Database
WordPress Vulnerability Database (page 1258)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Contact Form 7 Connector
≤1.1.13Update to 1.1.14
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Sync QCloud COS
<2.0.1Update to 2.0.1
- Medium6.1User Profile & User Registration Forms <= 3.6.1 - Cross-Site Scripting via site_url Parameter
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.6.1Update to 3.6.2
- Medium6.1Reflected Cross-Site Scripting
ARI Stream Quiz – WordPress Quizzes Builder
≤1.2.26Update to 1.2.27
- High7.2Unauthenticated Stored Cross-Site Scripting via platform
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤13.1.5Update to 13.1.6
- Medium5.4Unauthenticated Stored Cross-Site Scripting
Simple Ajax Chat – Add a Fast, Secure Chat Box
≤20220115Update to 20220216
- Medium4.3Cross-Site Request Forgery to Setting Update
WP Content Copy Protection
≤3.4.4Update to 3.4.5
- High7.2Unauthenticated Stored Cross-Site Scripting via browser
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤13.1.5Update to 13.1.6
- Medium6.1Cross-Site Request Forgery
Simple Quotation
≤1.3.2No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Better WordPress Google XML Sitemaps (support Sitemap Index, Multi-site and Google News)
≤1.4.1No patch available
- High8.8Missing Authorization to Arbitrary Options Update
Easy Embed for HubSpot Forms, CTAs, Links, Files & add HubSpot to WP Search Results
≤1.1.0No patch available
- Medium6.5Unauthenticated Remote Plugin Deletion
OTP Login With Phone Number, OTP Verification
<1.3.7Update to 1.3.7
- Critical9.8Unauthenticated Blind SQL Injection via current_page_type
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤13.1.5Update to 13.1.6
- Medium6.1Guest Submit < 4.20 - Reflected Cross-Site Scripting
Flexi – Guest Submit
<4.20Update to 4.20
- High8.8Open Redirect
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.9.6No patch available
- High8.8SQL injection
Simple Quotation
≤1.3.2No patch available
- Critical9.8Unauthenticated SQL Injection
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤13.1.5Update to 13.1.6
- Medium6.1Reflected Cross-Site Scripting
WP Voting Contest Lite
<3.0Update to 3.0
- Critical9.8Unauthenticated Blind SQL Injection via IP
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤13.1.5Update to 13.1.6
- High7.2Unauthenticated Stored Cross-Site Scripting via IP
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤13.1.5Update to 13.1.6
- Medium6.1Reflected Cross-Site Scripting
Advanced Product Labels for WooCommerce
<1.2.3.7Update to 1.2.3.7
- Critical9.8Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.6.0Update to 1.6.0
- Medium6.1Reflected Cross-Site Scripting
ووکامرس فارسی | فارسی و شمسی ساز وردپرس و ووکامرس
≤5.8.0Update to 5.9.8
- Medium6.3Missing Authorization
Relevanssi Premium
<2.16.5Update to 2.16.5
- Medium6.5Missing Authorization to Sensitive Information Disclosure
Smart Forms – when you need more than just a contact form
<2.6.71Update to 2.6.71
- Medium5.4Authenticated Stored Cross-Site Scripting via Shortcode
Iptanus File Upload
<4.16.3Update to 4.16.3
- Medium4.3E-mail Address Disclosure
Video Conferencing with Zoom
<3.8.17Update to 3.8.17
- Medium6.4Author+ Stored Cross-Site Scripting
YOP Poll
≤6.3.4Update to 6.3.5
- High8.8SQL Injection
WP Visitor Statistics (Real Time Traffic)
<5.6Update to 5.6
- Medium6.1Reflected Cross-Site Scripting via redirect-page Parameter
LoginPress | wp-login Custom Login Page Customizer
<1.5.12Update to 1.5.12