Database
WordPress Vulnerability Database (page 1293)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Nifty Newsletters <= 4.0.23 – Cross-Site Request Forgery to Stored Cross-Site Scripting
Nifty Newsletters (Formerly Sola Newsletters)
≤4.0.23No patch available
- High8.8SQL Injection
ZhuiGe Official Website Mini Program
<1.1.1Update to 1.1.1
- Medium5.5Stored Cross-Site Scripting
youForms for WordPress – Creating Forms for CopeCart
≤1.0.5Update to 1.0.6
- Medium6.4Authenticated Stored Cross-Site Scripting
有赏 You Shang
≤1.0.1No patch available
- Medium5.5Stored Cross-Site Scripting
Splash Header
<1.20.8Update to 1.20.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
FluentSMTP – WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP
<2.0.1Update to 2.0.1
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Alojapro Booking Engine
≤1.1.15Update to 1.1.16
- High7.5Authenticated File Upload
Download Manager
≤3.1.24Update to 3.1.25
- Medium6.5Cross-Site Scripting
Download Manager
≤3.1.24Update to 3.1.25
- High8.8Subscriber+ Arbitrary File Upload
SP Project & Document Manager
<4.24Update to 4.24
- Critical9.8Privilege Escalation
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium4.3Cross-Site Request Forgery leading to Settings Change
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium6.5Cross-Site Request Forgery
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium5.4Cross-Site Request Forgery
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- Medium6.1Reflected Cross-Site Scripting
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- High8.8add sticky fixed buttons < 2.2.6 - SQL Injection
Side Menu Lite – Sticky Floating Side Menu
<2.2.6Update to 2.2.6
- Medium6.1Reflected Cross-Site Scripting
Favicon by RealFaviconGenerator
<1.3.21Update to 1.3.21
- High8.8Cross-Site Request Forgery
Blue Admin
≤21.06.01No patch available
- High7.1Authenticated Insecure Direct Object References (IDOR)
Directory Listings WordPress plugin – uListing
≤2.0.5Update to 2.0.6
- High8.8Cross-Site Request Forgery
SEO Backlinks
≤4.0.1No patch available
- High8.8Admin Custom Login <= 3.2.7 – Cross-Site Request Forgery to Stored Cross-Site Scripting
Admin Custom Login
≤3.2.7Update to 3.2.8
- Medium5.4Stored Cross-Site Scripting
HD Quiz
<1.8.4Update to 1.8.4
- Medium4.8Authenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.12.0Update to 2.12.0
- Critical9.9Authenticated WordPress Options Change
Advanced Shipment Tracking for WooCommerce
≤3.2.6Update to 3.2.7
- Medium6.1Poll Maker <= 3.2.8 – Reflected Cross-Site Scripting
Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls
≤3.2.8Update to 3.2.9
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
LukasApps CAPTCHA tools for Contact Form 7
<0.0.9Update to 0.0.9
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website
≤2.10.3Update to 2.10.4
- Medium5.5Authenticated Stored Cross-Site Scripting
WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS
<5.4.13Update to 5.4.13
- Medium5.4Authenticated Stored Cross-Site Scripting
WPFront Scroll Top
≤2.0.5Update to 2.0.6
- Medium6.4Cross-Site Scripting
Qyrr – simply and modern QR-Code creation
≤0.7Update to 0.8