Database
WordPress Vulnerability Database (page 1275)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.5Denial of Service
Reviews Plus
<1.2.14Update to 1.2.15
- Medium5.5Authenticated Stored Cross-Site Scripting
Notification – Custom Notifications and Alerts for WordPress
≤7.2.4Update to 8.0.0
- Medium6.1Reflected Cross-Site Scripting
Falang multilanguage for WordPress
<1.3.18Update to 1.3.18
- Medium5.4Contributor+ Stored Cross-Site Scripting
Popup Maker and Popup Anything – Popup for opt-ins and Lead Generation Conversions
≤2.0.3Update to 2.0.4
- Medium6.1Reflected Cross-Site Scripting
WP Spell Check
<9.3Update to 9.3
- High7.2SQL Injection via orderby, order Parameters
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
<4.1.8Update to 4.1.8
- Medium6.1Two Factor Authentication <= 1.0.4 - Reflected Cross-Site Scripting
Ecommerce – Two Factor Authentication
<1.0.5Update to 1.0.5
- Medium5.5Stored Cross-Site Scripting
CM Video Lessons Manager – Simplify video lessons management for better education
≤1.7.1Update to 1.7.2
- Medium4.8Cross-Site Scripting
Slideshow Gallery LITE
<1.7.4Update to 1.7.4
- Medium4.3Cross-Site Request Forgery
Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid
<1.2.5Update to 1.2.5
- High8.8Object Injection
Social Sharing Plugin – Sassy Social Share
3.3.23 – 3.3.23Update to 3.3.24
- Medium5.5Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site Scripting
Simple Job Board
≤2.9.4Update to 2.9.5
- Medium4.8Reflected Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.11.2Update to 2.11.2.1
- High7.2Arbitrary File Upload
Catch Themes Demo Import
≤1.7Update to 1.8
- High8.8Cross-Site Request Forgery
Core Tweaks WP Setup
≤4.1No patch available
- Medium6.1Open Redirect
Pie Register – User Registration, Profiles & Content Restriction
<3.7.2.4Update to 3.7.2.4
- High8.8Authenticated (Contributor+) Arbitrary File Upload
Template Kit – Import
≤1.0.13Update to 1.0.14
- Medium5.4Stored Cross-Site Scripting
BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP
<1.2.6Update to 1.2.6
- High7.2Admin+ SQL Injection via orderby parameter
Download Monitor
<4.4.5Update to 4.4.5
- Medium4.8Admin+ Stored Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.15.4Update to 1.15.4
- Medium4.3Missing Authorization
Slider, Image Slider & Carousel by Slider Factory – Responsive Slideshow, Video Slider
<1.3.6Update to 1.3.6
- High7.2A Better Search Free & Premium <= 2.16.3 & 4.14.3 - Stored Cross-Site Scripting
Relevanssi Premium
<2.16.3Update to 2.16.4
- Medium5.4Stored Cross-Site Scripting
Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid
<1.2.4Update to 1.2.4
- High8.1Cross-Site Request Forgery
Images to WebP
<1.9Update to 1.9
- Medium6.5SQL Injection
Duplicate Post
<1.2.0Update to 1.2.0
- High7.5SQL Injection
Mang Board
≤1.9.9Update to 2.0.0
- Medium4.8Admin+ Stored Cross-Site Scripting
Access Governance for WordPress (aka AAM)
<6.8.0Update to 6.8.0
- Medium5.7Cross-Site Request Forgery
Download Plugin
<1.6.1Update to 1.6.1
- High7.5Local File Inclusion
Images to WebP
≤1.8Update to 1.9
- Medium5.4Reflected Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.11.2Update to 2.11.2.1