Critical9.8Arbitrary File Read
Admin Word Count Column
≤2.2No patch available
- High7.7Content-Type Bypass
Safe SVG
<1.9.10Update to 1.9.10
- Medium4.1Cross-Site Scripting
Simple Event Planner
≤1.5.4Update to 1.5.5
- Medium5.4Authenticated Stored Cross-Site Scripting
Simple Event Planner
≤1.5.4Update to 1.5.5
- Medium5.4Admin+ Local File Inclusion
Amministrazione Aperta
≤3.7.3Update to 3.8
- Medium5.5Admin+ Stored Cross-Site Scripting
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
<3.3.2Update to 3.3.2
- Medium5.3Email Address Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.6.7Update to 3.6.8
- Medium4.8Admin+ Stored Cross-Site Scripting
WP Downgrade | Specific Core Version
<1.2.3Update to 1.2.3
- Medium6.4Authenticated Stored Cross-Site Scripting
Loco Translate
<2.6.1Update to 2.6.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Ad Injection
≤1.2.0.19No patch available
- Critical9.8Missing Authorization
Product Table for WooCommerce
<3.1.2Update to 3.1.3
- Medium5.4Stored Cross-Site Scripting
Yoo Slider – Image Slider & Video Slider
<2.1.0Update to 2.1.0
- Medium5.4Cross-Site Request Forgery
Yoo Slider – Image Slider & Video Slider
<2.1.0Update to 2.1.0
- Medium6.5Cross-Site Request Forgery to Sensitive Data Export
Export All URLs
<4.3Update to 4.3
- Medium5.3Sensitive Data Disclosure
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤7.6.2Update to 7.6.3
- Medium5.5Admin+ Stored Cross-Site Scripting
Easy Social Icons
<3.2.1Update to 3.2.1
- High7.5Sensitive Information Disclosure
Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
≤7.6.2Update to 7.6.3
- Medium6.1Reflected Cross-Site Scripting via sub_page Parameter
WPvivid — Backup, Migration & Staging
<0.9.70Update to 0.9.70
- High7.2Authenticated SQL Injection
Advanced Booking Calendar
<1.7.1Update to 1.7.1
- Medium6.1Reflected Cross-Site Scripting
Favicon by RealFaviconGenerator
<1.3.23Update to 1.3.23
- Medium6.1Reflected Cross-Site Scripting
Export All URLs
<4.2Update to 4.2
- High7.2SQL Injection
Podcast Importer SecondLine
<1.3.8Update to 1.3.8
- Medium4.8Admin+ Stored Cross-Site Scripting
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
<3.3.2Update to 3.3.2