Database
WordPress Vulnerability Database (page 1256)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Stored Cross-Site Scripting
youForms for WordPress – Creating Forms for CopeCart
≤1.0.5Update to 1.0.6
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Alojapro Booking Engine
≤1.1.15Update to 1.1.16
- High7.5Authenticated File Upload
Download Manager
≤3.1.24Update to 3.1.25
- Medium6.5Cross-Site Scripting
Download Manager
≤3.1.24Update to 3.1.25
- Medium5.5Stored Cross-Site Scripting
Splash Header
<1.20.8Update to 1.20.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
FluentSMTP – WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP
<2.0.1Update to 2.0.1
- High8.8Subscriber+ Arbitrary File Upload
SP Project & Document Manager
<4.24Update to 4.24
- Critical9.8Privilege Escalation
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium4.3Cross-Site Request Forgery leading to Settings Change
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium6.5Cross-Site Request Forgery
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium5.4Cross-Site Request Forgery
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium6.1Reflected Cross-Site Scripting
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- High8.8Cross-Site Request Forgery
Blue Admin
≤21.06.01No patch available
- High7.1Authenticated Insecure Direct Object References (IDOR)
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- High8.8add sticky fixed buttons < 2.2.6 - SQL Injection
Side Menu Lite – Sticky Floating Side Menu
<2.2.6Update to 2.2.6
- Medium6.1Reflected Cross-Site Scripting
Favicon by RealFaviconGenerator
<1.3.21Update to 1.3.21
- High8.8Admin Custom Login <= 3.2.7 – Cross-Site Request Forgery to Stored Cross-Site Scripting
Admin Custom Login
≤3.2.7Update to 3.2.8
- High8.8Cross-Site Request Forgery
SEO Backlinks
≤4.0.1No patch available
- Medium5.4Stored Cross-Site Scripting
HD Quiz
<1.8.4Update to 1.8.4
- Medium6.1Poll Maker <= 3.2.8 – Reflected Cross-Site Scripting
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
≤3.2.8Update to 3.2.9
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
LukasApps CAPTCHA tools for Contact Form 7
<0.0.9Update to 0.0.9
- Critical9.9Authenticated WordPress Options Change
Advanced Shipment Tracking for WooCommerce
≤3.2.6Update to 3.2.7
- Medium4.8Authenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.12.0Update to 2.12.0
- High8.8Post Index <= 0.7.5 Cross-Site Request Forgery to Stored Cross-Site Scripting
Post Index
≤0.7.5No patch available
- High8.8SQL Injection
Slider Hero with Video Background, Animation
<8.2.7Update to 8.2.7
- Medium5.4Contributor+ Stored Cross-Site Scripting
Simple Social Media Share Buttons – Social Sharing for Everyone
≤3.2.2Update to 3.2.3
- Critical9.8Unauthenticated SQL Injection
Directory Listings WordPress plugin – uListing
≤2.0.3Update to 2.0.4
- Medium5.5Authenticated Stored Cross-Site Scripting
WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS
<5.4.13Update to 5.4.13
- Medium5.4Authenticated Stored Cross-Site Scripting
WPFront Scroll Top
≤2.0.5Update to 2.0.6
- Medium6.4Cross-Site Scripting
Qyrr – simply and modern QR-Code creation
≤0.7Update to 0.8