Database
WordPress Vulnerability Database (page 1272)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Administrator Open Redirect
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34Update to 3.4.34
- High8.8Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34Update to 3.4.34
- Medium4.3Authenticated OAuth Connection Key Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34.1Update to 3.4.34.1
- Medium5.4Cross-Site Request Forgery to OAuth Service Disconnection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34Update to 3.4.34
- Medium4.9Authenticated Arbitrary File Download
Theme Editor
≤2.5Update to 2.6
- High8.8Cross-Site Request Forgery to Setting Modification
Responsive Menu – Mobile Menu & Hamburger Menu Builder
<4.0.4Update to 4.0.4
- Medium6.1Tour & Travel WordPress Theme < 2.0 - Reflected Cross-Site Scripting
Goto - Tour & Travel WordPress Theme
<2.0Update to 2.0
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Responsive Menu – Mobile Menu & Hamburger Menu Builder
<4.0.4Update to 4.0.4
- High8.84.0.3 - Authenticated Arbitrary File Upload
Responsive Menu – Mobile Menu & Hamburger Menu Builder
4.0 – <4.0.4Update to 4.0.4
- Medium6.1Directory & Listings With Booking - WordPress Theme < 1.6.11 - Cross-Site Scripting
Listeo - Directory & Listings With Booking - WordPress Theme
<1.6.11Update to 1.6.11
- High7.5Server-Side Request Forgery
Like Button Rating ♥ LikeBtn
<2.6.32Update to 2.6.32
- Medium6.1Social Directory WordPress Theme <= 2.4.2 - Reflected Cross-Site Scripting
Wyzi - Social Directory WordPress Theme
≤2.4.2Update to 2.4.3
- High7.5Unauthenticated Settings Import & Export
Ultimate GDPR & CCPA Compliance Toolkit for WordPress
<2.5Update to 2.5
- High8.8Cross-Site Request Forgery
Name Directory
≤1.17.4Update to 1.18
- High8.8Contact Form 7 Style <= 3.1.9 Cross-Site Request Forgery
Contact Form 7 Style
≤3.1.9No patch available
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.68Update to 1.5.68
- Critical9.8Authentication Bypass
MStore API – Create Native Android & iOS Apps On The Cloud
≤3.1.9Update to 3.2.0
- Medium6.1Reflected Cross-Site Scripting
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤3.73Update to 3.74
- High8.8SQL Injection
wpDataTables (Premium)
≤3.4Update to 3.4.1
- High7.2Authenticated (Admin+) SQL injection
WP Editor
≤1.2.6.3Update to 1.2.7
- High7.5Unauthenticated Events Export
Modern Events Calendar Lite
≤5.16.4Update to 5.16.5
- High8.8Authenticated SQL Injection
Modern Events Calendar Lite
≤5.16.5Update to 5.16.6
- Medium6.4Authenticated Stored Cross-Site Scripting
Modern Events Calendar Lite
≤5.16.4Update to 5.16.5
- High7.2Authenticated Arbitrary File Upload leading to Remote Code Execution
Modern Events Calendar Lite
≤5.16.4Update to 5.16.5
- High7.5Unauthenticated Information Disclosure
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.8Unauthenticated Wordpress Options Changes via AJAX
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.8Unauthenticated Arbitrary Account Creation
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.8Unauthenticated Arbitrary Account Changes
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Medium6.5Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Critical9.1Unauthenticated Arbitrary Post/Page Deletion
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7