Database
WordPress Vulnerability Database (page 1313)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
NextGen Gallery Pro
≤3.1.9Update to 3.1.11
- High8.8Authenticated Account Creation and Privilege Escalation
WooCommerce Customers Manager
<26.5Update to 26.5
- Medium6.1Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.68Update to 1.5.69
- High7.5API Key Disclosure
Web-Stat – Live Visitor Analytics
≤1.4.0Update to 1.4.1
- Critical9.8Arbitrary File Creation
QuadMenu – Mega Menu
≤2.0.6Update to 2.0.7
- Medium6.4Cross-Site Scripting
Advanced Order Export For WooCommerce
≤3.1.7Update to 3.1.8
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Testimonial Rotator
≤3.0.3No patch available
- High7.2Authenticated Arbitrary File Upload
JetBackup – Backup, Restore & Migrate
≤1.5.9Update to 1.6.0
- High8.8Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34Update to 3.4.34
- Medium6.1Administrator Open Redirect
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34Update to 3.4.34
- Medium4.3Authenticated OAuth Connection Key Disclosure
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34.1Update to 3.4.34.1
- Medium5.4Cross-Site Request Forgery to OAuth Service Disconnection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.34Update to 3.4.34
- Medium6.1Reflected Cross-Site Scripting
Customer Support Ticket System & Helpdesk
≤5.5.1Update to 5.6.0
- Medium4.9Authenticated Arbitrary File Download
Theme Editor
≤2.5Update to 2.6
- High8.84.0.3 - Authenticated Arbitrary File Upload
Responsive Menu – Mobile Menu & Hamburger Menu Builder
4.0 – <4.0.4Update to 4.0.4
- Medium6.1Tour & Travel WordPress Theme < 2.0 - Reflected Cross-Site Scripting
Goto - Tour & Travel WordPress Theme
<2.0Update to 2.0
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
Responsive Menu – Mobile Menu & Hamburger Menu Builder
<4.0.4Update to 4.0.4
- High8.8Cross-Site Request Forgery to Setting Modification
Responsive Menu – Mobile Menu & Hamburger Menu Builder
<4.0.4Update to 4.0.4
- High7.2Unprotected AJAX Action
Map Block for Google Maps
<1.32Update to 1.32
- Medium6.1Directory & Listings With Booking - WordPress Theme < 1.6.11 - Cross-Site Scripting
Listeo - Directory & Listings With Booking - WordPress Theme
<1.6.11Update to 1.6.11
- Medium6.4Stored Cross-Site Scripting
WordPress Flipbook by Supsystic
≤1.6.12Update to 1.7.0
- High8.8SQL Injections
Contact Form by Supsystic – Drag & Drop Form Builder with Templates & Form Statistics
≤1.7.10Update to 1.7.11
- Critical9.6WP Armour Honeypot Anti Spam <= 1.5.6 -Cross-Site Request Forgery to Arbitrary Options Update
WP Armour – Honeypot Anti Spam
<1.5.7Update to 1.5.7
- High7.2Authenticated (Admin+) Time-Based Blind SQL Injection
Membership by Supsystic
≤1.5.0No patch available
- High8.8SQL Injection
Welcart e-Commerce
≤2.1.0Update to 2.1.1
- High7.2Authenticated (Admin+) Time-Based Blind SQL Injection
Newsletter by Supsystic
≤1.5.6No patch available
- High8.8Boolean-Based Blind SQL Injections
Pricing Table by Supsystic – Responsive Pricing Plans & Comparison Tables
≤1.8.8Update to 1.8.9
- High7.2Authenticated SQL Injection
Ultimate Maps by Supsystic – OpenStreetMap, Leaflet & Mapbox, No API Key
<1.1.17Update to 1.1.17
- High8.1Cross-Site Request Forgery to Arbitrary File Download/Deletion
Backup by Supsystic
≤2.3.11Update to 2.3.12
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
Extra Charges To Payment Gateway For WooCommerce (Standard)
≤2.0.2.1No patch available