Database
WordPress Vulnerability Database (page 1300)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Bookshelf
≤2.0.4No patch available
- Medium6.1Reflected Cross-site Scripting via id Parameter
Awesome Weather Widget
≤3.0.2No patch available
- Medium4.3Authenticated Insecure Direct Object Reference
User Profile Picture – Custom Local Avatars
<2.6.0Update to 2.6.0
- Medium6.1Reflected Cross-Site Scripting
Post Grid
≤2.1.7Update to 2.1.8
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Any Hostname
≤1.0.6No patch available
- Medium5.5Authenticated Stored Cross-Site Scripting
ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content
<3.1.8Update to 3.1.8
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Migrate Users
≤1.0.1No patch available
- High7.2Reflected Cross-Site Scripting via extension
W3 Total Cache
0.5 – 2.1.4Update to 2.1.5
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
DrawBlog
≤0.90No patch available
- Critical9.8Server-Side Request Forgery & Remote File Inclusion
Onair2: Radio Station WordPress Theme With Non-Stop Music Player
<3.9.9.2Update to 3.9.9.2
- Medium6.4Contributor+ Stored Cross-Site Scripting
YouTube Embed, Playlist and Popup by WpDevArt
<2.3.9Update to 2.3.9
- Medium6.1Reflected Cross-Site Scripting via extension
W3 Total Cache
<2.1.4Update to 2.1.4
- Medium6.4Stored Cross-Site Scripting
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
≤1.0.6Update to 1.0.7
- Medium6.4Authenticated Stored Cross-Site Scripting
Steam Group Viewer
≤2.1No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Event Geek
≤2.5.2No patch available
- Medium4.7Cross-Site Scripting
Event Calendar WD version
≤1.1.45Update to 1.1.46
- Medium6.4Cross-Site Scripting
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
<2.5.10Update to 2.5.10
- Medium6.1Reflected Cross-Site Scripting
event-espresso-core
≤4.10.6.pUpdate to 4.10.7.p
- Critical9.8Unauthenticated Arbitrary File Upload
ZoomSounds - WordPress Wave Audio Player with Playlist
≤5.96Update to 6.05
- Medium6.4Authenticated Cross-Site Scripting
WP Popular Posts
<5.3.3Update to 5.3.3
- Medium5.3Local File Inclusion
WP Image Zoom
≤1.46Update to 1.47.1
- Critical9.8Unauthenticated Blind SQL Injection
Poll, Survey, Questionnaire and Voting system
<1.5.3Update to 1.5.3
- High7.1Cross-Site Scripting
Fudousan Plugin
≤5.7.0No patch available
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
CiviCRM for WordPress
≤5.28.0Update to 5.28.1
- Medium4.3Cross-Site Request Forgery Bypass
Staff Directory Plugin: Company Directory
≤3.6Update to 4.0
- Medium4.8Authenticated Stored Cross-Site Scripting
My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu)
<2.5.2Update to 2.5.2
- High7.2Authenticated (Admin+) SQL Injection
Export Users With Meta
<0.6.5Update to 0.6.5
- Medium5.4Admin Columns Free < 4.3.2 and Pro < 5.5.2 Authenticated Stored Cross-Site Scripting
Admin Columns
<4.3.2Update to 4.3.2
- Medium4.8Stored Cross-Site Scripting
Sign-up Sheets
<1.0.14Update to 1.0.14
- Medium4.3Cross-Site Request Forgery Bypass
Absolute Reviews
≤1.0.8Update to 1.0.9