Database
WordPress Vulnerability Database (page 1274)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<4.4.6Update to 4.4.6
- Medium5.5Cross-Site Scripting
WP-PostRatings
≤1.86Update to 1.86.1
- High8.2Cross-Site Request Forgery and Cross-Site Scripting
Site Offline Or Coming Soon Or Maintenance Mode
≤1.4.2Update to 1.4.4
- High7.5File Read / Directory Traversal
W3 Total Cache
0.9.2.6 – 0.9.3Update to 0.9.4
- Medium5.4Cross-Site Scripting
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
<1.8.3.3Update to 1.8.3.3
- High8.8Cross-Site Request Forgery
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤3.4.7Update to 3.5.0
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤3.4.7Update to 3.5.0
- Critical9.8WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation
ListingPro - WordPress Directory & Listing Theme
<2.6.1Update to 2.6.1
- Medium5.3WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosure
ListingPro - WordPress Directory & Listing Theme
<2.6.1Update to 2.6.1
- High8.1Arbitrary File Upload via Bypass
Contact Form 7
<5.3.2Update to 5.3.2
- High7.5Unauthenticated Backup Download
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
≤1.14.9Update to 1.14.10
- Medium6.1Reflected Cross-Site Scripting
Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention
≤2.15.2Update to 2.17.4
- High7.3Login Rate Limiting Bypass
Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention
≤2.17.3Update to 2.17.4
- Medium6.1Reflected Cross-Site Scripting
directories
<1.3.46Update to 1.3.46
- Medium6.1Reflected Cross-Site Scripting via font-size
Page Builder: Pagelayer – Drag and Drop website builder
<1.3.5Update to 1.3.5
- Medium6.1Cross-Site Scripting via _drts_form_build_id, _t_ Parameters
directories
<1.3.46Update to 1.3.46
- Medium6.1Reflected Cross-Site Scripting via Color Settings
Page Builder: Pagelayer – Drag and Drop website builder
<1.3.5Update to 1.3.5
- Medium6.5Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.1.13Update to 2.1.13
- Medium5.3Improper Access Control
DiveBook
≤1.1.4No patch available
- Critical9.8Remote Code Execution
WP Hotel Booking
≤1.10.3Update to 1.10.4
- High8.1Sensitive Information Disclosure
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more
≤1.4.2Update to 1.4.3
- High8.3Blind Server-Side Request Forgery via detail.php
Canto
≤1.9.0Update to 2.0.1
- Medium5.4Authenticated Stored Cross-Site Scripting
Themify Portfolio Post
≤1.1.5Update to 1.1.6
- High8.3Blind Server-Side Request Forgery via download.php
Canto
≤1.9.0Update to 2.0.1
- Medium6.3Missing Authorization on Various AJAX Actions
NEX-Forms – Ultimate Forms Plugin for WordPress
≤7.7.1Update to 7.8
- Medium6.1Reflected Cross-Site Scripting
EventON (Pro) - WordPress Virtual Event Calendar Plugin
≤3.0.5Update to 3.0.6
- Medium6.4Unrestricted SVG Uploads
Elementor Website Builder – more than just a page builder
≤3.0.13Update to 3.0.14
- High7.2Authenticated SQL Injection via Orderby
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.1.4Update to 4.1.5
- Critical9.9Authenticated Privilege Escalation
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
<2.10.3Update to 2.10.3
- High8.8Remote Code Execution
Secure File Manager
<2.8.2Update to 2.8.2