Database
WordPress Vulnerability Database (page 1315)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.1Malicious Redirect
Digital Climate Strike WP
≤1.0.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Advanced Custom Fields Pro
<5.9.1Update to 5.9.1
- Medium5.5Authenticated Stored Cross-Site Scripting
Under Construction
≤3.85Update to 3.86
- High7.5Arbitrary Post Creation
123ContactForm for WordPress
≤1.5.6No patch available
- Critical9.8Arbitrary File Upload
123ContactForm for WordPress
≤1.5.6No patch available
- Critical9.8Validation Bypass via Plugin Verification
123ContactForm for WordPress
≤1.5.6No patch available
- High8.8SQL Injection
Database Addon for Contact Form 7 – CFDB7
<1.2.5.4Update to 1.2.5.4
- High7.2Easy Redirect Manager < 2.51 - SQL Injection
301 Redirects – Redirect Manager
<2.51Update to 2.51
- Medium6.1Reflected Cross-Site Scripting
WP Shieldon – WordPress Firewall
≤1.6.3Update to 1.6.4
- Critical9.8Incorrect Permission Assignment or Protection
WP Editor
<1.2.6Update to 1.2.6
- Medium5.4Authenticated Stored Cross-Site Scripting
Easy Contact Form Pro
<1.1.1.9Update to 1.1.1.9
- Medium6.4Authenticated Stored Cross-Site Scripting
FV Flowplayer Video Player
≤7.4.37.727Update to 7.4.38.727
- Medium5.4Authenticated Stored Cross-Site Scripting via Menu Label field
Pods – Custom Content Types and Fields
2.4.4.2 – 2.7.26Update to 2.7.27
- Medium5.42.7.26 - Authenticated Stored Cross-Site Scripting
Pods – Custom Content Types and Fields
2.4.4.1 – <2.7.27Update to 2.7.27
- High8.8Cross-Site Request Forgery
FormsDB – Save Elementor Forms to Google Sheets & Post Type
≤1.5Update to 1.6
- High8.1Authenticated (Subscriber+) Content Injection
WP Quick FrontEnd Editor – WordPress Plugin
≤5.5No patch available
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
WP Quick FrontEnd Editor – WordPress Plugin
≤5.5No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross Site Scripting
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
<2.10.3Update to 2.10.3
- Medium4.3Authenticated Settings Change
WP Quick FrontEnd Editor – WordPress Plugin
≤5.5No patch available
- Medium6.1Reflected Cross-Site Scripting
WP Quick FrontEnd Editor – WordPress Plugin
≤5.5No patch available
- Critical9.8Unauthenticated Arbitrary Object Deserialization leading to Remote Code Execution
Five Star Restaurant Menu and Food Ordering
<2.2.1Update to 2.2.1
- Critical9.8Unauthenticated Remote Code Execution
e-signature
<1.5.6.8Update to 1.5.6.8
- Medium5.5Stored Cross-Site Scripting via 'name'
Custom Global Variables
≤1.1.0Update to 1.1.1
- Medium6.1Reflected Cross-Site Scripting
Tutor LMS – eLearning and online course solution
≤1.9.12Update to 1.9.13
- High7.5Authorization Bypass
Modal Survey - WordPress Poll, Survey & Quiz Plugin
<2.0.1.8.2Update to 2.0.1.8.2
- Critical9.1PHP Object Injection
Modal Survey - WordPress Poll, Survey & Quiz Plugin
≤2.0.1.8Update to 2.0.1.8.2
- Medium5.5Cross-Site Scripting
WP24 Domain Check
≤1.6.2Update to 1.6.3
- Medium4.3IDOR to Sensitive Information Disclosure
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
<2.5.3Update to 2.5.3
- High7.5Broken Password Mechanism
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
≤7.6.1Update to 7.7.0
- High8.0SQL Injection via WP_Query
WordPress
<5.8.3Update to 3.7.37 or 3.8.37 or 3.9.35 or 4.0.34 or 4.1.34 or 4.2.31 or 4.3.27 or 4.4.26 or 4.5.25 or 4.6.22 or 4.7.22 or 4.8.18 or 4.9.19 or 5.0.15 or 5.1.12 or 5.2.14 or 5.3.11 or 5.4.9 or 5.5.8 or 5.6.7 or 5.7.5 or 5.8.3