Database
WordPress Vulnerability Database (page 1308)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Cross-Site Request Forgery to Stored Cross-Site Scripting
fitness calculators
≤1.9.5Update to 1.9.6
- Medium5.4Missing Authorization to Private Post Activity
BuddyPress
≤7.2.1Update to 7.3.0
- Medium5.4Missing Authorization to Group Creation
BuddyPress
≤7.2.1Update to 7.3.0
- High8.8Insufficient Privilege De-escalation
BuddyPress
≤7.2.1Update to 7.3.0
- Medium5.4Missing Authorization to Unauthorized Group Access
BuddyPress
≤7.2.1Update to 7.3.0
- Medium5.4Cross-Site Scripting
Essential Addons for Elementor – Popular Elementor Templates & Widgets
<4.5.4Update to 4.5.4
- Medium5.4Stored Cross-Site Scripting
Sina Extension for Elementor
<3.3.12Update to 3.3.12
- Medium6.4Authenticated Stored Cross-Site Scripting
Image Hover Effects – Elementor Addon
<1.3.4Update to 1.3.4
- High8.6Directory Traversal
Media File Organizer
≤1.0.1No patch available
- High8.1Directory Traversal to Arbitrary File Deletion and Denial of Service
CM Download Manager – Organize, Protect & Share Files in WordPress
<2.8.0Update to 2.8.0
- Critical9.1Server-Side Request Forgery
Import XML and RSS Feeds
<2.0.3Update to 2.0.3
- High7.5Directory Traversal
Video Downloader for TikTok
<1.4Update to 1.4
- Medium5.4Stored Cross-Site Scripting
Addon Elements for Elementor (formerly Elementor Addon Elements)
<1.11.2Update to 1.11.2
- Medium5.4Authenticated (Contributor+) Stored Cross-Site Scripting
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
≤2.1.7Update to 2.2.0
- Medium6.5Server-Side Request Forgery
Podcast Importer SecondLine
<1.1.5Update to 1.1.5
- Medium5.4Authenticated Stored Cross-Site Scripting
The Plus Addons for Elementor – Mega Menu, Header Footer, Post Grid, AI Widgets & Templates
<2.0.6Update to 2.0.6
- High8.3Server-Side Request Forgery
Video Downloader for TikTok
<1.4Update to 1.4
- Medium5.4Authenticated Stored Cross-Site Scripting
DethemeKit for Elementor
<1.5.5.5Update to 1.5.5.5
- Medium5.4Contributor+ Stored Cross-Site Scripting
PowerPack Addons for Elementor: Widgets, Form Styler and Templates
≤2.3.1Update to 2.3.2
- Medium6.1Cross-Site Scripting
CM Download Manager – Organize, Protect & Share Files in WordPress
<2.8.0Update to 2.8.0
- Medium5.4Absolute Addons for Elementor Page Builder <= 1.5.5 - Contributor+ Stored Cross-Site Scripting
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
≤1.5.5Update to 1.5.7
- Medium5.4Livemesh Addons for Elementor <= 6.7.1- Contributor+ Stored Cross-Site Scripting
Livemesh Addons by Elementor
≤6.7.1Update to 6.8
- Medium6.4WidgetKit <= 2.3.9 - Contributor+ Stored Cross-Site Scripting
WidgetKit for Elementor – Lightweight Elementor Addons, Widgets & Templates
<2.3.10Update to 2.3.10
- Medium5.4Stored Cross-Site Scripting
Ultimate Addons for Elementor
<1.30.0Update to 1.30.0
- Medium5.3Server-Side Request Forgery
WP-DownloadManager
<1.68.5Update to 1.68.5
- Medium6.4Stored Cross-Site Scripting
Ultimate Addons for Elementor – Widgets, Templates, WooCommerce & Header Footer Builder
<1.5.8Update to 1.5.8
- Medium6.4Contributor+ Stored Cross-Site Scripting
JetWidgets For Elementor
<1.0.9Update to 1.0.9
- Medium6.4Authenticated Stored Cross-Site Scripting
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
<1.8.6Update to 1.8.6
- Critical9.1Server-Side Request Forgery
WP Smart Import : Import any XML File to WordPress
<1.0.1Update to 1.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Rife Extensions & Templates for Elementor
<1.1.6Update to 1.1.6