Database
WordPress Vulnerability Database (page 1257)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
≤2.10.3Update to 2.10.4
- High7.2Authenticated (Admin+) SQL Injection
Broken Link Manager
≤0.6.5No patch available
- High7.2Authenticated (Admin+) SQL Injection
Timeline Calendar
≤1.2No patch available
- Medium6.1Stored Cross-Site Scripting
Email Subscriber
≤1.1No patch available
- Medium4.9Authenticated (Admin+) Arbitrary File Read
AceIDE
≤2.6.2No patch available
- Medium5.4Reflected Cross-Site Scripting
Project Status
≤1.6No patch available
- High7.2Authenticated (Admin+) SQL Injection
M-vSlider
≤2.1.3No patch available
- High7.2Authenticated (Admin+) SQL Injection
Paytm – Donation Plugin
≤1.3.2No patch available
- Critical9.8Unauthenticated SQL Injection
Edit Comments
≤0.3No patch available
- High7.2Authenticated SQL Injection
Simple Events Calendar
≤1.4.0Update to 1.4.1
- Medium5.8Reflected Cross-Site Scripting
Translate WordPress with GTranslate
<2.8.65Update to 2.8.65
- High7.2Authenticated (Admin+) SQL Injection
WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
≤3.7.2No patch available
- High7.2Authenticated (Admin+) SQL Injection
Easy Testimonial Manager
≤1.2.0No patch available
- Medium6.4Stored Cross-Site Scripting
Simple Post
≤1.1No patch available
- High7.2Authenticated (Admin+) SQL Injection
Comment Highlighter
≤0.13No patch available
- High8.8Authenticated (Admin+) SQL Injection
Cashtomer
≤1.0.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
WordPress Membership SwiftCloud.io
≤1.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
Embed Youtube Video
≤1.0No patch available
- High8.8Authenticated (Subscriber+) SQL Injection
Diary & Availability Calendar
≤1.0.3No patch available
- High8.8Authenticated Local File Inclusion
FOX – Currency Switcher Professional for WooCommerce
≤1.3.7Update to 1.3.7.1
- Medium4.3Authorization Bypass
SendGrid
≤1.11.8No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
≤1.6.50Update to 1.6.51
- High7.1Reflected Cross-Site Scripting
Translate WordPress – Google Language Translator
<6.0.10Update to 6.0.10
- Medium4.8Authenticated Stored Cross-Site Scripting
Maintenance
<4.03Update to 4.03
- Medium5.4Stored Cross-Site Scripting
Grid Gallery – for Photo Gallery, Image Gallery & Portfolio
<1.2.5Update to 1.2.5
- High8.8NewsPlugin <= 1.0.18 – Cross-Site Request Forgery to Stored Cross-Site Scripting
NewsPlugin
≤1.0.18Update to 1.1.0
- High8.8Privilege Escalation via Arbitrary Role Change
HM Multiple Roles
≤1.2Update to 1.3
- Medium5.4Stored Cross-Site Scripting
KN Fix Your Title
≤1.0.1No patch available
- High7.2Authenticated (Admin+) SQL Injection
Giveaway
≤1.2.2No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Social Tape
≤1.0No patch available