Database
WordPress Vulnerability Database (page 1256)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Bulk Creator
≤1.0.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Online Payment for Bank Mellat
≤2.0.0Update to 2.0.1
- Medium4.9Authenticated Arbitrary File Read
String locator
<2.5.0Update to 2.5.0
- Medium6.5Authenticated (Contributor+) Path Traversal
Iptanus File Upload
≤4.16.2Update to 4.16.3
- Medium6.1Reflected Cross-Site Scripting
dTabs
≤1.4No patch available
- Medium5.3Unauthenticated Arbitrary Post Deletion
OSMapper
≤2.1.5No patch available
- High7.5Path Traversal
Narnoo Distributor
≤2.5.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Database Peek
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
WPC Smart Wishlist for WooCommerce
<2.9.4Update to 2.9.4
- High8.8Cross-Site Request Forgery
Sermon Browser
≤0.45.22No patch available
- High7.1Cross-Site Scripting
Delete Old Orders
≤0.2No patch available
- Medium6.4Subscriber+ Stored Cross-Site Scripting
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
<1.12.1Update to 1.12.1
- Critical9.8Unauthenticated SQL Injection
Simple Link Directory – AI Powered
<7.7.2Update to 7.7.2
- High7.5Unauthenticated SQL Injection
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
≤2.3.11Update to 2.3.12
- Medium6.1Reflected Cross-Site Scripting
Mega Menu Plugin for WordPress – AP Mega Menu
<3.0.8Update to 3.0.8
- Critical9.8SQL Injection
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress
<1.0.11Update to 1.0.11
- High8.1Unauthenticated Arbitrary Options Deletion
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
≤5.4.52Update to 5.5
- Medium6.1Reflected Cross-Site Scripting
GEO Plugin by Squirrly SEO
<11.1.12Update to 11.1.12
- Critical9.8Backdoor
Mistape
1.4.0 – 1.4.0No patch available
- Medium6.4Stored Cross-Site Scripting
Modern Events Calendar Lite
≤6.3.0Update to 6.4.0
- Critical9.8Unauthenticated SQL Injection
Advanced Booking Calendar
≤1.6.9Update to 1.7.0
- Critical9.1Server Side Request Forgery
FormCraft – Form Builder
<3.8.28Update to 3.8.28
- Medium6.1Reflected Cross-Site Scripting
Pricing Table Builder – AP Pricing Tables Lite
≤1.1.4Update to 1.1.5
- Critical9.8SQL Injection
AI Infographic Maker
≤4.3.7Update to 4.3.8
- Medium6.1Reflected Cross-Site Scripting
Contact Form X
≤2.4Update to 2.4.1
- Medium6.5Cross-Site Request Forgery to Arbitrary Transaction Deletion
Simple Membership
<4.1.0Update to 4.1.0
- Medium6.4Photoswipe Masonry Gallery <= 1.2.14 Stored Cross-Site Scripting
Photoswipe Masonry
≤1.2.14Update to 1.2.15
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Information Disclosure
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
≤1.14.13Update to 1.14.14
- High8.8Amelia < 1.0.47 - Arbitrary File Upload
Booking for Appointments and Events Calendar – Amelia
<1.0.47Update to 1.0.47
- Medium6.1Reflected Cross-Site Scripting
Booking for Appointments and Events Calendar – Amelia
≤1.0.46Update to 1.0.47