Database
WordPress Vulnerability Database (page 1263)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3Coming Soon & Maintenance Plugin <= 4.0.18 - Unauthenticated Arbitrary CSS Update
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
<4.0.19Update to 4.0.19
- Medium5.4Missing Authorization to Stored Cross-Site Scripting
PPOM – Product Addons & Custom Fields for WooCommerce
≤23.9Update to 24.0
- Medium6.1Stored Cross-Site Scripting
Form Store to DB
≤1.1.0Update to 1.1.1
- Medium6.1Open Redirect
Noptin – Newsletter, New Post Notifications & Email Automation
<1.6.5Update to 1.6.5
- Medium6.1Cross-Site Scripting
Magee Shortcodes
≤2.0.8Update to 2.0.9
- Medium6.4WHMCS Bridge <= 6.1 Subscriber+ Stored Cross-Site Scripting
WHMCS Bridge
≤6.1Update to 6.3
- Medium4.3Sensitive Information Disclosure
Futurio Extra
<1.6.3Update to 1.6.3
- High7.5Unauthenticated Sensitive Data Disclosure
WP Import Export Lite
≤3.9.15Update to 3.9.16
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Random Banner
≤4.1.4Update to 4.1.5
- Medium5.4Reflected Cross-Site Scripting
Themify Portfolio Post
≤1.1.6Update to 1.1.7
- High8.8SQL Injection
Ad Invalid Click Protector (AICP)
<1.2.6Update to 1.2.6
- High8.8Cross-Site Request Forgery
PHP Everywhere
≤2.0.2Update to 2.0.3
- Medium6.1Cross-Site Scripting
RSVP and Event Management
<2.7.5Update to 2.7.5
- Medium6.1Reflected Cross-Site Scripting
PublishPress Capabilities: User Role Access Control, Admin Area Permissions
≤2.3.2Update to 2.3.3
- Medium6.1Reflected Cross-Site Scripting
SpiderCalendar
≤1.5.65Update to 1.6.65
- Medium6.1Reflected Cross-Site Scripting
NewStatPress
<1.3.6Update to 1.3.6
- High8.8Cross-Site Request Forgery to Arbitrary Options Update
Login & Register Customizer – Forms, Popup, Profile & WooCommerce
≤2.2Update to 2.3
- High8.8Cross-Site Request Forgery to Arbitrary Options Update
Side Cart Woocommerce | Woocommerce Cart
≤2.0Update to 2.1
- High8.8Cross-Site Request Forgery to Arbitrary Options Update
Waitlist Woocommerce ( Back in stock notifier )
≤2.5.1Update to 2.5.2
- Medium4.8Stored Cross-Site Scripting
WP-DownloadManager
<1.68.7Update to 1.68.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Mitsol Social Post Feed
≤1.10Update to 1.11
- Medium6.1Reflected Cross-Site Scripting via lang & pid Parameters
Brevo – Email, SMS, Web Push, Chat, and more.
<3.1.31Update to 3.1.31
- High8.8Cross-Site Request Forgery
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.3.5Update to 7.3.7
- Medium5.4Reflected Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.3.6Update to 7.3.7
- Medium4.8Admin+ Stored Cross-Site Scripting
Remove Footer Credit
≤1.0.10Update to 1.0.11
- High8.8Arbitrary File Upload
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤6.4.0Update to 6.4.1
- Medium6.1PowerPack Lite for Beaver Builder <= 1.2.9.2 Reflected Cross-Site Scripting
PowerPack Lite for Beaver Builder
≤1.2.9.2Update to 1.2.9.3
- Medium6.3Missing Authorization Checks
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
<6.4.1Update to 6.4.1
- Medium5.4Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.3.6Update to 7.3.7
- Medium6.4Missing Authorization to Stored Cross-Site Scripting
Ibtana – WordPress Website Builder
<1.1.4.9Update to 1.1.4.9