Database
WordPress Vulnerability Database (page 1260)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Contributor+ Stored Cross-Site Scripting
Leaflet Map
≤2.23.3Update to 3.0.0
- Medium6.3Missing Authorization
PWA for WP – Progressive Web Apps Made Simple
≤1.7.32Update to 1.7.33
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Leaflet Map
≤2.23.3Update to 3.0.0
- Medium4.8Admin+ Stored Cross-Site Scripting
Maps Plugin using Google Maps for WordPress – WP Google Map
≤1.7.6Update to 1.7.7
- Medium6.1Reflected Cross-Site Scripting
Newspaper Lite
≤10.3.9.1Update to 11.0
- Medium5.5Stored Cross-Site Scripting
PublishPress Taxonomies – Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms
≤3.0.7.1Update to 3.0.7.2
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
≤3.4.7Update to 3.4.8
- High7.2SQL Injection
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
<3.2.1Update to 3.2.1
- Low2.7Server-Side Request Forgery
RSVPMaker
<8.7.3Update to 8.7.4
- High7.2SQL Injection
Quiz Maker by AYS
<6.2.0.9Update to 6.2.0.9
- Medium5.4Stored Cross-Site Scripting
WP Offload SES Lite
≤1.4.4Update to 1.4.5
- High8.8SQL Injection
Popup Like box – Page Plugin
≤3.5.2Update to 3.5.3
- High8.8Blind SQL Injection
Portfolio Responsive Gallery
≤1.1.7Update to 1.1.8
- High7.2Responsive Image Gallery <= 4.4.3 - Authenticated Blind SQL Injections
Photo Gallery by Ays – Responsive Image Gallery
<4.4.4Update to 4.4.4
- High8.1Authorization Bypass
Workreap - Freelance Marketplace and Directory WordPress Theme
<2.2.2Update to 2.2.2
- High8.8SQL Injection
Image Slider by Ays- Responsive Slider and Carousel
<2.5.0Update to 2.5.0
- High7.2SQL Injection
Secure Copy Content Protection and Content Locking
<2.6.7Update to 2.6.7
- High8.8Blind SQL Injection
FAQ Builder AYS
≤1.3.5Update to 1.3.6
- High8.8Authenticated SQL Injection
Handsome Testimonials & Reviews
<2.1.1Update to 2.1.1
- High8.8Authenticated SQL Injection
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
<2.3.4Update to 2.3.4
- High8.8Authenticated SQL Injection
Survey Maker by AYS
<1.5.6Update to 1.5.6
- Critical9.83.1.3 - Arbitrary File Upload
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
3.0.0 – 3.1.3Update to 3.1.4
- Critical9.83.1.3 - Unauthenticated Privilege Escalation
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
3.0.0 – 3.1.3Update to 3.1.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Any Hostname
≤1.0.6No patch available
- Medium4.3Authenticated Insecure Direct Object Reference
User Profile Picture – Custom Local Avatars
<2.6.0Update to 2.6.0
- Medium5.5Authenticated Stored Cross-Site Scripting
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<3.1.8Update to 3.1.8
- Medium6.1Reflected Cross-site Scripting via id Parameter
Awesome Weather Widget
≤3.0.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Post Grid
≤2.1.7Update to 2.1.8
- Critical9.83.1.3 - Unauthenticated Privilege Escalation
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
3.0.0 – 3.1.3Update to 3.1.4
- High7.2SQL Injection
Side Menu Lite – Sticky Floating Side Menu
≤2.1.1Update to 2.2.1