Database
WordPress Vulnerability Database (page 1277)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Stored Cross-Site Scripting
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤15.3Update to 15.4
- Medium5.4Author+ Stored Cross-Site Scripting via Preview Module
YOP Poll
≤6.3.0Update to 6.3.1
- Medium5.4Author+ Stored Cross-Site Scripting via Options Module
YOP Poll
≤6.3.0Update to 6.3.1
- Medium5.5Stored Cross-Site Scripting
WordPress ERP, HR, CRM, and Project Management Plugin – Business Manager
≤1.4.5Update to 1.4.6
- Medium5.5Stored Cross-Site Scripting
WpGenius Job Listing
≤1.0.2Update to 1.0.3
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Job Board Vanila Plugin
1.0 – 1.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
KJM Admin Notices
≤2.0.1No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
MyBB Cross-Poster
≤1.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Job Manager
≤0.7.25No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
job-portal
≤0.0.1No patch available
- Medium5.5HAL <= 2.1.1 Authenticated Stored Cross-Site Scripting
HAL
≤2.1.1Update to 2.2
- High8.8Authenticated (Subscriber+) SQL Injection
WP Fastest Cache – WordPress Cache Plugin
<0.9.5Update to 0.9.5
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Fastest Cache – WordPress Cache Plugin
<0.9.5Update to 0.9.5
- Medium5.5Authenticated Stored Cross-Site Scripting
Author Bio Box
≤3.3.1Update to 3.3.2
- High8.8Backdoored
Frontend Post WordPress Plugin – AccessPress Anonymous Post
2.8.0 – 2.8.0Update to 2.8.1
- Medium4.3Cross-Site Request Forgery
Colorful Categories
<2.0.15Update to 2.0.15
- Medium6.4Page Builder <= 2.3.11 - Stored Cross-Site Scripting
Brizy – Page Builder
≤2.3.11Update to 2.3.12
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Testimonial – WordPress Testimonial Showcase Plugin Grid Plus Testimonial Slider
<1.6.0Update to 1.6.0
- High8.8Authenticated File Upload and Path Traversal
Brizy – Page Builder
≤2.3.11Update to 2.3.12
- High7.5Insecure Password Creation
Simple JWT Login – Allows you to use JWT on REST endpoints.
<3.3.0Update to 3.3.0
- High8.8Authenticated (Admin+) SQL Injection
WP Cloudy, weather plugin
≤4.4.9No patch available
- Medium6.1Reflected Cross-Site Scripting
Discounts & Promotions Automation
<3.4.5Update to 3.4.5
- Medium5.4Authenticated Stored Cross-Site Scripting
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
≤2.4.13Update to 2.4.14
- Medium4.3wpDiscuz <= 7.3.3 - Arbitrary Comment Addition/Edition/Deletion by Cross-Site Request Forgery
Comments – wpDiscuz
<7.3.4Update to 7.3.4
- Medium4.3Contributor+ Arbitrary Post Schedule Deletion
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
≤2.5.1Update to 2.6.0
- High7.2Admin+ Arbitrary PHP Code Execution
Similar Posts – Best Related Posts Plugin for WordPress
≤3.1.5Update to 3.1.6
- Critical9.8Unauthenticated SQL Injection
Pie Register – User Registration, Profiles & Content Restriction
<3.7.1.6Update to 3.7.1.6
- Medium6.5Logs Deletion via Cross-Site Request Forgery
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring
<3.0.9Update to 3.0.9
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Storefront Footer Text
≤1.0.1No patch available
- Critical9.8Authentication Bypass
Pie Register – User Registration, Profiles & Content Restriction
≤3.7.1.4Update to 3.7.1.5