Database
WordPress Vulnerability Database (page 1286)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Unuathenticated Arbitrary Options Update
Pinterest Automatic
≤4.14.3Update to 4.14.4
- Medium5.5Appointment Hour Booking <= 1.3.15 Admin+ Stored Cross-Site Scripting
Appointment Hour Booking – Booking Calendar
<1.3.16Update to 1.3.16
- Critical9.1Unauthenticated Arbitrary Options Update
WordPress Automatic Plugin
<3.53.3Update to 3.53.3
- Medium5.4Authenticated Stored Cross-Site Scripting
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
<2.0.2Update to 2.0.2
- Medium6.1Cross-Site Scripting
PublishPress Planner – Editorial Calendar, Marketing Content, Kanban Board
≤3.5.0Update to 3.5.1
- Medium6.1Reflected Cross-Site Scripting
Better Find and Replace – AI-Powered Suggestions
≤1.2.8Update to 1.2.9
- High8.8Cross-Site Request Forgery
Directory Listings WordPress plugin – uListing
≤2.0.8Update to 2.0.9
- Medium5.4Authenticated Stored Cross-Site Scripting
CM Tooltip Glossary
<3.9.21Update to 3.9.21
- Medium6.1Reflected Cross-Site Scripting
Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop
≤1.6.0Update to 1.6.1
- Critical9.8Multiple Unauthenticated SQL Injections
Support Board
≤3.3.3Update to 3.3.4
- High8.1SQL Injection
Meow Gallery
<4.1.9Update to 4.1.9
- High8.8Missing Authorization to Arbitrary Options Update
Meow Gallery
≤4.1.9Update to 4.2.0
- Medium6.1Reflected Cross-Site Scripting
Easy Social Icons
≤3.1.2Update to 3.1.3
- Medium6.5Contributor+ Arbitrary File Download
Simple Download Monitor
<3.9.5Update to 3.9.5
- Medium6.4Authenticated (admin+) Stored Cross-Site Scripting
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
≤2.1.1.2Update to 2.1.1.3
- Medium6.1Easy Social Icons <= 3.0.8 – Reflected Cross-Site Scripting
Easy Social Icons
≤3.0.8Update to 3.0.9
- Medium6.1Reflected Cross-Site Scripting
XO Event Calendar
≤2.3.6Update to 2.3.7
- Medium5.3Missing Authorization to Sensitive Information Disclosure
Redux Framework
≤4.2.11Update to 4.2.13
- Medium6.4Cross-Site Scripting
Zoho CRM Lead Magnet
≤1.7.2.4Update to 1.7.2.9
- High7.1Incorrect Authorization Leading to Arbitrary Plugin Installation and Post Deletion
Redux Framework
≤4.2.12Update to 4.2.13
- Medium6.1Reflected Cross-Site Scripting
Easy Social Icons
≤3.0.9Update to 3.1.0
- Medium6.1Reflected Cross-Site Scripting
underConstruction
≤1.18Update to 1.19
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
qTranslate X
≤3.4.6.8No patch available
- Medium6.5Stored Cross-Site Scripting
WooCommerce Dynamic Pricing and Discounts
<2.4.2Update to 2.4.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Software License Manager
≤4.4.9Update to 4.5.0
- Medium5.3Unauthenticated Settings Import/Export
WooCommerce Dynamic Pricing and Discounts
<2.4.2Update to 2.4.2
- Medium6.1Reflected Cross-Site Scripting
Geo Controller – Geolocation & Geotargeting
≤7.13.11Update to 7.13.12
- Medium6.1Reflected Cross Site Scripting
User Activity Log
≤1.4.6Update to 1.4.7
- Medium6.1Reflected Cross-Site Scripting
OAuth Single Sign On – SSO (OAuth Client)
≤6.20.2Update to 6.20.3
- Medium5.4Authenticated Stored Cross-Site Scripting
CoolClock
<4.3.5Update to 4.3.5