Database
WordPress Vulnerability Database (page 1257)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Booking for Appointments and Events Calendar – Amelia
≤1.0.46Update to 1.0.47
- High8.8Amelia < 1.0.47 - Arbitrary File Upload
Booking for Appointments and Events Calendar – Amelia
<1.0.47Update to 1.0.47
- Medium5.4Cross-Site Request Forgery
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
<4.2.4Update to 4.2.4
- Medium4.8Stored Cross-Site Scripting
MaxGalleria
<6.2.7Update to 6.2.7
- Medium5.5Admin+ Stored Cross-Site Scripting
BulletProof Security
<5.8Update to 5.8
- High8.8Authenticated Arbitrary File Deletion
Advanced Contact form 7 DB
<1.8.7Update to 1.8.7
- Medium5.4Incorrect Authorization Checks on REST API Endpoints
WooCommerce
≤6.2.0Update to 6.2.1
- High7.2Path Traversal via Tax Importer
WooCommerce
≤6.2.0Update to 6.2.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Home Page Menu
<3.1Update to 3.1
- Medium5.5Stored Cross-Site Scripting
GDMylist
≤1.1.1No patch available
- Medium5.5Stored Cross-Site Scripting
Seo 301 Meta
≤1.9.1No patch available
- Medium4.8Admin+ Stored Cross-Site Scripting
List Petfinder Pets
≤1.0.18Update to 1.0.19
- Medium6.1Reflected Cross-Site Scripting
Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits
<1.8.5Update to 1.8.5
- Medium4.3Cross-Site Request Forgery
Hide Admin Bar Based on User Roles – Disable the WordPress Toolbar by Role or Capability
<3.1.0Update to 3.1.0
- Critical9.8Unauthenticated SQL Injection
CommonsBooking
<2.6.8Update to 2.6.8
- High8.8SQL Injection
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
<3.5.8Update to 3.5.8
- Medium6.1Reflected Cross-Site Scripting
Team Circle Image Slider With Lightbox
≤1.0.15Update to 1.0.16
- High7.2Unauthenticated Stored Cross-Site Scripting
Contact Form Submissions
<1.7.3Update to 1.7.3
- Medium6.1Reflected Cross-Site Scripting
WordPress Multisite Content Copier/Updater Pro
<2.1.2Update to 2.1.2
- Medium6.1Reflected Cross-Site Scripting
Countdown, Coming Soon, Maintenance – Countdown & Clock
<2.2.9Update to 2.2.9
- Critical9.8Unauthenticated Remote Code Execution
WPCargo Track & Trace
<6.9.0Update to 6.9.0
- Medium6.1Reflected Cross-Site Scripting
Cookie Information | Free GDPR Consent Solution
<2.0.8Update to 2.0.8
- Medium5.5Stored Cross-Site Scripting
Simple Tracking
≤1.6Update to 1.7
- Medium5.5Authenticated Stored Cross-Site Scripting
Patreon WordPress
<1.8.2Update to 1.8.2
- Medium6.1Reflected Cross-Site Scripting
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤5.0.8Update to 5.0.9
- High7.2Admin+ SQL Injection
Zero Spam for WordPress
≤5.2.10Update to 5.2.11
- Medium6.1Reflected Cross-Site Scripting
Header Footer Code Manager
≤1.1.16Update to 1.1.17
- Medium6.1Reflected Cross-Site Scripting
ARI Stream Quiz – WordPress Quizzes Builder
≤1.2.26Update to 1.2.27
- High7.2Unauthenticated Stored Cross-Site Scripting via platform
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤13.1.5Update to 13.1.6
- Medium6.1User Profile & User Registration Forms <= 3.6.1 - Cross-Site Scripting via site_url Parameter
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.6.1Update to 3.6.2