Database
WordPress Vulnerability Database (page 1265)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Subscriber+ Arbitrary Events/Schedules Creation/Deletion
Advanced Cron Manager – debug & control
<2.4.2Update to 2.4.2
- Medium6.5Cross-Site Request Forgery to Arbitrary Ticket Deletion
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
<2.2.7Update to 2.2.7
- Medium6.4Stored Cross-Site Scripting via Shortcode
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
<2.2.7Update to 2.2.7
- Medium6.1Reflected Cross-Site Scripting
Amazon Affiliate
≤3.17Update to 3.17.1
- High7.2Authenticated (Admin+) SQL Injection
Futurio Extra
<1.6.3Update to 1.6.3
- Critical9.9Remote Code Execution by Contributor+ users via gutenberg block
PHP Everywhere
≤2.0.3Update to 3.0.0
- Critical9.9Authenticated (Contributor+) Remote Code Execution via Metabox
PHP Everywhere
≤2.0.3Update to 3.0.0
- Critical9.9Remote Code Execution by Subscriber+ users via shortcode
PHP Everywhere
≤2.0.3Update to 3.0.0
- Medium6.1Reflected Cross-Site Scripting
Asset CleanUp: Page Speed Booster
≤1.3.8.4Update to 1.3.8.5
- Medium6.3Authenticated (Subscriber+) Arbitrary Blog Option Update
TrustMate.io – WooCommerce integration
≤1.8.11Update to 1.8.12
- Medium6.3Authenticated (Subscriber+) Arbitrary Settings Update
TrustMate.io – WooCommerce integration
≤1.8.11Update to 1.8.12
- Medium6.1Reflected Cross-Site Scripting
CF7 Skins for Contact Form 7
≤2.5.0Update to 2.5.1
- Medium5.5SVG Support <= 2.3.19 Admin+ Cross-Site Scripting
SVG Support
≤2.3.19Update to 2.3.20
- Medium6.5Arbitrary Post Deletion via Cross-Site Request Forgery
NextScripts: Social Networks Auto-Poster
<4.3.25Update to 4.3.25
- Medium5.3Sensitive Data Exposure
Document Embedder – let visitors read files without downloading
<1.7.5Update to 1.7.6
- Medium6.1Reflected Cross-Site Scripting via wyp_page_type parameter
Visual CSS Style Editor
≤7.5.3Update to 7.5.4
- Medium6.1Unauthenticated Stored Cross-Site Scripting
NextScripts: Social Networks Auto-Poster
<4.3.24Update to 4.3.24
- Medium4.3Subscriber+ Arbitrary Private/Draft Post Title Disclosure
Document Embedder – let visitors read files without downloading
<1.7.9Update to 1.7.9
- Medium6.1Reflected Cross-Site Scripting via AJAX Action
Asset CleanUp: Page Speed Booster
<1.3.8.5Update to 1.3.8.5
- High8.8Local File Inclusion leading to Authenticated Remote Code Execution
Include Me
≤1.2.1Update to 1.2.2
- High7.2Stored Cross-Site Scripting
WP Photo Album Plus
<8.0.10Update to 8.1.00
- Medium4.3Cross-Site Request Forgery to Library Settings Reset
Link Library
≤7.2.7Update to 7.2.8
- High8.8Subscriber+ SQL Injection
Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types
≤2.18.9Update to 2.18.10
- Medium4.8Admin+ Stored Cross-Site Scripting
AGCA – Custom Dashboard & Login Page
≤6.9.5Update to 7.0
- Medium6.1Reflected Cross-Site Scripting
Link Library
≤7.2.8Update to 7.2.9
- Medium5.3Missing Authorization Checks
Link Library
≤7.2.7Update to 7.2.8
- High8.8Cross-Site Request Forgery
Orange Form
≤1.0.1No patch available
- High8.8Cross-Site Request Forgery
Error Log Viewer by BestWebSoft
≤1.1.1Update to 1.1.2
- High8.8Cross-Site Request Forgery
Orange Form
≤1.0.1No patch available
- Medium5.5Authenticated Cross-Site Scripting
Learning Courses
<5.0Update to 5.0