Database
WordPress Vulnerability Database (page 1307)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Missing Authorization to Arbitrary Plugin Installation/Activation
WP Maintenance Mode & Site Under Construction
<1.8.2Update to 1.8.2
- High8.8Cross-Site Request Forgery to Arbitrary Plugin Installation/Activation
Visitor Traffic Real Time Statistics
≤2.13Update to 3.1
- Medium5.5Authenticated Stored Cross-Site Scripting
RSS for Yandex Turbo
≤1.29Update to 1.30
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting
WooCommerce
<5.2.0Update to 5.2.0
- Medium6.1Reflected Cross-Site Scripting
Accordions
<2.2.30Update to 2.2.30
- High7.5Unauthenticated Arbitrary Nonce Generation
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Critical9.8Arbitrary File Upload
Kaswara Modern VC Addons
≤3.0.1No patch available
- High8.8Authenticated PHP Object Injection
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.3Unprotected AJAX Actions
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium4.3Authenticated Arbitrary Post Deletion
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.5Authenticated Arbitrary Plugin Installation
Redirection for Contact Form 7
<2.3.4Update to 2.3.4
- Medium6.1Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.68Update to 1.5.69
- Medium6.1Reflected Cross-Site scripting
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.7.14Update to 1.7.15
- Medium6.1Reflected Cross-Site Scripting
CES – Popup Builder, Optin Forms, Lead Generation, CRM & Email Marketing Automation
≤1.10.4Update to 1.10.5
- Medium6.1Reflected Cross-Site Scripting <= 1.5.68 - Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.68Update to 1.5.69
- Medium6.1Reflected Cross-Site scripting
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key
≤1.2.4Update to 1.2.5
- Medium6.1Multiple Reflected Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.69Update to 1.5.69
- High8.8Cross-Site Request Forgery
404 SEO Redirection
≤1.3Update to 1.4
- Medium6.1Reflected Cross-Site Scripting via tab Parameter
All 404 Redirect to Homepage
<1.21Update to 1.21
- Medium6.1Reflected Cross-Site Scripting
404 SEO Redirection
≤1.3Update to 1.4
- Medium4.8Authenticated Stored Cross-Site Scripting
SEO Redirection Plugin – 301 Redirect Manager
≤6.4Update to 7.1
- Medium5.3Missing Authorization
Download Manager
<3.1.18Update to 3.1.18
- Medium4.3Cross-Site Request Forgery
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
≤2.10.2Update to 2.10.3
- Medium6.6Missing Authorization
User Rights Access Manager
≤1.0.3Update to 1.0.4
- Medium6.4Stored Cross-Site Scripting
Clever Addons for Elementor
<2.1.0Update to 2.1.0
- High7.1XXE Injection
WordPress
<5.7.1Update to 4.7.20 or 4.8.16 or 4.9.17 or 5.0.12 or 5.1.9 or 5.2.10 or 5.3.7 or 5.4.5 or 5.5.4 or 5.6.3 or 5.7.1
- Medium6.5Sensitive Information Disclosure
WordPress
<5.7.1Update to 4.7.20 or 4.8.16 or 4.9.17 or 5.0.12 or 5.1.9 or 5.2.10 or 5.3.7 or 5.4.5 or 5.5.4 or 5.6.3 or 5.7.1
- Medium5.4Missing Authorization to Unauthorized Group Access
BuddyPress
≤7.2.1Update to 7.3.0
- Medium4.3Cross-Site Request Forgery
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<2.10.3Update to 2.10.3
- Medium6.5Authenticated (Contributor+) Arbitrary File Read
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
≤4.1.9Update to 2.0.7 or 4.1.10