Database
WordPress Vulnerability Database (page 1303)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
| Severity | Vulnerability | CVE | Installs | Published |
|---|---|---|---|---|
| Medium6.1 | Reflected Cross-Site Scripting | — | — | |
| Critical9.8 | Unauthenticated Arbitrary File Upload | CVE-2021-24370 | — | |
| Medium5.5 | Cross-Site Scripting | — | — | |
| Medium5.3 | Information Disclosure Jetpack – AI Agents & MCP, Security, Backup & Analytics<9.7.1Update to 2.0.8 or 2.1.6 or 2.2.9 or 2.3.9 or 2.4.6 or 2.5.4 or 2.6.5 or 2.7.4 or 2.8.4 or 2.9.5 or 3.0.5 or 3.1.4 or 3.2.4 or 3.3.5 or 3.4.5 or 3.5.5 or 3.6.3 or 3.7.4 or 3.8.4 or 3.9.8 or 4.0.5 or 4.1.2 or 4.2.3 or 4.3.3 or 4.4.3 or 4.5.1 or 4.6.1 or 4.7.2 or 4.8.3 or 4.9.1 or 5.0.1 or 5.1.2 or 5.2.3 or 5.3.2 or 5.4.2 or 5.5.3 or 5.6.3 or 5.7.3 or 5.8.2 or 5.9.2 or 6.0.2 or 6.1.3 or 6.2.3 or 6.3.5 or 6.4.4 or 6.5.2 or 6.6.3 or 6.7.2 or 6.8.3 or 6.9.2 or 7.0.3 or 7.1.3 or 7.2.3 or 7.3.3 or 7.4.3 or 7.5.5 or 7.6.2 or 7.7.4 or 7.8.2 or 7.9.2 or 8.0.1 or 8.1.2 or 8.2.4 or 8.3.1 or 8.4.3 or 8.5.1 or 8.6.2 or 8.7.2 or 8.8.3 or 8.9.2 or 9.0.3 or 9.1.1 or 9.2.2 or 9.3.3 or 9.4.2 or 9.5.3 or 9.6.2 or 9.7.1 | CVE-2021-24374 | — | |
| Medium6.4 | Stored Cross-Site Scripting | CVE-2021-24357 | — | |
| Medium5.4 | Admin Columns Free < 4.3 and Pro < 5.5.1 Stored Cross-Site Scripting | CVE-2021-24366 | — | |
| High7.2 | Cross-Site Scripting | — | — | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2021-24367 | — | |
| Medium6.5 | Authenticated SQL Injection | CVE-2021-24360 | — | |
| Medium5.3 | Open Redirect | CVE-2021-24359 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-24351 | — | |
| Medium6.1 | Open Redirect | CVE-2021-24358 | — | |
| Medium6.6 | Authenticated PHAR Deserialization | CVE-2021-4451 | — | |
| High7.2 | SQL Injection | CVE-2021-24348 | — | |
| High8.8 | SQL Injection | CVE-2021-24341 | — | |
| Medium5.4 | Reflected Cross-Site Scripting | CVE-2021-24346 | — | |
| Medium6.6 | Authenticated (Admin+) SQL Injection | CVE-2021-24345 | — | |
| High8.8 | 2.0.3 - Unauthenticated Redirect Import | CVE-2021-24353 | — | |
| Medium4.3 | 2.0.3 - Authenticated Wildcard Activation and Retrieval | CVE-2021-24355 | — | |
| Critical9.8 | Arbitrary File Upload | — | — | |
| Medium4.3 | Insecure Direct Object Reference | — | — | |
| Medium5.5 | Authenticated Stored Cross-Site Scripting via extra_data Parameter | CVE-2021-24424 | — | |
| High8.8 | 2.0.3 - Authenticated Arbitrary Plugin Installation | CVE-2021-24354 | — | |
| High8.8 | 2.0.3 - Unauthenticated Redirect Export | CVE-2021-24352 | — | |
| High8.8 | 2.0.3 - Authenticated Arbitrary Plugin Activation | CVE-2021-24356 | — | |
| Medium6.1 | Reflected Cross-Site Scripting | CVE-2021-24349 | — | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting | CVE-2021-24350 | — | |
| High8.8 | Authenticated Shell Upload | CVE-2021-24347 | — | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2021-24344 | — | |
| Medium5.5 | Authenticated (Admin+) Stored Cross-Site Scripting | CVE-2021-47957 | — |
- Medium6.1Reflected Cross-Site Scripting
Bitcoin Payments – Blockonomics
<3.3Update to 3.3
- Critical9.8Unauthenticated Arbitrary File Upload
Fancy Product Designer
<4.6.9Update to 4.6.9
- Medium5.5Cross-Site Scripting
All 404 Redirect to Homepage
≤2.0Update to 2.1
- Medium5.3Information Disclosure
Jetpack – AI Agents & MCP, Security, Backup & Analytics
