Database
WordPress Vulnerability Database (page 1278)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Cross-Site Scripting
Recall Products
≤0.8No patch available
- Medium5.4Stored Cross-Site Scripting
WP smart CRM & Invoices FREE
≤1.8.7No patch available
- High8.8Authenticated SQL Injection
Recall Products
≤0.8No patch available
- Medium6.1Cross-Site Scripting
Chamber Dashboard Business Directory
<3.3.1Update to 3.3.1
- Medium6.1Reflected Cross-Site Scripting
Subscribe Sidebar plugin by Blubrry
≤1.3.1No patch available
- High7.2SQL Injection
WordPress Poll
≤36No patch available
- High7.2Authenticated Arbitrary File Upload
Autoptimize
≤2.7.6Update to 2.7.7
- Medium6.1Cross-Site Scripting via id Parameter
WP Floating Menu – One page navigator, sticky menu for WordPress
<1.4.1Update to 1.4.1
- High8.6Unauthenticated Arbitrary Post Deletion
Kali Forms — Contact Form & Drag-and-Drop Builder
<2.1.2Update to 2.1.2
- High7.1Missing Authorization to Settings Update
Kali Forms — Contact Form & Drag-and-Drop Builder
<2.1.2Update to 2.1.2
- High8.8Cross-Site Request Forgery
Kali Forms — Contact Form & Drag-and-Drop Builder
<2.1.2Update to 2.1.2
- High7.5Payment System Bypass
NAB Transact
<2.1.2Update to 2.1.2
- Medium6.3Missing Authorization
Discount Rules for WooCommerce
≤2.0.2Update to 2.1.0
- Medium6.1Multiple Stored Cross-Site Scripting
WP Customer Reviews
≤3.4.2Update to 3.4.3
- Medium4.3Authenticated Information Disclosure
Access Governance for WordPress (aka AAM)
≤6.6.1Update to 6.6.2
- High8.84.2.12 - Unprotected AJAX Actions
Backup, Restore and Migrate your sites with XCloner
4.2.1 – 4.2.12Update to 4.2.153
- Critical9.8Cross-Site Request Forgery
Backup, Restore and Migrate your sites with XCloner
<4.2.153Update to 4.2.153
- High7.5Authenticated Authorization Bypass and Privilege Escalation
Access Governance for WordPress (aka AAM)
≤6.6.1Update to 6.6.2
- High7.5Unauthenticated Resource Access to Site Backups
File Manager
≤6.4Update to 6.5
- High8.6CSV injection via form entry
weForms – Easy Drag & Drop Contact Form Builder For WordPress
≤1.4.7Update to 1.4.8
- Medium6.1Cross-Site Scripting
Sell Media
<2.4.2Update to 2.4.2
- Medium6.1Reflected Cross-Site Scripting
Ultimate Appointment Booking & Scheduling
<1.1.10Update to 1.1.10
- Medium6.1Reflected Cross-Site Scripting
RSS Feed Widget
<2.8.1Update to 2.8.1
- Medium6.1Reflected Cross-Site Scripting
Admin Menu
≤1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Nova Lite
<1.3.9Update to 1.3.9
- High7.4Missing Capabilities Check
Facebook Chat Plugin – Live Chat Plugin for WordPress
<1.6Update to 1.6
- High8.3Missing Authorization
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
≤3.8.1Update to 3.8.2
- High7.5Missing Authorization
Product Input Fields for WooCommerce
≤1.2.6Update to 1.2.7
- High8.2Unauthenticated Arbitrary File Deletion
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
<7.0.1Update to 7.0.1
- High8.8Arbitrary File Upload
Divi Builder
≤4.3.2Update to 4.5.3