Database
WordPress Vulnerability Database (page 1260)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Advanced iFrame <= 2021.9 Reflected Cross-Site Scripting
Advanced iFrame
≤2021.9Update to 2022
- High7.5Sensitive Information Disclosure
Download Manager
<3.2.35Update to 3.2.35
- Medium4.3Authenticated Arbitrary File Access / Local File Inclusion
Custom Content Shortcode
≤4.0.1Update to 4.0.2
- Medium5.4Authenticated Stored Cross-Site Scripting
Custom Content Shortcode
≤4.0.1Update to 4.0.2
- Medium5.5Stored Cross-Site Scripting
WP Time Slots Booking Form
≤1.1.62Update to 1.1.63
- Medium4.3Unauthorised Arbitrary Post Metadata Access
Custom Content Shortcode
≤3.8.8Update to 4.0.1
- Critical9.8Blind SQL Injection
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
≤2.3.8Update to 2.3.9
- Medium6.4Authenticated Stored Cross-Site Scripting via License ID settings
CP Blocks
<1.0.15Update to 1.0.15
- Critical9.8Unauthenticated SQL Injection
Page View Count
<2.4.15Update to 2.4.15
- Medium6.5Arbitrary Post Removal via Cross-Site Request Forgery
Pricing Table WordPress Plugin – Easy Pricing Tables
≤3.1.2Update to 3.1.3
- Medium6.3Arbitrary Settings Change
Lead Form Builder & Contact Form
<1.7.4Update to 1.7.4
- High7.5Authenticated Local File Inclusion
Cost Calculator
≤1.8No patch available
- Critical9.8Unauthenticated Admin Account Creation
MasterStudy LMS WordPress Plugin – for Online Courses and Education
≤2.7.5Update to 2.7.6
- High8.8Google Analytics and Google Shopping plugin for WooCommerce <= 4.6.1 Authenticated SQL Injection
Conversios – GA4, Google Ads & Meta Conversion Tracking with Product Feed for WooCommerce
<4.6.2Update to 4.6.2
- Medium6.1Reflected Cross-Site Scripting
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce
<11.2.3Update to 11.2.3
- Medium6.4Contributor+ Stored Cross-Site Scripting
Cost Calculator
≤1.5Update to 1.6
- Critical9.6Cross-Site Request Forgery to Stored Cross-Site Scripting
Post Snippets – Custom WordPress Code Snippets Customizer
≤3.1.3Update to 3.1.4
- Medium4.3Cross-Site Request Forgery
Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid
<2.0.1Update to 2.0.1
- Medium6.1Reflected Cross-Site Scripting
WP User – Custom Registration Forms, Login and User Profile
<7.0Update to 7.0
- Critical9.1Arbitrary IP Address Blocking via IP Spoofing
Blackhole for Bad Bots
<3.3.2Update to 3.3.2
- High8.8SQL Injection
Asgaros Forum
<2.0.0Update to 2.0.0
- Medium6.1Unauthenticated Stored Cross-Site Scripting
WPvivid — Backup, Migration & Staging
<0.9.69Update to 0.9.69
- Medium6.1Reflected Cross-Site Scripting
Fotobook
≤3.2.3No patch available
- High7.2Stored Cross-Site Scripting
WS Form LITE – Drag & Drop Contact Form Builder
<1.8.176Update to 1.8.176
- High8.8SQL Injection
WP Email Users
≤1.7.6No patch available
- Medium4.8Stored Cross-Site Scripting
WS Form LITE – Drag & Drop Contact Form Builder
<1.8.176Update to 1.8.176
- Medium6.1Unauthenticated Arbitrary CSS Appending
Use Any Font | Custom Font Uploader
<6.2.1Update to 6.2.1
- High7.2SQL Injection
WP Review Slider
<11.0Update to 11.0
- Medium4.3Email Address Disclosure
Customize WordPress Emails and Alerts – Better Notifications for WP
<1.8.7Update to 1.8.7
- Critical9.8Unauthenticated SQL Injection
TI WooCommerce Wishlist
<1.40.1Update to 1.40.1