<9.7.1Update to 2.0.8 or 2.1.6 or 2.2.9 or 2.3.9 or 2.4.6 or 2.5.4 or 2.6.5 or 2.7.4 or 2.8.4 or 2.9.5 or 3.0.5 or 3.1.4 or 3.2.4 or 3.3.5 or 3.4.5 or 3.5.5 or 3.6.3 or 3.7.4 or 3.8.4 or 3.9.8 or 4.0.5 or 4.1.2 or 4.2.3 or 4.3.3 or 4.4.3 or 4.5.1 or 4.6.1 or 4.7.2 or 4.8.3 or 4.9.1 or 5.0.1 or 5.1.2 or 5.2.3 or 5.3.2 or 5.4.2 or 5.5.3 or 5.6.3 or 5.7.3 or 5.8.2 or 5.9.2 or 6.0.2 or 6.1.3 or 6.2.3 or 6.3.5 or 6.4.4 or 6.5.2 or 6.6.3 or 6.7.2 or 6.8.3 or 6.9.2 or 7.0.3 or 7.1.3 or 7.2.3 or 7.3.3 or 7.4.3 or 7.5.5 or 7.6.2 or 7.7.4 or 7.8.2 or 7.9.2 or 8.0.1 or 8.1.2 or 8.2.4 or 8.3.1 or 8.4.3 or 8.5.1 or 8.6.2 or 8.7.2 or 8.8.3 or 8.9.2 or 9.0.3 or 9.1.1 or 9.2.2 or 9.3.3 or 9.4.2 or 9.5.3 or 9.6.2 or 9.7.1
- Medium6.4Stored Cross-Site Scripting
FooGallery Photo Gallery : Image, Video & Masonry Galleries
<2.0.35Update to 2.0.35
- Medium5.4Admin Columns Free < 4.3 and Pro < 5.5.1 Stored Cross-Site Scripting
Admin Columns
≤4.2Update to 4.3
- High7.2Cross-Site Scripting
Event Calendar WD version
<1.1.45Update to 1.1.45
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP Config File Editor
≤1.7.1No patch available
- Medium6.5Authenticated SQL Injection
Yes/No Chart
<1.0.12Update to 1.0.12
- Medium5.3Open Redirect
The Plus Addons for Elementor Page Builder Pro
<4.1.11Update to 4.1.11
- Medium6.1Reflected Cross-Site Scripting
The Plus Addons for Elementor Page Builder Pro
<4.1.12Update to 4.1.12
- Medium6.1Open Redirect
The Plus Addons for Elementor Page Builder Pro
<4.1.10Update to 4.1.10
- Medium6.6Authenticated PHAR Deserialization
NinjaFirewall (WP Edition) – Advanced Security Plugin and Firewall
<4.3.4Update to 4.3.4
- High7.2SQL Injection
Side Menu – add fixed side buttons
≤3.1.3Update to 3.1.5
- High8.8SQL Injection
Xllentech English Islamic Calendar
≤2.6.7Update to 2.6.8
- Medium5.4Reflected Cross-Site Scripting
Stock in & out
≤1.0.4No patch available
- Medium6.6Authenticated (Admin+) SQL Injection
Sendit WP Newsletter
≤2.5.1No patch available
- High8.82.0.3 - Unauthenticated Redirect Import
Simple 301 Redirects by BetterLinks – Easy Redirect Manager
2.0.0 – 2.0.3Update to 2.0.4
- Medium4.32.0.3 - Authenticated Wildcard Activation and Retrieval
Simple 301 Redirects by BetterLinks – Easy Redirect Manager
2.0.0 – 2.0.3Update to 2.0.4
- Critical9.8Arbitrary File Upload
Gallery from files
≤1.60No patch available
- Medium4.3Insecure Direct Object Reference
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
≤3.7.3Update to 3.7.4
- Medium5.5Authenticated Stored Cross-Site Scripting via extra_data Parameter
WP Reset
≤1.86Update to 1.90
- High8.82.0.3 - Authenticated Arbitrary Plugin Installation
Simple 301 Redirects by BetterLinks – Easy Redirect Manager
2.0.0 – 2.0.3Update to 2.0.4
- High8.82.0.3 - Unauthenticated Redirect Export
Simple 301 Redirects by BetterLinks – Easy Redirect Manager
2.0.0 – 2.0.3Update to 2.0.4
- High8.82.0.3 - Authenticated Arbitrary Plugin Activation
Simple 301 Redirects by BetterLinks – Easy Redirect Manager
2.0.0 – 2.0.3Update to 2.0.4
- Medium6.1Reflected Cross-Site Scripting
Gallery from files
≤1.60No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Visitors
≤0.3No patch available
- High8.8Authenticated Shell Upload
SP Project & Document Manager
<4.22Update to 4.22
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Easy Preloader
≤1.0.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Cookie Law Bar
≤1.2.1No patch available