Database
WordPress Vulnerability Database (page 1297)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤5.1.1Update to 5.1.2
- Medium6.4Authenticated Stored Cross-Site Scripting
CarSpot – Dealership Wordpress Classified Theme
<2.1.7Update to 2.1.7
- Critical9.8Arbitrary File Upload
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
<2.0.1Update to 2.0.1
- Medium6.1Reflected Cross-Site Scripting via URL parameter
MailPoet – Newsletters, Email Marketing, and Automation
<3.23.2Update to 3.23.2
- High8.1PHP Object Injection
OptionTree
≤2.6.0Update to 2.7.0
- Medium6.1Cross-Site Scripting
Download Manager
<2.9.94Update to 2.9.94
- Critical9.6Cross-Site Request Forgery to Cross-Site Scripting via Comments
WordPress
≤5.1Update to 3.7.29 or 3.8.29 or 3.9.27 or 4.0.26 or 4.1.26 or 4.2.23 or 4.3.19 or 4.4.18 or 4.5.17 or 4.6.14 or 4.7.13 or 4.8.9 or 4.9.10 or 5.0.4 or 5.1.1
- High8.1File Uploads <= 3.0.22 - Unauthenticated Arbitrary File Upload
Ninja Forms - File Uploads
<3.0.23Update to 3.0.23
- Critical9.8Unauthenticated Arbitrary Options Update
Visual CSS Style Editor
<7.2.1Update to 7.2.1
- High7.2Missing Authorization to Stored Cross-Site Scripting
YUZO
<5.12.94Update to 5.12.94
- Medium6.1Referer Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.6.3Update to 12.6.4
- High8.8Remote Code Execution
Groundhogg — CRM, Newsletters, and Marketing Automation
<1.3.5Update to 1.3.5
- High7.3Missing Authorization and No Direct File Access Restrictions
ARI Adminer – WordPress Database Manager
≤1.1.14Update to 1.1.15
- High8.8Cross-Site Request Forgery
Contact Form by WD – responsive drag & drop contact form builder tool
<1.13.5Update to 1.13.5
- High8.1Cross-Site Request Forgery to Local File Inclusion
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.13.4Update to 1.13.5
- High8.8Cross-Site Request Forgery
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.40Update to 2.0.40
- High7.5Denial of Service
article2pdf
≤0.27No patch available
- Medium4.3Insufficient Restrictions on Option Changes
Easy Updates Manager
≤8.0.4Update to 8.0.5
- Critical9.10.27 - Information Disclosure
article2pdf
≤0.27No patch available
- High7.2VulnCrest analysisKEVPoCUnauthenticated Arbitrary Settings Update
Social Sharing Plugin – Social Warfare
<3.5.3Update to 3.5.3
- Medium6.1Reflected Cross-Site Scripting
Font Organizer
≤2.1.1No patch available
- High7.5Sensitive Information Disclosure
WP Human Resource Management
<2.2.6Update to 2.2.6
- Critical9.8Missing Authorization to Arbitrary Options Update
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more
<1.3.9.1Update to 1.3.9.1
- Medium6.1Cross-Site Scripting
Import and export users and customers
<1.14.0.3Update to 1.14.0.3
- Critical9.8Missing Authorization
Speed Optimizer – The All-In-One Performance-Boosting Plugin
<5.0.13Update to 5.0.13
- High8.8Cross-Site Request Forgery
Import and export users and customers
<1.14.0.3Update to 1.14.0.3
- Critical9.8Local File Inclusion
GraceMedia Media Player
≤1.0No patch available
- Medium6.1Stored Cross-Site Scripting
WooCommerce Subscription
<2.6.3Update to 2.6.3
- High7.2Stored Cross-Site Scripting
Abandoned Cart Lite for WooCommerce
<5.2.0Update to 5.2.0
- Critical9.8Remote Code Execution via unrestricted file upload
wp-live-chat-support-pro
≤8.0.06Update to 8.0.07