Database
WordPress Vulnerability Database (page 1279)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.2Authenticated (Admin+) SQL Injection
Wow Forms – create any form with custom style
≤3.1.3No patch available
- High7.2Authenticated (Admin+) SQL Injection
G Auto-Hyperlink
≤1.0.1No patch available
- High7.2Authenticated (Admin+) SQL Injection
SpiderCatalog
≤1.7.3No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Arrival
≤1.4.2Update to 1.4.3
- Medium4.8Admin+ Stored Cross-Site Scripting
WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel
<1.3.1Update to 1.3.1
- Medium4.3Author Arbitrary Media File Renaming
Phoenix Media Rename
≤3.4.2Update to 3.4.4
- Medium4.3Log Deletion via Cross-Site Request Forgery
Redirect 404 Error Page to Homepage or Custom Page with Logs
≤1.7.8Update to 1.7.9
- Medium4.8Admin+ Stored Cross-Site Scripting
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<5.0.07Update to 5.0.07
- Medium4.3Cross-Site Request Forgery
Genie WP Favicon
≤0.5.2No patch available
- Medium6.4Stored Cross-Site Scripting
Age Gate
<2.16.4Update to 2.16.4
- High8.8Subscriber+ SQL Injection
Visitor Traffic Real Time Statistics
≤3.8Update to 3.9
- Medium6.54.0.2 - Authenticated SQL Injection via id Parameter
WP Bannerize
2.0.0 – 4.0.2No patch available
- Medium6.17.5.2.727 - Reflected Cross-Site Scripting via player_id Parameter
FV Flowplayer Video Player
7.5.0.727 – 7.5.2.727Update to 7.5.3.727
- Medium4.3Missing Authorization on jobsearch_update_job_import_schedule_call() function
JobSearch WP Job Board
≤1.8.1Update to 1.8.2
- High7.2Authenticated (Admin+) Local File Inclusion
TWChat – Send or receive messages from users
≤3.1.4Update to 3.1.5
- Medium4.3Log Reset
Simple Download Monitor
≤3.9.5Update to 3.9.6
- High8.8Missing Authorization to Arbitrary Options Update
JobSearch WP Job Board
≤1.8.1Update to 1.8.2
- Medium4.3Contributor+ Arbitrary Thumbnail Removal
Simple Download Monitor
<3.9.6Update to 3.9.6
- Critical9.0Contributor+ Stored Cross-Site Scripting via File Thumbnail
Simple Download Monitor
≤3.9.4Update to 3.9.5
- Medium4.8Cross-Site Scripting
Booking.com Product Helper
<1.0.2Update to 1.0.2
- Medium5.3Missing Authorization to Settings Change
JobSearch WP Job Board
≤1.8.1Update to 1.8.2
- Medium5.3Sensitive Data Exposure
Simple Download Monitor
<3.9.6Update to 3.9.6
- High8.8Cross-Site Request Forgery
Perfect Survey
≤1.5.2No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Survey Plus
≤1.0No patch available
- Medium6.5Missing Authorization
Batch Cat
≤0.3No patch available
- Medium4.8Google Language Translator <= 6.0.11 - Admin+ Stored Cross-Site Scripting
Translate WordPress – Google Language Translator
<6.0.12Update to 6.0.12
- Medium6.1Reflected Cross-Site Scripting
World Travel Information
≤1.0.0No patch available
- Medium5.3Full Path Disclosure
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
<17.3Update to 17.3
- Medium4.8Cross-Site Scripting
Booking.com Banner Creator
<1.4.3Update to 1.4.3
- Critical9.8Arbitrary File Upload
MStore API – Create Native Android & iOS Apps On The Cloud
<3.4.5Update to 3.4.5