Database
WordPress Vulnerability Database (page 1319)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery to Arbitrary File Modification and Creation
Child Theme Creator by Orbisius
<1.5.2Update to 1.5.2
- High7.2Stored Cross-Site Scripting
Mailster WordPress Newsletter Plugin
≤2.4.5.1Update to 2.4.9
- High7.1Incorrect Authorization Checks Allowing Post Modification
Brizy – Page Builder
≤2.3.11Update to 1.0.126 or 2.3.12
- High7.2Stored Cross-Site Scripting
Web Instant Messenger
≤1.1.2No patch available
- High7.2Arbitrary File Upload
PowerPress Podcasting plugin by Blubrry
≤8.3.7Update to 8.3.8
- High8.1Race Condition leading to Remote Code Execution
Autoptimize
<2.7.8Update to 2.7.8
- Medium4.8Unsafe File Upload to Cross-Site Scripting
Autoptimize
<2.7.8Update to 2.7.8
- Critical9.8Arbitrary File Upload (and Remote Code Execution) via Import Settings
Autoptimize
<2.7.8Update to 2.7.8
- High7.2Arbitrary File Deletion
HyperComments
≤1.2.2No patch available
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
WPBakery Page Builder
≤6.4Update to 6.4.1
- High7.2Authenticated Remote Code Execution in Dynamic OOO Widget
Elementor Website Builder Pro
≤3.0.5Update to 3.0.6
- High8.8SQL Injection
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.2.7.2Update to 3.2.7.3
- Critical9.1Authentication Bypass
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
≤11.6Update to 11.7
- Critical9.8Function Injection
Sparkling
≤2.4.8Update to 2.4.9
- Medium6.5Unauthenticated Plugin Activation/Deactivation
Newspaper X
≤1.3.1Update to 1.3.2
- Medium6.1Cross-Site Scripting and Cross-Frame Scripting
BA Book Everything
<1.3.25Update to 1.3.25
- High8.8SQL Injection
Slider by 10Web – Responsive Image Slider
≤1.2.35Update to 1.2.36
- High7.5Improper Access Controls
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
≤2.0.28Update to 2.0.29
- Medium4.3Cross-Site Request Forgery Bypass
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
<1.6.4Update to 1.6.4
- Medium4.3Cross-Site Request Forgery Bypass
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce
<1.5.16Update to 1.5.16
- Medium4.3Cross-Site Request Forgery Bypass
Hueman
≤3.6.3Update to 3.6.4
- Medium4.3Cross-Site Request Forgery Bypass
Customizr
≤4.3.0Update to 4.3.1
- Medium4.3Cross-Site Request Forgery Bypass
Ocean Extra
<1.6.6Update to 1.6.6
- Critical9.8Arbitrary File Upload
Simple:Press Forum
<6.6.1Update to 6.6.1
- Medium5.3Validation Bypass via Email Field
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.4.27Update to 3.4.27.1
- Medium6.1Cross-Site Scripting
UpdraftPlus Premium
<1.9.64Update to 1.9.64
- High8.8Cross-Site Request Forgery to Plugin Installation
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.4.27Update to 3.4.27.1
- High8.8Remote Code Execution
Coditor – Code Editor
≤1.1No patch available
- Critical9.8SQL Injection
Advanced Contact form 7 DB
≤1.6.2Update to 1.7.0
- High7.5Password Hash Extraction
W3 Total Cache
≤0.9.2.4Update to 0.9.2.5