Database
WordPress Vulnerability Database (page 1258)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
My Site Audit
≤1.2.4Update to 1.2.5
- High8.8SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.2.6.7Update to 3.2.6.8
- Medium6.4Contributor+ Stored Cross-Site Scripting
Wonder PDF Embed
≤1.6Update to 1.7
- Medium6.4Contributor+ Stored Cross-Site Scripting
Embeds for YouTube
≤5.2.1Update to 5.2.2
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Mimetic Books
≤0.2.13No patch available
- Critical9.8Admin Access via Password Reset
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<3.4.9Update to 3.4.9
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
తెలుగు బైబిల్ వచనములు
≤1.0No patch available
- Medium4.3NEX-Forms <= 7.8.7 Authorization Bypass
NEX-Forms – Ultimate Forms Plugin for WordPress
≤7.8.7Update to 7.8.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
VikRentCar Car Rental Management System
<1.1.10Update to 1.1.10
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Custom Login Redirect
≤1.0.0No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Verse-O-Matic
≤4.1.1No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Wonder Video Embed
≤1.7Update to 1.8
- Medium6.4Cross-Site Scripting
PhoneTrack Meu Site Manager
≤0.1Update to 0.1.1
- Medium4.3Cross-Site Request Forgery
Shantz WordPress QOTD
≤1.2.2No patch available
- Medium6.1Authenticated (Admin+) Cross-Site Scripting
Light Messages
≤1.0No patch available
- Medium4.9File Upload Path Traversal
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.75Update to 1.5.75
- Medium6.1Stored Cross-Site Scripting via Uploaded SVG
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.75Update to 1.5.75
- Medium4.3Cross-Site Request Forgery Bypass
WordPress Photo Gallery – Image Gallery
≤1.0.6No patch available
- Medium5.4Authenticated Stored Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.13.59Update to 1.13.60
- High8.8Cross-Site Request Forgery
MDTF – Meta Data and Taxonomies Filter
<2.2.8Update to 2.2.8
- Medium6.1Cross-Site Scripting
Webcam Microphone Screen Recorder – Media Capture
<3.2.4Update to 3.2.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.14.12Update to 1.14.12
- Medium6.4Authenticated Stored Cross-Site Scripting
Current Book
≤1.0.1No patch available
- High8.8Authenticated Blind SQL Injection
WooCommerce
≤5.5Update to 3.3.6 or 3.4.8 or 3.5.9 or 3.6.6 or 3.7.2 or 3.8.2 or 3.9.4 or 4.0.2 or 4.1.2 or 4.2.3 or 4.3.4 or 4.4.2 or 4.5.3 or 4.6.3 or 4.7.2 or 4.8.1 or 4.9.3 or 5.0.1 or 5.1.1 or 5.2.3 or 5.3.1 or 5.4.2 or 5.5.1 or 5.5.2
- Medium6.4Privilege Escalation
Frontend File Manager Plugin
<18.3Update to 18.3
- High7.2Unauthenticated HTML Injection leading to Spam Emails
Frontend File Manager Plugin
<18.3Update to 18.3
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Remove Footer Credit
≤1.0.5Update to 1.0.6
- Medium5.8Unauthenticated Post Meta Change
Frontend File Manager Plugin
<18.3Update to 18.3
- Critical9.0Unauthenticated Arbitrary File Download
Frontend File Manager Plugin
<18.3Update to 18.3
- Medium6.5Unauthenticated Arbitrary Post Deletion
Frontend File Manager Plugin
<18.3Update to 18.3