Database
WordPress Vulnerability Database (page 1274)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Ecommerce Product Addons <= 0.2.3 - Reflected Cross-Site Scripting
Ibtana – Ecommerce Product Addons
≤0.2.3Update to 0.2.4
- High8.8Subscriber+ SQL Injection
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
≤2.2Update to 2.3
- Medium5.4Stored Cross-Site Scripting
Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator
≤7.0.3Update to 7.0.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
GenerateBlocks
≤1.3.5Update to 1.4.0
- Medium5.4Subscriber+ Reflected Cross-Site Scripting
My Calendar – Accessible Event Manager
≤3.2.17Update to 3.2.18
- High7.2Admin+ SQL Injection
Email Before Download
≤6.7Update to 6.8
- Medium6.1Reflected Cross-Site Scripting
Check & Log Email – Easy Email Testing & Mail logging
<1.0.4Update to 1.0.4
- High7.2Admin+ SQL Injection
BSK PDF Manager
<3.1.2Update to 3.1.2
- Medium4.8Authenticated Cross-Site Scripting
Shop Page WP
<1.2.8Update to 1.2.8
- Medium4.8Admin+ Stored Cross-Site Scripting
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content
≤4.19.1Update to 4.19.2
- Medium6.1Reflected Cross-Site Scripting
Download Monitor
≤4.4.6Update to 4.4.7
- Medium6.8Authenticated (Admin+) Arbitrary File Download
Download Monitor
≤4.4.6Update to 4.4.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Download Monitor
≤4.4.6Update to 4.4.7
- Medium5.4Arbitrary Plugin Settings Update to Stored Cross-Site Scripting
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
<4.0.1Update to 4.0.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
<1.7.20Update to 1.7.20
- Medium6.4Authenticated Stored Cross-Site Scripting
Hotel Listings
<1.3.3Update to 1.3.3
- Medium4.3Cross-Site Request Forgery
URL Shortify – Simple and Easy URL Shortener
≤1.5.0Update to 1.5.1
- Critical9.8Unauthenticated SQL Injection
Directory Listings WordPress plugin – uListing
<1.7Update to 1.7
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Social Media Flying Icons | Floating Social Media Icon
≤4.3.5No patch available
- Medium5.3Hidden Login Page Location Disclosure
WPS Hide Login
≤1.9.0Update to 1.9.1
- Medium6.1Reflected Cross-Site Scripting
Registrations for the Events Calendar – Event Registration Plugin
≤2.7.4Update to 2.7.5
- Medium5.4Missing Authorisation
Bulk Datetime Change
<1.12Update to 1.12
- High7.2Authenticated SQL Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.6.4Update to 3.6.4
- Medium6.4Cross-Site Scripting
About Author Box
<1.0.2Update to 1.0.2
- High8.1Missing Authorization to Database Wipe
HashThemes Demo Importer
≤1.1.1Update to 1.1.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Media Tags
≤3.2.0.2No patch available
- Medium6.1Two Factor Authentication <= 1.0.4 - Reflected Cross-Site Scripting
Ecommerce – Two Factor Authentication
<1.0.5Update to 1.0.5
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Editable Table Simple Fast FrontEnd From Sql tables
≤0.1.4No patch available
- Medium6.5Denial of Service
Reviews Plus
<1.2.14Update to 1.2.15
- Medium4.3Cross-Site Request Forgery
MAZ Loader – Preloader Builder for WordPress
≤1.4.0Update to 1.4.1