Database
WordPress Vulnerability Database (page 1255)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Admin+ Stored Cross-Site Scripting
Site Reviews
<5.13.1Update to 5.13.1
- Medium6.1Cross-Site Scripting
Keyword Meta
≤3.0Update to 3.1
- High7.2Unauthenticated Cross-Site Scripting
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
≤3.1.10Update to 3.1.11
- Medium5.4Authenticated Stored Cross-Site Scripting
AddToAny Share Buttons
<1.7.46Update to 1.7.46
- Medium5.4Authenticated Stored Cross-Site Scripting
WPFront Notification Bar
≤2.0.0Update to 2.1.0
- Medium6.1Reflected Cross-Site Scripting
Titan Framework
all versionsNo patch available
- Medium6.1WP Fusion Lite <= 3.37.18 – Cross-Site Request Forgery to Data Deletion
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
≤3.37.18Update to 3.37.30
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Highlight Sitewide Notice, Text, Button Menu
<0.9.3Update to 0.9.3
- High8.8SQL Injection
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤2.4.1Update to 2.4.2
- Medium6.1WP Fusion Lite <= 3.37.18 – Reflected Cross-Site Scripting
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
≤3.37.18Update to 3.37.30
- High7.5Missing Capabilities Check to Information Disclosure
Welcart e-Commerce
<2.2.8Update to 2.2.8
- Medium5.4Authenticated Stored Cross-Site Scripting
Free Cookie Notice & Consent Banner for Privacy Compliance (GDPR, CCPA, DSGVO and others)
<1.7.2Update to 1.7.2
- High8.8Authenticated SQL Injection
WP Simple Booking Calendar
≤2.0.6Update to 2.0.7
- Medium6.1Cross-Site Scripting
ReFlex Gallery » WordPress Photo Gallery
<1.4.3Update to 1.4.3
- High8.8Authenticated SQL Injection
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
<6.60Update to 6.60
- Medium4.3Missing Capabilities Check to Information Disclosure
Welcart e-Commerce
<2.2.8Update to 2.2.8
- Medium5.5Stored Cross-Site Scripting
WP Mapa Politico España
<3.7.0Update to 3.7.0
- High8.8SQL Injection
Availability Calendar
<1.2.1Update to 1.2.1
- Medium5.5Stored Cross-Site Scripting
Availability Calendar
≤1.2.1Update to 1.2.2
- High7.5PHP Object Injection
Bold Page Builder
≤3.1.5Update to 3.1.6
- Medium6.1Cross-Site Scripting
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
<3.4.7Update to 3.4.7
- Medium5.5Authenticated Stored Cross-Site Scripting
Sitewide Notice WP
<2.3Update to 2.3
- Medium6.1Reflected Cross Site Scripting
Email Encoder – Protect Email Addresses and Phone Numbers
≤2.1.1Update to 2.1.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Business Hours Indicator
<2.3.5Update to 2.3.5
- Medium6.1Reflected Cross-Site Scripting via ga_action parameter
ShareThis Dashboard for Google Analytics
<2.5.2Update to 2.5.2
- High8.8Cross-Site Request Forgery
Youtube Feeder
≤2.0.1No patch available
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
WP Dialog
≤1.2.5.5No patch available
- High8.8Nifty Newsletters <= 4.0.23 – Cross-Site Request Forgery to Stored Cross-Site Scripting
Nifty Newsletters (Formerly Sola Newsletters)
≤4.0.23No patch available
- High8.8SQL Injection
ZhuiGe Official Website Mini Program
<1.1.1Update to 1.1.1
- Medium6.4Authenticated Stored Cross-Site Scripting
有赏 You Shang
≤1.0.1No patch available