Database
WordPress Vulnerability Database (page 1283)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
GamePress – The Game Database Plugin
≤1.1.0No patch available
- Medium6.5Cross-Site Request Forgery to Cross-Site Scripting
Wp Cookie Choice
≤1.1.0No patch available
- Medium5.4Reflected Cross-Site Scripting
eID Easy
≤4.6Update to 4.7
- Medium5.3Sensitive Information Disclosure
BulletProof Security
≤5.1Update to 5.2
- High7.2SQL Injection
BuddyBoss Platform
≤1.7.8Update to 1.7.9
- Medium6.9Stored Cross-Site Scripting
YITH Maintenance Mode
≤1.3.7Update to 1.3.8
- Medium6.4Contributor+ Stored Cross-Site Scripting
Compact WP Audio Player
≤1.9.6Update to 1.9.7
- Medium6.5Cross-Site Request Forgery
SEO Redirection Plugin – 301 Redirect Manager
≤7.8Update to 7.9
- Medium6.4Stored Cross-Site Scripting
Podcast Subscribe Buttons
<1.4.2Update to 1.4.2
- Critical9.9Authenticated Command Injection
WordPress PDF Light Viewer Plugin
≤1.4.11Update to 1.4.12
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
PlanSo Forms
≤2.6.4No patch available
- Medium6.4Contributor+ Stored Cross-Site Scripting
DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
≤1.7.12Update to 1.7.13
- Medium5.3Sensitive Information Disclosure
Find My Blocks – Locate blocks on your site
<3.4.0Update to 3.4.0
- Medium4.3Setting Change via Cross-Site Request Forgery
Compact WP Audio Player
≤1.9.6Update to 1.9.7
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Shared Files – File Upload & Download Manager
<1.6.57Update to 1.6.57
- Medium6.1Reflected Cross-Site Scripting
Affiliate Power – Sales Tracking for Affiliate Marketers
≤2.2.0Update to 2.3.0
- High8.8Authenticated (Contributor+) Code Injection
Gutenberg Block Editor Toolkit – EditorsKit
≤1.31.5Update to 1.31.6
- High7.5Unauthenticated SQL Injection
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
<3.4.2Update to 3.4.2
- Medium4.8Admin+ Stored Cross-Site Scripting
Simple Social Media Share Buttons – Social Sharing for Everyone
≤3.2.3Update to 3.2.4
- Medium4.3Missing Authorization
CURCY – Multi Currency for WooCommerce
≤2.1.17Update to 2.1.18
- Medium6.1Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.1.13Update to 7.1.14
- Medium6.5Missing Authorization
CURCY - WooCommerce Multi Currency - Currency Switcher
≤2.1.17Update to 2.1.18
- Medium4.8wpDiscuz <= 7.3.0 - Authenticated Stored Cross-Site Scripting
Comments – wpDiscuz
≤7.3.0Update to 7.3.2
- Medium6.1Reflected Cross-Site Scripting
SEO Redirection Plugin – 301 Redirect Manager
≤7.3Update to 7.4
- Medium6.4Authenticated Stored Cross-Site Scripting
Coming soon and Maintenance mode
<3.5.3Update to 3.5.3
- High8.8Cross-Site Request Forgery
Travelpayouts: All Travel Brands in One Place
≤1.0.16Update to 1.0.17
- Medium4.8Admin+ Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.3.1Update to 7.3.2
- Medium4.3Cross-Site Request Forgery leading to Arbitrary Domain Deletion
Software License Manager
<4.5.1Update to 4.5.1
- Critical9.8Arbitrary File Upload
Download from files
≤1.48No patch available
- Medium6.5Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤13.1.1Update to 13.1.2