Database
WordPress Vulnerability Database (page 1291)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Sender by BestWebSoft
≤1.2.0Update to 1.2.1
- High7.5Missing Authorization Checks
WP All Import Pro
<4.1.1Update to 4.1.1
- Medium6.1Reflected Cross-Site Scripting
Variation Swatches for WooCommerce
<1.0.62Update to 1.0.62
- Medium6.1Cross-Site Scripting
Easy Property Listings
≤3.3.3Update to 3.4
- Medium6.1Cross-Site Scripting
OptionTree
≤2.5.5Update to 2.6
- Critical9.8SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<4.0.9Update to 4.0.9
- High8.8Cross-Site Request Forgery
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤5.6Update to 5.6.1
- Medium6.1Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
<4.0.2Update to 4.0.2
- Medium6.1Cross Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤1.3.88Update to 2.0.4
- High8.8Cross-Site Request Forgery
Social Feed Gallery
<2.4.8Update to 2.4.8
- Medium6.1Cross-Site Scripting
Contact Form Email
≤1.2.65Update to 1.2.66
- Critical9.8Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection
GiveWP – Donation Plugin and Fundraising Platform
≤2.5.0Update to 2.5.1
- High8.8Unauthenticated HTML Injection & Cross-Site Request Forgery
cformsII
<15.0.2Update to 15.0.2
- High8.8Cross-Site Request Forgery
Contact Form Email
≤1.2.65Update to 1.2.66
- Medium4.3Directory Traversal
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.4Update to 2.0.4
- Medium6.1Cross Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.3Update to 2.0.4
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Social LikeBox & Feed
≤2.8.4Update to 2.8.5
- High7.2Missing Authorization
Simple 301 Redirects – Addon – Bulk Uploader
<1.2.5Update to 1.2.5
- Medium5.4Authenticated Stored Cross-Site Scripting
PPOM – Product Addons & Custom Fields for WooCommerce
<18.4Update to 18.4
- Medium6.1Missing Authentication on Option Changes
Simple 301 Redirects – Addon – Bulk Uploader
<1.2.5Update to 1.2.5
- High7.5Arbitrary Post Deletion
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
≤2.2.5Update to 2.2.6
- Critical9.8Options Change
Restaurant Reservations
≤1.3Update to 1.5
- Critical9.8PHP Object Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<4.02.01Update to 4.02.01
- High8.8Cross-Site Request Forgery to Remote Code Execution
WP SVG Icons
<3.2.3Update to 3.2.3
- High8.8< 2.3 - Cross-Site Request Forgery
Pricing Table Plugin
<2.3Update to 2.3
- Medium6.1Unauthenticated Settings Update
Login or Logout Menu Item
<1.2.0Update to 1.2.0
- Critical9.8SQL Injection
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤3.44Update to 3.45
- Medium6.1Open Redirect
Learning Courses
≤4.7Update to 4.8
- Critical9.6Unauthenticated Arbitrary Options Update
Hotel Booking
<2.5Update to 2.5
- High8.2Unauthenticated Arbitrary Options Change
Donations
<1.4Update to 1.4