Database
WordPress Vulnerability Database (page 1273)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Authenticated Stored Cross-Site Scripting
Meks Easy Photo Feed Widget
<1.2.4Update to 1.2.4
- Medium5.5Arbitrary File Deletion
Error Log Viewer by BestWebSoft
≤1.1.1Update to 1.1.2
- Medium6.1Reflected Cross-Site Scripting
Booking Package
<1.5.11Update to 1.5.11
- Critical9.8Authenticated SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
<4.1.4Update to 4.1.4
- Medium6.4Contributor+ Stored Cross-Site Scripting
Get Custom Field Values
<4.0.1Update to 4.0.1
- Medium6.5Arbitrary Post Metadata Access
Get Custom Field Values
<4.0Update to 4.0
- High7.2Admin+ SQL Injection
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
≤4.3.1Update to 5.0.0
- Medium6.1Reflected Cross-Site Scripting
Email Log
≤2.4.7Update to 2.4.8
- Medium6.1Reflected Cross-Site Scripting via rul_login_url, rul_logout_url Parameter
LoginWP (Formerly Peter's Login Redirect)
<3.0.0.5Update to 3.0.0.5
- Critical9.8Unauthenticated SQL Injection
Registrations for the Events Calendar – Event Registration Plugin
<2.7.6Update to 2.7.6
- Medium5.4Staff Member Stored Cross-Site Scripting
Online Scheduling and Appointment Booking System – Bookly
≤20.3Update to 20.3.1
- Medium5.5Authenticated (Admin+) Arbitrary File Deletion
Backup and Restore plugin – WordPress
≤1.0.3No patch available
- Medium6.1Reflected Cross-Site Scripting
FOX – Currency Switcher Professional for WooCommerce
≤1.3.7Update to 1.3.7.1
- Critical9.8Unauthenticated SQL Injection
Secure Copy Content Protection and Content Locking
≤2.8.1Update to 2.8.2
- High8.0Missing Authorization to Visitor Monitoring & Chat Removal
Tawk.To Live Chat
<0.6.0Update to 0.6.0
- Medium6.4Authenticated Stored Cross-Site Scripting
Testimonial – WordPress Testimonial Showcase Plugin Grid Plus Testimonial Slider
≤1.6.1Update to 1.6.2
- Medium5.3Unauthenticated Information Disclosure
Visual Form Builder
<3.0.6Update to 3.0.6
- Medium6.1Reflected Cross-Site Scripting
WP Google Fonts
≤3.1.4Update to 3.1.5
- Medium6.1Reflected Cross-Site Scripting
Email Tracker
<5.2.6Update to 5.2.6
- Medium5.3CSV Injection
Visual Form Builder
<3.0.6Update to 3.0.6
- Medium5.3Missing Authorization
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
<3.5.3Update to 3.5.3
- High7.5Missing Authorization to Arbitrary Plugin Installation
Nitro by WooRockets
≤1.7.9No patch available
- Medium6.5Arbitrary Settings Change
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
<3.5.3Update to 3.5.3
- Medium4.8Authenticated Stored Cross-Site Scripting
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.6.3Update to 3.6.3
- Medium5.5Cross-Site Scripting
Contact Form, Survey, Quiz & Popup Form Builder – ARForms
<1.5Update to 1.5
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Ivory Search – WordPress Search Plugin
≤4.7.1Update to 4.8
- Medium5.4Cross-Site Request Forgery
Email Tracker
≤5.2.6Update to 5.2.7
- Medium4.8Stored Cross-Site Scripting
Easy Google Maps by Supsystic – Custom Markers, Clustering & Map Themes
≤1.9.33Update to 1.10.1
- High8.2Unprotected REST-API Endpoints
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
≤2.6.4Update to 2.6.5
- Medium4.3Authenticated Email Address Disclosure
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
<13.1.0.7Update to 13.1.0.7