Database
WordPress Vulnerability Database (page 1296)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery Bypass
WordPress Photo Gallery – Image Gallery
≤1.0.6No patch available
- Medium5.4Authenticated Stored Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.13.59Update to 1.13.60
- Medium6.4Authenticated Stored Cross-Site Scripting
Current Book
≤1.0.1No patch available
- Medium6.1Cross-Site Scripting
Webcam Microphone Screen Recorder – Media Capture
<3.2.4Update to 3.2.4
- High8.8Cross-Site Request Forgery
MDTF – Meta Data and Taxonomies Filter
<2.2.8Update to 2.2.8
- High7.2Unauthenticated Stored Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.14.12Update to 1.14.12
- High8.8Authenticated Blind SQL Injection
WooCommerce
≤5.5Update to 3.3.6 or 3.4.8 or 3.5.9 or 3.6.6 or 3.7.2 or 3.8.2 or 3.9.4 or 4.0.2 or 4.1.2 or 4.2.3 or 4.3.4 or 4.4.2 or 4.5.3 or 4.6.3 or 4.7.2 or 4.8.1 or 4.9.3 or 5.0.1 or 5.1.1 or 5.2.3 or 5.3.1 or 5.4.2 or 5.5.1 or 5.5.2
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Remove Footer Credit
≤1.0.5Update to 1.0.6
- Medium5.8Unauthenticated Post Meta Change
Frontend File Manager Plugin
<18.3Update to 18.3
- High7.2Unauthenticated HTML Injection leading to Spam Emails
Frontend File Manager Plugin
<18.3Update to 18.3
- High8.8Cross-Site Request Forgery
WowRestro – Restaurant Ordering & Operations for WooCommerce
≤1.0Update to 1.1
- High7.2Authenticated (Admin+) Local File Inclusion
UpdraftPlus Premium
≤1.16.56Update to 1.16.59
- High8.8Cross-Site Request Forgery to Menu Edition
Advanced Menu Manager Pro – Built for Content-heavy WordPress Sites to Add, Filter, Lock, and Edit Menus Easily
≤2.9.6Update to 3.0
- Medium6.4Privilege Escalation
Frontend File Manager Plugin
<18.3Update to 18.3
- Medium5.8Unauthenticated Content Injection
Frontend File Manager Plugin
<18.3Update to 18.3
- Critical9.9Authenticated Settings Change leading to Arbitrary File Upload
Frontend File Manager Plugin
<18.3Update to 18.3
- Medium5.4Authenticated (Subscriber+) Menu Creation/Deletion
Advanced Menu Manager Pro – Built for Content-heavy WordPress Sites to Add, Filter, Lock, and Edit Menus Easily
≤3.0.6Update to 3.0.7
- Medium6.1Reflected Cross-Site Scripting
Wr Age Verification
≤1.0.0Update to 2.0.0
- High7.2Unauthenticated Stored Cross-Site Scripting
Frontend File Manager Plugin
<18.3Update to 18.3
- Medium5.4Contributor+ Stored Cross-Site Scripting
Page View Count
≤2.4.8Update to 2.4.9
- Critical9.0Unauthenticated Arbitrary File Download
Frontend File Manager Plugin
<18.3Update to 18.3
- Medium6.1Reflected Cross-Site Scripting
NewsMag
<5.0Update to 5.0
- Medium6.5Unauthenticated Arbitrary Post Deletion
Frontend File Manager Plugin
<18.3Update to 18.3
- Medium4.8Authenticated Stored Cross-Site Scripting
WPFront Notification Bar
≤1.9.2Update to 2.0.0
- Medium6.1Cross-Site Scripting
VDZ CallBack Plugin
<1.14.6Update to 1.14.6
- High8.8Cross-Site Request Forgery
Software License Manager
<4.4.6Update to 4.4.6
- Medium6.1Reflected Cross-Site Scripting
Hubbub Lite – Fast, free social sharing and follow buttons
≤1.18.2Update to 1.19.0
- Critical9.8Unauthenticated SQL Injection
Astra Pro Addon
<3.5.2Update to 3.5.2
- Medium6.4WP Upload Restriction <= 2.2.4 – Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Upload Restriction
≤2.2.4Update to 2.2.5
- High8.8Cross-site request forgery
WPCS – WordPress Currency Switcher Professional
≤1.1.6Update to 1.1.7