Database
WordPress Vulnerability Database (page 1276)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery to Arbitrary File Modification and Creation
Child Theme Creator by Orbisius
<1.5.2Update to 1.5.2
- High8.8Cross-Site Request Forgery
AI Chatbot for WooCommerce & Live Chat – onWebChat
≤3.1.0Update to 3.2.0
- High7.1Incorrect Authorization Checks Allowing Post Modification
Brizy – Page Builder
≤2.3.11Update to 1.0.126 or 2.3.12
- High7.2Arbitrary File Upload
PowerPress Podcasting plugin by Blubrry
≤8.3.7Update to 8.3.8
- Critical9.8Arbitrary File Upload (and Remote Code Execution) via Import Settings
Autoptimize
<2.7.8Update to 2.7.8
- Medium4.8Unsafe File Upload to Cross-Site Scripting
Autoptimize
<2.7.8Update to 2.7.8
- High8.1Race Condition leading to Remote Code Execution
Autoptimize
<2.7.8Update to 2.7.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPBakery Page Builder
≤6.4Update to 6.4.1
- High7.2Authenticated Remote Code Execution in Dynamic OOO Widget
Elementor Website Builder Pro
≤3.0.5Update to 3.0.6
- Critical9.1Authentication Bypass
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤11.6Update to 11.7
- Critical9.8Function Injection
Sparkling
≤2.4.8Update to 2.4.9
- Medium6.5Unauthenticated Plugin Activation/Deactivation
Newspaper X
≤1.3.1Update to 1.3.2
- High8.8SQL Injection
Slider by 10Web – Responsive Image Slider
≤1.2.35Update to 1.2.36
- High7.5Improper Access Controls
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
≤2.0.28Update to 2.0.29
- Medium4.3Cross-Site Request Forgery Bypass
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
<1.6.4Update to 1.6.4
- Medium4.3Cross-Site Request Forgery Bypass
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
<1.5.16Update to 1.5.16
- Medium4.3Cross-Site Request Forgery Bypass
Hueman
≤3.6.3Update to 3.6.4
- Medium4.3Cross-Site Request Forgery Bypass
Customizr
≤4.3.0Update to 4.3.1
- Medium4.3Cross-Site Request Forgery Bypass
Ocean Extra
<1.6.6Update to 1.6.6
- Critical9.8Arbitrary File Upload
Simple:Press Forum
<6.6.1Update to 6.6.1
- High7.5Password Hash Extraction
W3 Total Cache
≤0.9.2.4Update to 0.9.2.5
- High7.5Sensitive Information Exposure
W3 Total Cache
≤0.9.2.4Update to 0.9.2.5
- Critical9.8SQL Injection
Advanced Contact form 7 DB
≤1.6.2Update to 1.7.0
- Medium5.3Validation Bypass via Email Field
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.4.27Update to 3.4.27.1
- Medium6.1Cross-Site Scripting
UpdraftPlus Premium
<1.9.64Update to 1.9.64
- Critical9.8SQL Injection
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.3.2Update to 2.3.3
- High7.5Insecure Cryptography to Sensitive Information Disclosure
W3 Total Cache
≤0.9.2.4Update to 0.9.2.5
- High8.8Cross-Site Request Forgery to Plugin Installation
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.4.27Update to 3.4.27.1
- Medium6.1Reflected Cross-Site Scripting
15Zine | Magazine Newspaper Blog News WordPress Theme
<3.3.0Update to 3.3.0
- Medium6.5Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.4.27.1Update to 3.4.28