Database
WordPress Vulnerability Database (page 1311)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery Bypass
eCommerce Product Catalog
<2.9.44Update to 2.9.44
- Critical9.8Arbitrary File Upload to Remote Code Execution
WooCommerce Help Scout
≤2.9.1Update to 2.9.2
- Medium6.5Missing Authorization
Realteo
<1.2.4Update to 1.2.4
- Medium6.1Open Redirect
PhastPress
≤1.110Update to 1.111
- High7.3Missing Authorization
Kaswara Modern VC Addons
≤3.0.1No patch available
- Medium5.4Authenticated (Admin+) Stored Cross-Site Scripting
WordPress Related Posts
≤3.6.4No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag
Elementor Website Builder – more than just a page builder
0.1.0 – 3.1.3Update to 3.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via title_size
Elementor Website Builder – more than just a page builder
0.1.0 – 3.1.3Update to 3.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via html_tag
Elementor Website Builder – more than just a page builder
0.1.0 – 3.1.3Update to 3.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via title_size Parameter
Elementor Website Builder – more than just a page builder
<3.1.4Update to 3.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via header_size
Elementor Website Builder – more than just a page builder
0.1.0 – 3.1.3Update to 3.1.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via title_html_tag
Elementor Website Builder – more than just a page builder
≤3.1.3Update to 3.1.4
- Medium5.4Authorization Bypass to Friend Invite
BuddyPress
≤7.2.0Update to 7.2.1
- Medium6.5Blind SQL Injection via length Parameter
wpDataTables (Premium)
<3.4.2Update to 3.4.2
- High8.1Improper Access Control leading to Table Permission Takeover
wpDataTables (Premium)
<3.4.2Update to 3.4.2
- High7.2Authenticated (Admin+) Remote Code Execution
WP Super Cache
<1.7.2Update to 1.7.2
- High8.1Improper Access Control leading to Table Data Deletion
wpDataTables (Premium)
<3.4.2Update to 3.4.2
- Medium6.5Blind SQL Injection via start Parameter
wpDataTables (Premium)
<3.4.2Update to 3.4.2
- Medium4.67.0.0 - 7.2.0 - Insufficient Privilege De-escalation
BuddyPress
7.0.0 – <7.2.1Update to 7.2.1
- High8.8Privilege Escalation via REST API
BuddyPress
5.0.0 – 7.2.0Update to 7.2.1
- Medium6.4Options Change to Stored Cross-Site Scripting
Flo Forms – Easy Drag & Drop Form Builder
≤1.0.35Update to 1.0.36
- Medium6.1301 Redirect Manager <= 6.3 - Reflected Cross-Site Scripting
SEO Redirection Plugin – 301 Redirect Manager
≤6.3Update to 6.4
- Medium6.5SQL Injection via tutor_quiz_builder_get_question_form
Tutor LMS – eLearning and online course solution
≤1.8.2Update to 1.8.3
- Medium6.5SQL Injection
Tutor LMS – eLearning and online course solution
<1.7.7Update to 1.7.7
- High8.8Unprotected AJAX including Privilege Escalation
Tutor LMS – eLearning and online course solution
<1.7.7Update to 1.7.7
- High8.8SQL Injection via tutor_answering_quiz_question/get_answer_by_id
Tutor LMS – eLearning and online course solution
<1.8.3Update to 1.8.3
- Medium5.4Reflected Cross-Site Scripting
Related Posts for WordPress
≤2.0.3Update to 2.0.4
- Medium6.5SQL Injection
Tutor LMS – eLearning and online course solution
<1.7.7Update to 1.7.7
- High8.8SQL Injection via tutor_quiz_builder_get_answers_by_question
Tutor LMS – eLearning and online course solution
≤1.8.2Update to 1.8.3
- Medium6.1Reflected Cross-Site Scripting
Social Slider Feed – Social Media Feed & Gallery Widgets
<1.8.5Update to 1.8.5