Database
WordPress Vulnerability Database (page 1306)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
<4.21.1Update to 4.21.1
- Medium6.1Open Redirect
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
<7.5.0Update to 7.5.0
- Medium5.3Denial of Service
WPGraphQL
≤1.3.5Update to 1.3.6
- Medium6.5Authenticated (Admin+) Directory Traversal to Arbitrary File Deletion
WP Fastest Cache – WordPress Cache Plugin
<0.9.1.7Update to 0.9.1.7
- Critical9.8Tour & Travel WordPress Theme < 2.1 - SQL Injection
Goto - Tour & Travel WordPress Theme
<2.1Update to 2.1
- Medium6.4Stored Cross-Site Scripting
Happy Addons for Elementor Pro
<1.17.0Update to 1.17.0
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Store Locator Plus® for WordPress
≤5.12.3Update to 5.13.8
- High8.8Authenticated Privilege Escalation
Store Locator Plus® for WordPress
≤5.5.15Update to 5.7
- Critical9.8Auto Classifieds Script <= 2.1.0 - Unauthenticated SQL Injection
Car Seller – Auto Classifieds Script
≤2.1.0No patch available
- Medium4.8Cross-Site Scripting
Smooth Page Scroll Up/Down Buttons
≤1.3Update to 1.4
- Medium4.8Admin+ Stored Cross-Site Scripting
Smooth Page Scroll Up/Down Buttons
≤1.3Update to 1.4
- Medium6.1Reflected Cross-Site Scripting
Redirect 404 to parent
<1.3.1Update to 1.3.1
- Medium5.3Arbitrary Options Update
Thrive Leads
<2.3.9.4Update to 2.3.9.4
- Medium6.1Reflected Cross-Site Scripting
Select All Categories and Taxonomies, Change Checkbox to Radio Buttons
<1.3.2Update to 1.3.2
- Medium5.5Admin+ Stored Cross-Site Scripting
RSS for Yandex Turbo
≤1.30Update to 1.31
- High8.8Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation
Limit Login Attempts (Spam Protection)
≤2.9Update to 3.1
- High8.8Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation
WP Maintenance Mode & Site Under Construction
≤1.8.2Update to 1.9
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
WP Maintenance Mode & Site Under Construction
<1.8.2Update to 1.8.2
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Captchinoo, admin login page protection with Google recaptcha
≤2.3Update to 2.4
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Tree Sitemap (Pages, Posts & Categories list)
<2.9Update to 2.9
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
WP Content Copy Protection & No Right Click
<3.1.5Update to 3.1.5
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Limit Login Attempts (Spam Protection)
<2.9Update to 2.9
- High8.8Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation
Visitor Traffic Real Time Statistics
≤2.13Update to 3.1
- High8.8Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation
Login as User or Customer — User Switching
≤1.9Update to 2.1
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Login as User or Customer — User Switching
<1.8Update to 1.8
- High8.8Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation
Tree Sitemap (Pages, Posts & Categories list)
≤2.9Update to 3.1
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
Visitor Traffic Real Time Statistics
≤2.11Update to 2.12
- High8.8Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation
WP Content Copy Protection & No Right Click
≤3.3Update to 3.4
- High8.8Improper Authorization
WP Maintenance Mode & Site Under Construction
<1.5.2Update to 1.5.2
- High8.8Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation
WP Maintenance Mode & Site Under Construction
≤1.5.2Update to 1.6