Database
WordPress Vulnerability Database (page 1267)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Brevo – Email, SMS, Web Push, Chat, and more.
<3.1.25Update to 3.1.25
- High8.8Cross-Site Request Forgery to Arbitrary Ad Deletion
WP125
≤1.5.4Update to 1.5.5
- Medium6.1Open Redirect
Event Tickets and Registration
≤5.2.1Update to 5.2.2
- High8.8SQL Injection
WP Visitor Statistics (Real Time Traffic)
<4.8Update to 4.8
- Medium6.1Reflected Cross-Site Scripting
Smart SEO Tool – SEO优化插件
<3.0.6Update to 3.0.6
- High8.8Multiple Cross-Site Request Forgery vulnerabilities
Simple Download Monitor
≤3.9.8Update to 3.9.9
- Medium5.4Contributor+ Stored Cross-Site Scripting via Shortcodes
Simple Download Monitor
≤3.9.10Update to 3.9.11
- Medium6.1Reflected Cross-Site Scripting
Easy Forms for Mailchimp
<6.8.6Update to 6.8.6
- High7.2Admin+ SQL Injection via forum_id
Asgaros Forum
≤1.15.14Update to 1.15.15
- Medium6.1Reflected Cross-Site Scripting
Backup and Staging by WP Time Capsule
≤1.22.6Update to 1.22.7
- Medium6.4Subscriber+ Stored Cross-Site Scripting
Five Star Restaurant Reservations – WordPress Booking Plugin
≤2.4.7Update to 2.4.8
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤13.1.0.9Update to 14.0.0
- Medium5.4Open Redirect via redirect parameter
AnyComment
<0.3.5Update to 0.3.5
- Medium4.3Subscriber+ Event Creation
Event Calendar WD version
≤1.1.50Update to 1.1.51
- Medium4.8Cross-Site Scripting
SEUR Oficial
<1.7.0Update to 1.7.0
- Critical9.8Unauthenticated Arbitrary Option Update
Tabs – Responsive Tabs with WooCommerce Product Tab Extension
<3.6.0Update to 3.6.0
- Medium6.1Reflected Cross-Site Scripting
ACF Photo Gallery Field
≤1.7.4Update to 1.7.5
- Medium6.1Reflected Cross-Site Scripting
Event Calendar WD version
≤1.1.50Update to 1.1.51
- Low3.4Cross-Site Scripting
tarteaucitron.io – Cookie Banner & GDPR Consent Management
≤1.6Update to 1.6.1
- Medium6.1Reflected Cross-Site Scripting
Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages
≤1.4.9.5Update to 1.4.9.6
- Medium5.4Reflected Cross-Site Scripting
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
<4.1.1Update to 4.1.1
- High8.8Crisp Live Chat <= 0.31 Cross-Site Request Forgery to Stored Cross-Site Scripting
Crisp – Live Chat and AI Chatbot
≤0.31Update to 0.32
- Critical9.8Unauthenticated Arbitrary Options Update
Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier )
≤9.6.1Update to 9.6.2
- Medium5.5Authenticated Stored Cross-Site Scripting
AMP for WP – Accelerated Mobile Pages
≤1.0.77.32Update to 1.0.77.33
- High8.8Contributor+ SQL Injection
Post Grid
<2.1.13Update to 2.1.13
- Critical9.64.1.5.2 - Authenticated SQL Injection
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
4.1.3.1 – 4.1.5.2Update to 4.1.5.3
- High8.84.1.5.2 Authorization Bypass
All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
4.0.0 – 4.1.5.2Update to 4.1.5.3
- Medium6.1WooCommerce myghpay Payment Gateway <= 3.0 Reflected Cross-Site Scripting
myghpay WooCommerce Payment Gateway
≤3.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Simple Image Gallery
≤1.0.6No patch available
- High7.5Directory Traversal/Arbitrary File Read
TrueRanker
≤2.2.2Update to 2.2.4