Database
WordPress Vulnerability Database (page 1287)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤13.0.9Update to 13.1
- Medium6.1Reflected Cross-Site Scripting
Docket Cache – Object Cache Accelerator
≤21.08.01Update to 21.08.02
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA
<2.1.2Update to 2.1.2
- High7.5WordPress Wave Audio Player with Playlist <= 6.45 - Directory Traversal
ZoomSounds - WordPress Wave Audio Player with Playlist
≤6.45Update to 6.50
- Medium6.5Authenticated (Subscriber+) Limited Arbitrary Option Update
Premium Addons for Elementor – AI-Ready Elementor Addons, Widgets & Templates
≤4.5.1Update to 4.5.2
- Medium4.8Authenticated Stored Cross-Site Scripting
TranslatePress – Translate Multilingual sites with AI Translation
<2.0.9Update to 2.0.9
- Medium6.1Reflected Cross-Site Scripting
User Activity Log
≤1.4.6Update to 1.4.7
- Medium4.3Missing Authorization
Countdown Block
<1.1.2Update to 1.1.2
- Medium5.5Duplicate Page <= 4.4.1 Authenticated (Admin+) Stored Cross-Site Scripting
Duplicate Page
≤4.4.1Update to 4.4.2
- Medium5.4Gutenberg Blocks for Post Grid <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Post Grid Gutenberg Blocks – PostX
<2.4.10Update to 2.4.10
- Medium5.4Gutenberg Blocks for Post Grid <= 2.4.9 - Stored Cross-Site Scripting
Post Grid Gutenberg Blocks – PostX
<2.4.10Update to 2.4.10
- Medium4.3Private Content Disclosure
Post Grid Gutenberg Blocks – PostX
≤2.4.9Update to 2.4.10
- Medium6.1Various Plugins (Various Versions) - Reflected Cross-Site Scripting
Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms
≤1.1.9Update to 1.2.0
- Medium5.3Authorization Bypass
Woffice CRM
≤4.0.1Update to 4.0.2
- Medium6.1Reflected Cross-Site Scripting
TS Poll – Survey, Versus Poll, Image Poll, Video Poll
≤1.5.8Update to 1.5.9
- High8.1Cross-Site Request Forgery to Arbitrary Post Deletion and Modification
Nested Pages
≤3.1.15Update to 3.1.16
- Medium6.4Authenticated (Author) Stored Cross-Site Scripting
Real Media Library: Media Library Folder & File Manager
≤4.14.1Update to 4.14.2
- Medium6.1Cross-Site Scripting
WP Zoho for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms – CRM, Bigin
≤1.1.7Update to 1.1.8
- Medium6.1Reflected Cross-Site Scripting
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
≤6.61Update to 6.62
- Medium6.1Reflected Cross-Site Scripting
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
<6.67Update to 6.67
- Medium4.7Open Redirect
Nested Pages
≤3.1.15Update to 3.1.16
- Medium6.1Various Plugins (Various Versions) - Reflected Cross-Site Scripting
MPL-Publisher — Ebook & Audiobook Creator
≤1.29.1Update to 1.29.2
- Medium6.4Contributor+ Cross-Site Scripting
MX Time Zone Clocks
<3.4.1Update to 3.4.1
- Medium5.4Stored Cross-Site Scripting
WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters
<1.2.3Update to 1.2.3
- Critical9.8Authentication Bypass
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools
≤5.4.3Update to 5.4.4
- High7.4Authenticated Stored Cross-Site Scripting
TextMe SMS
<1.8.9Update to 1.8.9
- Medium6.1Reflected Cross-Site Scripting
Database for Contact Form 7, WPforms, Elementor forms
≤1.2.0Update to 1.2.1
- Medium6.1Reflected Cross-Site Scripting
Contact List – Online Staff Directory & Address Book
≤2.9.41Update to 2.9.42
- Medium6.1Reflected Cross-Site Scripting
Live Scores for SportsPress
≤1.9.0Update to 1.9.1
- Medium5.4Authenticated Stored Cross-Site Scripting
Recipe Card Blocks Lite
<2.8.3Update to 2.8.3