Database
WordPress Vulnerability Database (page 1292)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1WP Fusion Lite <= 3.37.18 – Cross-Site Request Forgery to Data Deletion
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
≤3.37.18Update to 3.37.30
- Medium6.1Cross-Site Scripting
ReFlex Gallery » WordPress Photo Gallery
<1.4.3Update to 1.4.3
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Pods – Custom Content Types and Fields
≤2.7.28Update to 2.7.29
- Medium6.1Reflected Cross-Site Scripting
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
<2.4.2Update to 2.4.2
- High8.8Authenticated SQL Injection
WP Simple Booking Calendar
≤2.0.6Update to 2.0.7
- Medium5.4Authenticated Stored Cross-Site Scripting
Free Cookie Notice & Consent Banner for Privacy Compliance (GDPR, CCPA, DSGVO and others)
<1.7.2Update to 1.7.2
- High7.5Missing Capabilities Check to Information Disclosure
Welcart e-Commerce
<2.2.8Update to 2.2.8
- High8.8SQL Injection
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
≤2.4.1Update to 2.4.2
- Medium6.1WP Fusion Lite <= 3.37.18 – Reflected Cross-Site Scripting
WP Fusion Lite – Marketing Automation and CRM Integration for WordPress
≤3.37.18Update to 3.37.30
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Highlight Sitewide Notice, Text, Button Menu
<0.9.3Update to 0.9.3
- Medium4.3Missing Capabilities Check to Information Disclosure
Welcart e-Commerce
<2.2.8Update to 2.2.8
- High8.8Authenticated SQL Injection
Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection
<6.60Update to 6.60
- Medium5.5Stored Cross-Site Scripting
WP Mapa Politico España
<3.7.0Update to 3.7.0
- High7.2Access Restriction Bypass
User Rights Access Manager
≤1.0.7Update to 1.0.8
- High8.8SQL Injection
Availability Calendar
<1.2.1Update to 1.2.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Customize Login
≤1.1No patch available
- Medium5.5Stored Cross-Site Scripting
Availability Calendar
≤1.2.1Update to 1.2.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Business Hours Indicator
<2.3.5Update to 2.3.5
- Medium5.5Authenticated Stored Cross-Site Scripting
Sitewide Notice WP
<2.3Update to 2.3
- Medium6.1Authenticated Stored Cross-Site Scripting
StoryChief
≤1.0.30Update to 1.0.31
- Medium6.1Reflected Cross Site Scripting
Email Encoder – Protect Email Addresses and Phone Numbers
≤2.1.1Update to 2.1.2
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
VDZ Google Analytics or Google Tag Manager / GTM
<1.4.9Update to 1.4.9
- Medium6.4Stored Cross-Site Scripting
VDZ Google Analytics or Google Tag Manager / GTM
≤1.5.5Update to 1.6.0
- High8.8Cross-Site Request Forgery
WP Learn Manager
≤1.1.4Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting via ga_action parameter
ShareThis Dashboard for Google Analytics
<2.5.2Update to 2.5.2
- Medium6.1Cross-Site Scripting
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery
<3.4.7Update to 3.4.7
- High7.5PHP Object Injection
Bold Page Builder
≤3.1.5Update to 3.1.6
- Medium6.1Reflected Cross-Site Scripting
StoryChief
≤1.0.30Update to 1.0.31
- High8.8Cross-Site Request Forgery
Youtube Feeder
≤2.0.1No patch available
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
WP Dialog
≤1.2.5.5No patch available