Database
WordPress Vulnerability Database (page 1281)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Contributor+ Stored Cross-Site Scripting
Cool Tag Cloud
≤2.25Update to 2.26
- High8.8Privilege Escalation
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI
<1.7.6Update to 1.7.6
- Medium5.5Stored Cross-Site Scripting
Flat Preloader
<1.5.5Update to 1.5.5
- High8.8Cross-Site Request Forgery
OG Tags
≤2.0.1Update to 2.0.2
- Medium5.4Cross-Site Request Forgery to Stored Cross-Site Scripting
Flat Preloader
<1.5.4Update to 1.5.4
- Medium5.5Admin+ Stored Cross-Site Scripting
Connections Business Directory
<10.4.3Update to 10.4.3
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Countdown and CountUp, WooCommerce Sales Timer
≤1.5.7Update to 1.5.8
- Medium6.1Reflected Cross-Site Scripting
WP Table Builder – Drag & Drop Table Builder
≤1.3.9Update to 1.3.10
- Medium4.8Admin+ Stored Cross-Site Scripting
Visual Form Builder
≤3.0.3Update to 3.0.4
- Medium4.8Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.5.8.2Update to 3.5.8.2
- Medium6.5Unauthenticated Plugin Settings Update
WP Debugging
≤2.10.2Update to 2.11.0
- High7.2Admin+ SQL Injection via Order and OrderBy parameters
Check & Log Email – Easy Email Testing & Mail logging
≤1.0.2Update to 1.0.3
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Great Quotes
≤1.0.0No patch available
- Medium5.5Cross-Site Scripting
Contact Forms by Cimatti
<1.4.12Update to 1.4.12
- Medium4.9Drag & Drop Contact Form Builder <= 1.0.5 - Authenticated (Admin+) Arbitrary System File Read
Contact Forms – Drag & Drop Contact Form Builder
≤1.0.5No patch available
- High7.2Admin+ SQL Injection
Permalink Manager Lite
≤2.2.12Update to 2.2.13.1
- Medium6.1Reflected Cross-Site Scripting
Product Table & List Builder for WooCommerce
≤2.3.0Update to 2.4.0
- High7.2Stored Cross-Site Scripting
Appointment Bookings for Zoom GoogleMeet and more – Wappointment
≤2.2.4Update to 2.2.5
- Medium6.1Cross-Site Scripting
WP Visited Countries Reloaded
≤3.1.0Update to 3.1.1
- Medium6.3Cross-Site Request Forgery and Missing Authorization
Careerfy - Job Board WordPress Theme
≤7.0Update to 7.1.0
- High7.2Unauthenticated Stored Cross-Site Scripting
WP DSGVO Tools (GDPR)
<3.1.24Update to 3.1.24
- High7.2iframe Injection
ark-commenteditor
≤2.15.6No patch available
- Critical9.8Arbitrary File Upload
3DPrint Lite
<1.9.1.5Update to 1.9.1.5
- Medium6.6Authenticated Stored Cross-Site Scripting
AGCA – Custom Dashboard & Login Page
≤6.8Update to 6.9
- Medium6.9Multiple Authenticated Stored Cross-Site Scripting
YITH Maintenance Mode
≤1.3.8Update to 1.4.0
- Medium5.5Authenticated Stored Cross-Site Scripting
iQ Block Country
≤1.2.11Update to 1.2.12
- Medium6.4Unprotected REST-API to Email Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.5.7Update to 3.5.8
- Medium6.5Unprotected REST-API to Sensitive Information Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.5.7Update to 3.5.8
- High7.5Arbitrary User Password Reset
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
≤2.6.2Update to 2.6.3
- Medium5.4Cross-Site Scripting
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch
<1.4Update to 1.4