Database
WordPress Vulnerability Database (page 1265)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Directory & Listing - < 1.6.0 - Cross-Site Scripting
Bello - Directory & Listing
<1.6.0Update to 1.6.0
- High7.2Authenticated Remote Code Execution
WP Super Cache
<1.7.3Update to 1.7.3
- High7.2Authenticated SQL Injection
Tradetracker-Store
<4.6.60Update to 4.6.60
- High8.8Authenticated Arbitrary File Upload
External Media
<1.0.34Update to 1.0.34
- High7.2SQL Injection
Hotscot Contact Form
<1.3Update to 1.3
- Medium4.8Authenticated Stored Cross-Site Scripting via Gallery Title
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.67Update to 1.5.67
- Medium6.1Stored Cross-Site Scripting
Weekly Schedule
<3.4.3Update to 3.4.3
- Medium5.4Stored Cross-Site Scripting
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
<4.21.1Update to 4.21.1
- Medium4.8Stored Cross-Site Scripting
UpdraftPlus Premium
<1.6.59Update to 1.6.59
- High7.2Stored Cross-Site Scripting
ReDi Restaurant Reservation – Instant Restaurant Booking & Table Reservation System
≤21.0307Update to 21.0426
- Medium6.1Reflected Cross-Site Scripting
Simple Giveaways – Grow your business, email lists and traffic with contests
<2.36.1Update to 2.36.2
- High8.8Authenticated Code Injection
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
<4.1.0.2Update to 4.1.0.2
- High7.3Missing Authorization
Product Filter for WooCommerce by WBW
≤1.4.9Update to 1.5.0
- Medium6.1Unauthenticated Stored Cross-Site Scripting
DSGVO All in one for WP
≤3.9Update to 4.0
- Medium5.5Stored Cross-Site Scripting
Autoptimize
<2.8.4Update to 2.8.4
- Medium6.1Reflected Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.1.20Update to 2.1.20
- Medium6.1Reflected Cross-Site Scripting
Product Slider, Product Grid, Product Masonry
≤1.13.21Update to 1.13.22
- Medium6.4Authenticated Stored Cross-Site Scripting
Hana Flv Player
≤3.1.3No patch available
- Medium6.3Missing Authorization
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤4.6.4Update to 4.6.5
- High8.8Authenticated (Contributor+) Privilege Escalation
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤4.6.4Update to 4.6.5
- Medium6.1Stored Cross-Site Scripting
Watcheezy Live chat plugin for WordPress
≤2.0Update to 3.0
- Medium6.1Tour & Travel WordPress Theme < 2.1 - Reflected Cross-Site Scripting
Goto - Tour & Travel WordPress Theme
<2.1Update to 2.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Hotjar Connecticator
≤1.1.1No patch available
- Medium4.8Authenticated Stored Cross-Site Scripting
WP Customer Reviews
≤3.5.5Update to 3.5.6
- Low3.8Authenticated (Admin+) Cross-Site Scripting
WP YouTube Lyte
<1.7.16Update to 1.7.16
- Medium4.8Authenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.10.4Update to 2.10.4
- Critical10.0Remote Code Execution
Social Sharing Plugin – Social Warfare
<3.5.3Update to 3.5.3
- Medium6.1Open Redirect
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
<7.5.0Update to 7.5.0
- Medium6.5Authenticated (Admin+) Directory Traversal to Arbitrary File Deletion
WP Fastest Cache – WordPress Cache Plugin
<0.9.1.7Update to 0.9.1.7
- Medium5.3Denial of Service
WPGraphQL
≤1.3.5Update to 1.3.6