Database
WordPress Vulnerability Database (page 1266)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.8Reflected Cross-Site Scripting
WP-DownloadManager
≤1.68.6Update to 1.68.7
- Medium5.4Reflected Cross-Site Scripting via domain
Domain Check
≤1.0.16Update to 1.0.17
- Medium5.4Authenticated PHP Object Injection & Stored Cross-Site Scripting
Insight Core
≤1.0No patch available
- Medium6.5Missing Authorization
LabTools
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting via updraft_restore
UpdraftPlus Premium
0.7.4 – 1.16.68Update to 1.16.69
- Medium6.1Reflected Cross-Site Scripting
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤5.0.1.8Update to 5.0.1.9
- Medium5.4Reflected Cross-Site Scripting
Dynamic Widgets
≤1.5.16Update to 1.6
- Medium6.1Products Filter for WooCommerce <= 1.2.6.2 - Reflected Cross-Site Scripting
HUSKY – Products Filter for WooCommerce Professional. MCP is onboard
<1.2.6.3Update to 1.2.6.3
- High7.2SQL Injection
Cookie Notification Plugin for WordPress – WP Cookie User Info
<1.0.9Update to 1.0.9
- Medium5.4Cross-Site Request Forgery
AF Companion – AI SEO, GEO, Alt Text, Performance & Site Health
1.1.0 – <1.1.2Update to 1.2.0
- Medium6.1Reflected Cross-Site Scripting
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤2.3.2Update to 2.4
- Medium6.1Reflected Cross-Site Scripting
Code Snippets
<2.14.3Update to 2.14.3
- High7.2Stored Cross-Site Scripting
Tutor LMS – eLearning and online course solution
≤1.9.11Update to 1.9.12
- Medium5.7Missing Authorization to Arbitrary FAQ Creation
Ultimate FAQ Accordion Plugin
<2.1.2Update to 2.1.2
- Medium4.3Missing Authorization to Post Disclosure
WP Post Page Clone
≤1.1Update to 1.2
- Medium6.1Reflected Cross-Site Scripting
Trakoo – Orders Tracking for WooCommerce
≤1.0.14Update to 1.1.10
- High8.8SQL Injection & Reflected Cross-Site Scripting
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
≤3.5.25Update to 3.5.26
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Extra File Types
≤0.5Update to 0.5.1
- Medium6.1Reflected Cross-Site Scripting
Tutor LMS – eLearning and online course solution
≤1.9.11Update to 1.9.12
- Medium5.4Missing Authorization to Arbitrary Post Deletion
Qubely – Advanced Gutenberg Blocks
<1.7.8Update to 1.7.8
- Medium6.1Reflected Cross-Site Scripting
Registrations for the Events Calendar – Event Registration Plugin
<2.7.10Update to 2.7.10
- Medium6.1Unauthenticated Open Redirect
Converter for Media – Optimize images | Convert WebP & AVIF
<4.0.3Update to 4.0.3
- Medium6.1Reflected Cross-Site Scripting via effects
Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )
≤9.7.0Update to 9.7.1
- High8.8Cross-Site Request Forgery
WPGSI: Spreadsheet Integration
≤3.5.0Update to 3.6.0
- Medium5.5Cross-Site Scripting
Mobile Events Manager
<1.4.4Update to 1.4.4
- High7.2Unauthenticated Stored Cross-Site Scripting
Affiliates Manager
≤2.8.9Update to 2.9.0
- Medium6.1Reflected Cross-Site Scripting
WPGSI: Spreadsheet Integration
≤3.5.0Update to 3.6.0
- High7.2Admin+ SQL Injection
Advanced Custom Fields: Extended
≤0.8.8.6Update to 0.8.8.7
- Medium5.4Settings Update to Stored Cross-Site Scripting
Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce
<11.0.7Update to 11.0.7
- Medium6.1Reflected Cross-Site Scripting
Brevo – Email, SMS, Web Push, Chat, and more.
<3.1.25Update to 3.1.25