Database
WordPress Vulnerability Database (page 1264)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8SQL Injection
Xllentech English Islamic Calendar
≤2.6.7Update to 2.6.8
- Medium6.6Authenticated (Admin+) SQL Injection
Sendit WP Newsletter
≤2.5.1No patch available
- Medium5.5Authenticated Stored Cross-Site Scripting via extra_data Parameter
WP Reset
≤1.86Update to 1.90
- Medium4.32.0.3 - Authenticated Wildcard Activation and Retrieval
Simple 301 Redirects by BetterLinks – Easy Redirect Manager
2.0.0 – 2.0.3Update to 2.0.4
- High8.82.0.3 - Unauthenticated Redirect Export
Simple 301 Redirects by BetterLinks – Easy Redirect Manager
2.0.0 – 2.0.3Update to 2.0.4
- High8.82.0.3 - Authenticated Arbitrary Plugin Installation
Simple 301 Redirects by BetterLinks – Easy Redirect Manager
2.0.0 – 2.0.3Update to 2.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Visitors
≤0.3No patch available
- High8.82.0.3 - Authenticated Arbitrary Plugin Activation
Simple 301 Redirects by BetterLinks – Easy Redirect Manager
2.0.0 – 2.0.3Update to 2.0.4
- Medium6.1Reflected Cross-Site Scripting
Gallery from files
≤1.60No patch available
- High8.82.0.3 - Unauthenticated Redirect Import
Simple 301 Redirects by BetterLinks – Easy Redirect Manager
2.0.0 – 2.0.3Update to 2.0.4
- High8.8Authenticated Shell Upload
SP Project & Document Manager
<4.22Update to 4.22
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Easy Preloader
≤1.0.0No patch available
- Medium6.1WordPress Newspaper Magazine Blog AMP Theme < 8.0.6 - Reflected Cross-Site Scripting
JNews - WordPress Newspaper Magazine Blog AMP Theme
<8.0.6Update to 8.0.6
- Medium4.8Admin+ Stored Cross-Site Scripting
iFlyChat – WordPress Chat
<4.7.0Update to 4.7.0
- Medium6.1Cross-Site Scripting
WP Learn Manager
≤1.1.5Update to 1.1.6
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Cookie Law Bar
≤1.2.1No patch available
- High7.2Authenticated (Editor+) SQL Injection
FlightLog
≤3.0.2No patch available
- High8.8Authenticated (Subscriber+) SQL Injection
Video Embed
≤1.0No patch available
- High7.5Unauthenticated SQL Injection
WP Statistics – Simple, privacy-friendly Google Analytics alternative
<13.0.8Update to 13.0.8
- Medium6.4Stored Cross-Site Scripting
JobSearch WP Job Board
<1.7.4Update to 1.7.4
- Medium4.8Authenticated Stored Cross-Site scripting via FB Pixel ID and Google Analytics ID
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
<1.6.13Update to 1.6.13
- Medium6.4Authenticated Stored Cross-Site Scripting
Instant Images – One-click Image Uploads from Unsplash, Openverse, Pixabay, Pexels, and Giphy
≤4.4.0Update to 4.4.0.1
- High7.5Insecure Direct Object Reference
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
<4.21.2Update to 4.21.2
- Medium6.1Reflected Cross-Site Scripting
Car Repair Services & Auto Mechanic WordPress Theme + RTL
<4.0Update to 4.0
- Medium5.5Stored Cross-Site Scripting
Related Posts for WordPress
≤2.0.4Update to 2.0.5
- Medium6.4Authenticated Stored Cross-Site Scripting
WP Prayer
<1.6.2Update to 1.6.2
- Critical9.8Directory & Listing <= 1.5.9 - Unauthenticated SQL Injection
Bello - Directory & Listing
<1.6.0Update to 1.6.0
- Medium5.4Authenticated Stored Cross-Site Scripting via backup_receipient Parameter
Database Backup for WordPress
<2.4Update to 2.4
- Medium6.1Reflected Cross-Site Scripting
Mediumish
≤1.0.60No patch available
- Medium6.5Directory & Listings With Booking - WordPress Theme < 1.6.11 - Insecure Direct Object Reference
Listeo - Directory & Listings With Booking - WordPress Theme
<1.6.11Update to 1.6.11