Database
WordPress Vulnerability Database (page 1282)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.8Admin+ Stored Cross-Site Scripting
Cookie Bar
≤1.8.8Update to 1.8.9
- Medium5.4Cross-Site Scripting
Video Player for YouTube – Embed Videos Your Visitors Will Love to Watch
<1.4Update to 1.4
- Medium5.8Open Relay and Server-Side Request Forgery
Telefication
≤1.8.0No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Responsive WordPress Slider
≤2.2.0No patch available
- High7.5Unauthenticated Arbitrary Post Deletion
WP DSGVO Tools (GDPR)
≤3.1.23Update to 3.1.24
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
St-Daily-Tip
≤4.7No patch available
- Medium4.8Stored Cross-Site Scripting
Request a Quote – Quote Forms for Any WordPress Site
<2.3.5Update to 2.3.5
- Medium5.4Authenticated (Author+) Stored Cross-Site Scripting
WP HTML Author Bio
≤1.2.0No patch available
- High7.2Authenticated (Admin+) SQL Injection
Game Server Status
≤1.0No patch available
- Medium4.8Vimeo and YouTube Gallery < 1.1.5 - Stored Cross-Site Scripting
Video Gallery – Vimeo and YouTube Gallery
<1.1.5Update to 1.1.5
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Special Text Boxes
≤5.9.109Update to 5.9.110
- High8.8Cross-Site Request Forgery
jQuery Reply to Comment
≤1.31No patch available
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Frontend Uploader
≤1.3.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
≤2.6.0Update to 2.6.1
- Medium4.8Authenticated Stored Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤4.1.3Update to 4.1.3.1
- Medium6.5Cross-Site Request Forgery to Cross-Site Scripting
Wp Cookie Choice
≤1.1.0No patch available
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Sociable
≤4.3.4.1No patch available
- Medium6.1Reflected Cross-Site Scripting
GamePress – The Game Database Plugin
≤1.1.0No patch available
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
Polo Video Gallery – Best wordpress video gallery plugin
≤1.2No patch available
- Medium5.4Cross-Site Scripting
StreamCast – bring live radio to your site with a sleek player
<2.1.1Update to 2.1.1
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
微信打赏（Wechat Reward）
≤1.7No patch available
- Medium5.5Admin+ Stored Cross-Site Scripting
Tutor LMS – eLearning and online course solution
<1.9.9Update to 1.9.9
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Customer Support Ticket System & Helpdesk
<5.10.4Update to 5.10.4
- Medium5.4Cross-Site Scripting
PDF Viewer Block for Gutenberg
<1.0.1Update to 1.0.1
- High7.2Admin+ SQL Injection
MainWP Child Reports
≤2.0.7Update to 2.0.8
- Medium6.4Contributor+ Stored Cross-Site Scripting
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player
≤2.1.2Update to 2.1.3
- Critical9.8Authentication Bypass via Password Reset
YITH Easy Login & Register Popup for WooCommerce
≤1.8.0Update to 1.8.1
- Medium5.4Stored Cross-Site Scripting
One User Avatar | User Profile Picture
<2.3.7Update to 2.3.7
- Medium5.4Missing Authorization
Catch Themes Demo Import
<1.6Update to 1.6
- High8.8Cross-Site Request Forgery to Remote Code Execution and/or Cross-Site Scripting
Scroll Baner
≤1.0No patch available