Database
WordPress Vulnerability Database (page 1259)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8SQL Injection
WP Visitor Statistics (Real Time Traffic)
<5.6Update to 5.6
- Medium6.4Author+ Stored Cross-Site Scripting
YOP Poll
≤6.3.4Update to 6.3.5
- Medium4.3E-mail Address Disclosure
Video Conferencing with Zoom
<3.8.17Update to 3.8.17
- Medium4.3Subscriber+ User Avatar Override
UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP
<1.2.3.1Update to 1.2.3.1
- Medium6.1Reflected Cross-Site Scripting
Travel Booking
<1.2.3Update to 1.2.3
- High8.8Authenticated (or Cross-Site Request Forgery) Blind SQL Injection
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
<5.3.2Update to 5.3.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Social Media Feather
≤2.0.4Update to 2.0.5
- Medium6.3Edit/Delete event via IDOR
Spiffy Calendar
≤4.9.0Update to 4.9.1
- Low3.7wpDiscuz <= 7.3.11 Sensitive Information Disclosure
Comments – wpDiscuz
≤7.3.11Update to 7.3.12
- Medium5.4Event deletion via Cross-Site Request Forgery
Spiffy Calendar
≤4.9.0Update to 4.9.1
- Critical9.8Unauthenticated Blind SQL Injection
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤13.1.4Update to 13.1.5
- Medium6.1Reflected Cross-Site Scripting
Ditty – Responsive News Tickers, Sliders, and Lists
<3.0.15Update to 3.0.15
- Medium4.8Stored Cross-Site Scripting
E2Pdf – Export Pdf Tool for WordPress
≤1.16.44Update to 1.16.45
- High7.2Admin+ SQL Injection
Fancy Product Designer
≤4.7.4Update to 4.7.5
- Medium6.1Reflected Cross-Site Scripting
Anti-Malware Security and Brute-Force Firewall
≤4.21.74Update to 4.21.83
- Medium6.4Authenticated Stored Cross-Site Scripting
IP2Location Country Blocker
<2.26.9Update to 2.26.9
- Medium6.5Cross-Site Request Forgery
Real Cookie Banner: GDPR & ePrivacy Cookie Consent
<2.14.2Update to 2.14.2
- Medium6.1Reflected Cross-Site Scripting
White Label CMS
<2.2.9Update to 2.2.9
- High7.2Authenticated (Admin+) Arbitrary File Upload
Catch Themes Demo Import
<2.1.1Update to 2.1.1
- High7.2Authenticated (Admin+) Arbitrary File Upload
All-in-One WP Migration and Backup
≤7.40Update to 7.41
- High7.2SQL Injection
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
<5.0.2.2Update to 5.0.2.2
- Medium6.1WordPress Multisite User Sync/Unsync (Premium) <= 2.1.1 Reflected Cross-Site Scripting
WordPress Multisite User Sync/Unsync (Premium)
≤2.1.1Update to 2.1.2
- Medium6.1Reflected Cross-Site Scripting
PublishPress Taxonomies – Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms
≤3.4.4Update to 3.4.5
- Medium6.1Reflected Cross-Site Scripting
WP Multisite Content Copier/Updater
≤1.4.0Update to 1.5.0
- High7.2Admin+ SQL Injection
AdRotate Banner Manager
≤5.8.17Update to 5.8.22
- High8.8Cross-Site Request Forgery
Connect Matomo – Analytics Dashboard for WordPress
<1.0.27Update to 1.0.27
- High7.7Local File Inclusion
Simple Job Board
≤2.9.3Update to 2.9.4
- Medium4.7Cross-Site Scripting via source
YASR – Yet Another Star Rating Plugin for WordPress
≤2.9.9Update to 3.0.0
- Medium6.1Reflected Cross-Site Scripting
easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution
<1.4.8Update to 1.4.8
- High7.2Authenticated (Admin+) Remote Code Execution
Ad Inserter – Ad Manager & AdSense Ads
<2.7.11Update to 2.7.11