Database
WordPress Vulnerability Database (page 1305)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Simple Giveaways – Grow your business, email lists and traffic with contests
<2.36.1Update to 2.36.2
- High7.5Authorization Bypass
Wishlist and Compare for WooCommerce
≤1.0.4Update to 1.0.5
- Medium6.1Reflected Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.1.20Update to 2.1.20
- Medium5.5Stored Cross-Site Scripting
Autoptimize
<2.8.4Update to 2.8.4
- Medium6.1Unauthenticated Stored Cross-Site Scripting
DSGVO All in one for WP
≤3.9Update to 4.0
- Medium5.3Unauthenticated Arbitrary License Change
Leads5050 Visitor Insights
<1.0.4Update to 1.0.4
- Critical9.8PHP Object Injection
UltimateWoo – The Ultimate WooCommerce Plugin with Unlimited Usage
≤0.1.10No patch available
- Medium4.3Authorization Bypass
Leads5050 Visitor Insights
≤1.0.5Update to 1.1.0
- High7.3Missing Authorization
Product Filter for WooCommerce by WBW
≤1.4.9Update to 1.5.0
- Medium6.1Reflected Cross-Site Scripting
Product Slider, Product Grid, Product Masonry
≤1.13.21Update to 1.13.22
- Medium6.4Authenticated Stored Cross-Site Scripting
Hana Flv Player
≤3.1.3No patch available
- High8.8Cross-Site Request Forgery
Zlick Paywall
<2.2.2Update to 2.2.2
- High8.8Authenticated (Contributor+) Privilege Escalation
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤4.6.4Update to 4.6.5
- Medium4.3Authorization Bypass
Simple Admin Language Change
≤2.0.1Update to 2.0.2
- Medium6.3Missing Authorization
Essential Addons for Elementor – Popular Elementor Templates & Widgets
≤4.6.4Update to 4.6.5
- High8.8Cross-Site Request Forgery
Parcel Tracker eCourier
≤1.0.1Update to 1.0.2
- Medium6.1Stored Cross-Site Scripting
Watcheezy Live chat plugin for WordPress
≤2.0Update to 3.0
- High8.8Cross-Site Request Forgery
Ship To eCourier
≤1.0.1Update to 1.0.2
- Medium6.1Tour & Travel WordPress Theme < 2.1 - Reflected Cross-Site Scripting
Goto - Tour & Travel WordPress Theme
<2.1Update to 2.1
- Medium6.1Reflected Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.10.3Update to 2.10.4
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Hotjar Connecticator
≤1.1.1No patch available
- Medium4.8Authenticated Stored Cross-Site Scripting
WP Customer Reviews
≤3.5.5Update to 3.5.6
- High8.82.6.1 - SQL Injection
Activity Log – Monitor User and Agent Changes
2.3.5 – 2.6.1Update to 2.7.0
- Low3.8Authenticated (Admin+) Cross-Site Scripting
WP YouTube Lyte
<1.7.16Update to 1.7.16
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
WP DoNotTrack
≤0.8.8No patch available
- Medium4.8Authenticated Stored Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.10.4Update to 2.10.4
- High8.8Cross-Site Request Forgery
Download Manager
<3.1.22Update to 3.1.22
- Medium6.3Arbitrary Asset Manager Usage
Download Manager
<3.1.23Update to 3.1.23
- High8.8Arbitrary File Upload
Download Manager
<3.1.19Update to 3.1.19
- Medium6.1Reflected Cross-Site Scripting
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
<4.21.1Update to 4.21.1