Database
WordPress Vulnerability Database (page 1300)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.3User Enumeration
WP JobHunt
<2.4Update to 2.4
- High8.8Unauthenticated Arbitrary Password Reset
WP JobHunt
<2.4Update to 2.4
- Medium4.7Authenticated Open Redirect
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.19Update to 3.3.19.1
- Critical9.8Improper Access Control
User Email Verification for WooCommerce
≤3.1.15Update to 3.2.0
- Medium6.1Stored Cross-Site Scripting
Easy Testimonials
<3.6Update to 3.6
- Critical9.8PHP Object Injection
Patreon WordPress
<1.2.2Update to 1.2.2
- Medium5.4Stored Cross-Site Scripting
AMP for WP – Accelerated Mobile Pages
≤0.9.97.20Update to 0.9.97.21
- Medium6.1Cross-Site Scripting via begin_date, end_date, or form_id Parameter
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.3.18Update to 3.3.18
- Medium5.4Authenticated Stored Cross-Site Scripting
Master Slider – Responsive Touch Slider
≤3.7.0Update to 3.7.5
- High8.8Cross-Site Request Forgery
Read and Understood
<2.2Update to 2.2
- Medium5.4Stored Cross-Site Scripting
Easy Custom Auto Excerpt
<2.4.7Update to 2.4.7
- High7.5Directory Traversal
Media from FTP
<9.85Update to 9.85
- Medium5.4Stored Cross-Site Scripting
Custom Product Tabs for WooCommerce & WordPress Tabs Builder – Smart Tabs
≤1.8.0Update to 2.0.0
- High8.8Cross-Site Request Forgery
Weblizar Pin Feeds
<1.1.2Update to 1.1.2
- Medium6.1Cross-Site Scripting
Weblizar Pin Feeds
<1.1.2Update to 1.1.2
- Critical9.8SQL Injection
BuddyForms
≤2.2.7Update to 2.2.8
- High7.2Authenticated SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.0.12Update to 3.1.0
- Medium6.1Open Redirect
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.0.12Update to 3.1.0
- Medium6.1Cross-Site Scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.0.12Update to 3.1.0
- Critical9.8Arbitrary Options Update and Action Calling
Cookie Information | Free GDPR Consent Solution
<1.4.3Update to 1.4.3
- Critical9.8SQL Injection
RSVPMaker
<5.6.4Update to 5.6.4
- High7.2WooCommerce File Deletion
WooCommerce
<3.4.6Update to 3.4.6
- Medium6.6Race Condition to Remote Code Execution
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤9.1.0Update to 9.2.0
- Medium6.1Reflected Cross-Site Scripting
Media File Manager
≤1.4.2Update to 1.4.3
- Medium5.4Cross-Site Scripting
Event Calendar WD version
≤1.1.21Update to 1.1.22
- Medium4.8Cross-Site Scripting
WP Editor.md – The Perfect WordPress Markdown Editor
<10.0.4Update to 10.0.4
- Critical9.8Arbitrary File Upload
GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership
≤1.4.13Update to 1.4.14
- Medium5.4Authenticated Stored Cross-Site Scripting
Calendar
<1.3.11Update to 1.3.11
- Medium6.1Cross-Site Scripting
Elementor Website Builder Pro
<2.0.10Update to 2.0.10
- Critical9.8Arbitrary File Upload
Arigato Autoresponder and Newsletter
all versionsNo patch available