Database
WordPress Vulnerability Database (page 1268)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Responsive, Flat, Simple FAQ <= 1.4.8 - Reflected Cross-Site Scripting
duoFAQ - Responsive, Flat, Simple FAQ
≤1.4.8No patch available
- Medium6.1Reflected Cross-Site Scripting
Real WYSIWYG
≤0.0.2No patch available
- Medium6.1Reflected Cross-Site Scripting
link-list-manager
≤1.0No patch available
- High7.5Sensitive Data Disclosure
The Plus Addons for Elementor Page Builder Pro
<5.0.7Update to 5.0.7
- Medium6.1Reflected Cross-Site Scripting
Out-of-the-Box
<1.20.3Update to 1.20.3
- Medium6.1Reflected Cross-Site Scripting
Parsian Bank Gateway for Woocommerce
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Magic Post Voice
≤1.2No patch available
- Medium6.1Reflected Cross-Site Scripting
H5P CSS Editor
≤1.0No patch available
- Medium4.7Reflected Cross-Site Scripting
WP Cloud Plugins - Box (Lets-Box)
<1.15.3Update to 1.15.3
- Medium6.1Reflected Cross-Site Scripting
FOX – Currency Switcher Professional for WooCommerce
≤1.3.7.2Update to 1.3.7.3
- Medium6.1.htaccess Redirect <= 0.3.1 Reflected Cross-Site Scripting
.htaccess Redirect
≤0.3.1No patch available
- Medium6.1WooCommerce EnvioPack <= 1.2 Reflected Cross-Site Scripting
WooCommerce EnvioPack
≤1.2No patch available
- Critical9.8Pro <= 5.0.6 - SQL Injection
The Plus Addons for Elementor Page Builder Pro
<5.0.7Update to 5.0.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
AMP for WP – Accelerated Mobile Pages
≤1.0.77.31Update to 1.0.77.32
- Medium6.1Reflected Cross-Site Scripting
WP Booking System – Booking Calendar
<2.0.15Update to 2.0.15
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
tarteaucitron.io – Cookie Banner & GDPR Consent Management
≤1.5.4Update to 1.6
- Medium6.5Arbitrary Post Deletion via Cross-Site Request Forgery
Accept Donations with PayPal & Stripe
≤1.3.3Update to 1.3.4
- Medium4.8Stored Cross-Site Scripting
Fathom Analytics for WP
≤3.0.4Update to 3.0.5
- Medium5.4Missing Authorization
Maps Plugin using Google Maps for WordPress – WP Google Map
≤1.8.0Update to 1.8.1
- Medium5.7Subscriber+ Arbitrary Post Deletion and Plugin Settings Update
Maps Plugin using Google Maps for WordPress – WP Google Map
≤1.8.0Update to 1.8.1
- Critical9.8Unauthenticated Arbitrary Options Update
PublishPress Capabilities: User Role Access Control, Admin Area Permissions
<2.3.1Update to 2.3.1
- Critical9.8Authentication Bypass
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤5.0.1.7Update to 5.0.1.8
- Medium6.1Reflected Cross-Site Scripting
10WebSocial
≤1.4.28Update to 1.4.29
- Medium6.1Reflected Cross-Site Scripting
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
<3.8.4Update to 3.8.4
- Medium6.1Reflected Cross-Site Scripting
Booking Calendar
≤8.9.1Update to 8.9.2
- Medium6.1Reflected Cross-Site Scripting
UpdraftPlus Premium
<1.16.66Update to 1.16.66
- Medium6.1Reflected Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤2.6.1Update to 2.6.2
- High7.5Denial of Service
Stars Rating
<3.5.1Update to 3.5.1
- Medium6.1Reflected Cross-Site Scripting
Use-your-Drive | Google Drive plugin for WordPress
<1.18.3Update to 1.18.3
- Medium4.7Reflected Cross-Site Scripting
Share-one-Drive | OneDrive & SharePoint plugin for WordPress
<1.15.3Update to 1.15.3