Database
WordPress Vulnerability Database (page 1317)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1Sensitive Information Disclosure
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more
≤1.4.2Update to 1.4.3
- Medium5.4Authenticated Stored Cross-Site Scripting
Themify Portfolio Post
≤1.1.5Update to 1.1.6
- High8.8Authenticated Blind SQL Injection
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<3.3.3Update to 3.3.3
- High8.3Blind Server-Side Request Forgery via detail.php
Canto
≤1.9.0Update to 2.0.1
- Medium6.4Cross-Site Scripting
Wibar | Wine and Vineyard WooCommerce WordPress Theme
<1.2.1Update to 1.2.1
- High8.3Blind Server-Side Request Forgery via download.php
Canto
≤1.9.0Update to 2.0.1
- Medium6.1Reflected Cross-Site Scripting
EventON (Pro) - WordPress Virtual Event Calendar Plugin
≤3.0.5Update to 3.0.6
- Medium6.4Insufficient Input Validation
BuddyPress
<6.4.0Update to 6.4.0
- Medium6.3Missing Authorization on Various AJAX Actions
NEX-Forms – Ultimate Forms Plugin for WordPress
≤7.7.1Update to 7.8
- Medium6.4Unrestricted SVG Uploads
Elementor Website Builder – more than just a page builder
≤3.0.13Update to 3.0.14
- High7.2Authenticated SQL Injection via Orderby
WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
≤4.1.4Update to 4.1.5
- Medium6.1Reflected Cross-Site Scripting & Cross-Frame Scripting
WP Job Board
≤5.6.4Update to 5.7.0
- Critical9.8SQL Injection
WP Job Board
≤5.6.4Update to 5.7.0
- Critical9.9Authenticated Privilege Escalation
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
<2.10.3Update to 2.10.3
- High8.8Cross-Site Request Forgery
Redux Framework
≤4.1.20Update to 4.1.21
- High8.8Remote Code Execution
Secure File Manager
<2.8.2Update to 2.8.2
- Medium5.4Insecure Direct Object Reference
WooCommerce Anti-Fraud
≤3.2Update to 3.3
- High7.3CSV injection via a customer's profile
Import and export users and customers
≤1.16.3.5Update to 1.16.3.6
- High8.8CSV Injection
Easy Registration Forms
≤2.0.6No patch available
- High7.2Authenticated SQL Injection
Anti-Spam, Spam FireWall by CleanTalk
<5.149Update to 5.149
- Medium4.3Cross-Site Request Forgery
Contextual Related Posts
≤2.9.3Update to 2.9.4
- Medium6.4Stored Cross-Site Scripting
Fancy Product Designer
≤4.5.0Update to 4.5.1
- Medium6.4Cross-Site Scripting
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
≤2.5.0Update to 2.5.1
- Medium6.1Reflected Cross-Site Scripting
WP DB Error Manager
≤2.1.6No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
AIT CSV import/export
≤3.0.3Update to 3.0.4
- Critical9.8Unauthenticated SQL Injection
Good LMS - Learning Management System WP Plugin
≤2.1.4Update to 2.1.5
- Critical9.8PHP Object Injection
Ultimate Reviews
<2.1.33Update to 2.1.33
- Critical9.9Authenticated Privilege Escalation via Profile Update
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.1.12Update to 2.1.12
- Critical10.0Unauthenticated Privilege Escalation via User Meta
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.1.12Update to 2.1.12
- Critical10.0Unauthenticated Privilege Escalation via User Roles
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.1.12Update to 2.1.12