Database
WordPress Vulnerability Database (page 1272)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Unauthenticated Stored Cross-Site Scripting
Shiny Buttons – CSS3 Button Generator for WordPress
≤1.1.0No patch available
- Medium4.3Cross-Site Request Forgery
Wp Limits
≤1.0No patch available
- Medium4.3Plugin's Settings Update via Cross-Site Request Forgery
WP Admin Logo Changer
≤1.0No patch available
- Medium6.1Cross-Site Scripting
Activity Log for WordPress
<1.0.21Update to 1.0.21
- High7.2Authenticated (Admin+) SQL Injection
Quotes Collection
≤2.5.2No patch available
- Medium6.5Cross-Site Request Forgery
Filter Portfolio Gallery
≤1.5No patch available
- Critical9.0Unauthenticated PHP Object Injection
ToTop Link
≤1.7.1No patch available
- Critical9.8Unauthenticated Blind SQL Injection via time Parameter
Modern Events Calendar Lite
<6.1.5Update to 6.1.5
- Medium6.1Reflected Cross-Site Scripting via current_month_divider parameter
Modern Events Calendar Lite
≤6.1.0Update to 6.1.5
- Medium4.3Subscriber+ Plugin Settings Update
Temporary Login Without Password
≤1.7.0Update to 1.7.1
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Pixel Cat – Conversion Pixel Manager
≤2.6.1Update to 2.6.2
- Medium6.1Reflected Cross-Site Scripting
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<3.2.3Update to 3.2.3
- Medium4.8Admin+ Stored Cross-Site Scripting
Pixel Cat – Conversion Pixel Manager
≤2.6.2Update to 2.6.3
- High7.2Admin+ Local File Inclusion
All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
≤2.4.9Update to 2.5.0
- Medium4.3Improper Access Control
User meta shortcodes
≤0.5No patch available
- High8.5Missing Authorization
Contact Form Advanced Database
≤1.0.8No patch available
- Medium4.3Cross-Site Request Forgery
Single Post Exporter
≤1.1.1No patch available
- High8.8SQL Injection
Mediamatic – Media Library Folders
≤2.8.0Update to 2.8.1
- High7.2Admin+ SQL Injection
SEO Booster
≤3.7Update to 3.8
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
NEX-Forms – Ultimate Forms Plugin for WordPress
≤8.4.2Update to 8.4.3
- Medium6.1Reflected Cross-Site Scripting
Database for Contact Form 7, WPforms, Elementor forms
≤1.2.3Update to 1.2.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Album and Image Gallery with Lightbox – Flagallery Photo Portfolio
≤6.1.2No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Database Addon for Contact Form 7 – CFDB7
≤1.2.6.1Update to 1.2.6.2
- High8.8Authenticated Arbitrary File Upload
WP Popular Posts
≤5.3.2Update to 5.3.3
- Medium6.5Cross-Site Request Forgery
Database Addon for Contact Form 7 – CFDB7
≤1.2.5.9Update to 1.2.6.1
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Contact Form Email
≤1.3.24Update to 1.3.25
- Medium4.8Admin+ Stored Cross-Site Scripting
Caldera Forms – More Than Contact Forms
<1.9.5Update to 1.9.5
- Medium6.5Unauthorised Vote Export to Email & IP Addresses Disclosure
Like Button Rating ♥ LikeBtn
≤2.6.37Update to 2.6.38
- High8.8Cross-Site Request Forgery
WP Reset
5.00 – 5.98Update to 5.99
- High8.8Missing Authorization to Database Reset
WP Reset
5.00 – 5.98Update to 5.99