Database
WordPress Vulnerability Database (page 1295)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.8Authenticated Stored Cross-Site Scripting
Maintenance
<4.03Update to 4.03
- Medium6.4Authenticated Cross-Site Scripting
Translate WordPress – Google Language Translator
<6.0.10Update to 6.0.10
- High7.2Authenticated (Admin+) SQL Injection
Giveaway
≤1.2.2No patch available
- Medium5.4Stored Cross-Site Scripting
KN Fix Your Title
≤1.0.1No patch available
- High8.8Privilege Escalation via Arbitrary Role Change
HM Multiple Roles
≤1.2Update to 1.3
- Medium6.5Cross-Site Request Forgery
Addon Elements for Elementor (formerly Elementor Addon Elements)
≤1.11.7Update to 1.11.8
- Medium6.1Reflected Cross-Site Scripting
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
≤2.19.1Update to 2.19.2
- High7.3Missing Authorization to Stored Cross-Site Scripting
WP SEO TDK
≤2.1.2No patch available
- Medium5.4Missing Authorization
RestroPress – Online Food Ordering System
≤2.8.3Update to 2.8.3.1
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Social Tape
≤1.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
My Site Audit
≤1.2.4Update to 1.2.5
- Medium6.1Authenticated (Admin+) Cross-Site Scripting
Light Messages
≤1.0No patch available
- High8.8SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.2.6.7Update to 3.2.6.8
- Medium6.4Contributor+ Stored Cross-Site Scripting
Wonder PDF Embed
≤1.6Update to 1.7
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
Mimetic Books
≤0.2.13No patch available
- Medium6.4Contributor+ Stored Cross-Site Scripting
Embeds for YouTube
≤5.2.1Update to 5.2.2
- Medium6.4Stored Cross-Site Scripting via Uploaded SVG
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.78Update to 1.5.79
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Verse-O-Matic
≤4.1.1No patch available
- Medium4.3Cross-Site Request Forgery
Shantz WordPress QOTD
≤1.2.2No patch available
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Custom Login Redirect
≤1.0.0No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Wonder Video Embed
≤1.7Update to 1.8
- Medium6.4Cross-Site Scripting
PhoneTrack Meu Site Manager
≤0.1Update to 0.1.1
- Critical9.8Admin Access via Password Reset
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<3.4.9Update to 3.4.9
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
తెలుగు బైబిల్ వచనములు
≤1.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
VikRentCar Car Rental Management System
<1.1.10Update to 1.1.10
- High8.8Cross-Site Request Forgery to Cart Manipulation
RestroPress – Online Food Ordering System
≤2.8.2Update to 2.8.3
- Medium4.3NEX-Forms <= 7.8.7 Authorization Bypass
NEX-Forms – Ultimate Forms Plugin for WordPress
≤7.8.7Update to 7.8.8
- Medium6.1Stored Cross-Site Scripting via Uploaded SVG
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.75Update to 1.5.75
- Medium4.9File Upload Path Traversal
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.75Update to 1.5.75
- Medium5.5Stored Cross-Site Scripting
VDZ VERIFICATION (Custom Meta Tags)
≤1.3.12Update to 1.4