Database
WordPress Vulnerability Database (page 1271)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting via message_id
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
<2.0.5Update to 2.0.5
- Critical9.8WooCommerce Multivendor Marketplace <= 3.4.11 - Unauthenticated SQL Injection
WCFM Marketplace – Multivendor Marketplace for WooCommerce
≤3.4.11Update to 3.4.12
- Medium5.4Contributor+ Stored Cross-Site Scripting
Logo Carousel – Responsive Logo Slider, Logo Showcase, and Clients Logo Gallery
≤3.4.1Update to 3.4.2
- High7.2SQL Injection
ExportFeed: List WooCommerce Products on eBay Store
≤2.0.1.0No patch available
- Medium6.5Information Disclosure
WP Guppy
<1.3Update to 1.3
- High7.1Reflected Cross-Site Scripting
Simple Slider
<1.1Update to 1.1
- High7.2File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting
Ninja Forms - File Uploads
≤3.3.12Update to 3.3.13
- Medium5.4Child Theme Generator <= 2.2.7 Cross-Site Request Forgery to Arbitrary Folder Deletion
Child Theme Generator
≤2.2.7No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Easy Registration Forms
≤2.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Preview E-mails for WooCommerce
≤1.6.8Update to 2.0.0
- High7.2Authenticated (Admin+) SQL Injection
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
<3.5.25Update to 3.5.25
- Medium6.1Reflected Cross-Site Scripting
Pixel Cat – Conversion Pixel Manager
≤2.6.3Update to 2.6.4
- Medium6.4Reflected Cross-Site Scripting
Child Theme Generator
≤2.2.7No patch available
- Medium6.1Reflected Cross-Site Scripting
Login & Register Customizer – Forms, Popup, Profile & WooCommerce
≤2.1Update to 2.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Backup Migration
≤1.1.5Update to 1.1.6
- High8.8Cross-Site Request Forgery
Push Notifications for WordPress (Lite)
<6.0.1Update to 6.0.1
- Medium6.4Cross-Site Scripting
Mortgage Calculator
<1.5.17Update to 1.5.17
- Critical9.8Unauthenticated Arbitrary File Upload
Wordpress Plugin Smart Product Review
≤1.0.4Update to 1.0.5
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Directorist: AI-Powered Business Directory, Listings & Classified Ads
≤7.0.6.1Update to 7.0.6.2
- Medium6.1Reflected Cross-Site Scripting
SportsPress – Sports Club & League Manager
≤2.7.8Update to 2.7.9
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Pixel Cat – Conversion Pixel Manager
≤2.6.1Update to 2.6.2
- Medium4.8Admin+ Stored Cross-Site Scripting
Pixel Cat – Conversion Pixel Manager
≤2.6.2Update to 2.6.3
- Medium5.5Stored Cross-Site Scripting
Inspirational Quote Rotator
≤1.0.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Auto Featured Image (Auto Post Thumbnail)
≤3.9.2Update to 3.9.3
- Critical9.8Unauthenticated Blind SQL Injection via time Parameter
Modern Events Calendar Lite
<6.1.5Update to 6.1.5
- Medium6.1Reflected Cross-Site Scripting
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<3.2.3Update to 3.2.3
- Medium6.1Reflected Cross-Site Scripting via current_month_divider parameter
Modern Events Calendar Lite
≤6.1.0Update to 6.1.5
- Critical9.0Unauthenticated PHP Object Injection
ToTop Link
≤1.7.1No patch available
- Medium4.3Cross-Site Request Forgery
Single Post Exporter
≤1.1.1No patch available
- Medium4.3Subscriber+ Plugin Settings Update
Temporary Login Without Password
≤1.7.0Update to 1.7.1