Database
WordPress Vulnerability Database (page 1322)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Real Estate 7 WordPress
≤3.0.5Update to 3.0.6
- Critical9.8Arbitrary File Upload
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤7.0.1Update to 7.0.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider
<3.17.2Update to 3.17.2
- High7.2SQL Injection
WordPress Poll
≤36No patch available
- High7.2Authenticated Arbitrary File Upload
Autoptimize
≤2.7.6Update to 2.7.7
- Medium6.1Cross-Site Scripting via id Parameter
WP Floating Menu – One page navigator, sticky menu for WordPress
<1.4.1Update to 1.4.1
- Critical9.8Unauthenticated SQL Injection via 'event_count'
RSVPMaker
<7.8.2Update to 7.8.2
- High7.1Missing Authorization to Settings Update
Kali Forms — Contact Form & Drag-and-Drop Builder
<2.1.2Update to 2.1.2
- High8.8Cross-Site Request Forgery
Kali Forms — Contact Form & Drag-and-Drop Builder
<2.1.2Update to 2.1.2
- High8.6Unauthenticated Arbitrary Post Deletion
Kali Forms — Contact Form & Drag-and-Drop Builder
<2.1.2Update to 2.1.2
- Medium4.3Authenticated Information Disclosure
Access Governance for WordPress (aka AAM)
≤6.6.1Update to 6.6.2
- High7.5Payment System Bypass
NAB Transact
<2.1.2Update to 2.1.2
- Medium6.1Multiple Stored Cross-Site Scripting
WP Customer Reviews
≤3.4.2Update to 3.4.3
- Medium6.3Missing Authorization
Discount Rules for WooCommerce
≤2.0.2Update to 2.1.0
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Click to top
<1.2.8Update to 1.2.8
- Critical9.8Cross-Site Request Forgery
Backup, Restore and Migrate your sites with XCloner
<4.2.153Update to 4.2.153
- Medium6.4Multiple Stored Cross-Site Scripting
Internal Links Manager
≤2.1.0Update to 2.1.1
- High8.84.2.12 - Unprotected AJAX Actions
Backup, Restore and Migrate your sites with XCloner
4.2.1 – 4.2.12Update to 4.2.153
- Medium6.4Stored Cross-Site Scripting
NextGEN Gallery Sell Photo
≤1.0.4No patch available
- Medium6.1Reflected Cross-Site Scripting
Geo Magazine Theme
≤2.0No patch available
- Medium6.4Stored Cross-Site Scripting
Easy Media Download
≤1.1.4Update to 1.1.5
- High7.2Stored Cross-Site Scripting
Change WordPress Login Logo
<1.1.5Update to 1.1.5
- High7.1Cross-Site Scripting
WP Elegant Testimonial
≤1.1.6No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Sell Photo
≤1.0.5Update to 1.0.6
- Medium6.1Stored Cross-Site Scripting
WP Colorbox
≤1.1.4Update to 1.1.5
- High8.3Stored Cross-Site Scripting
WP fancybox
≤1.0.2Update to 1.0.3
- High7.5Authenticated Authorization Bypass and Privilege Escalation
Access Governance for WordPress (aka AAM)
≤6.6.1Update to 6.6.2
- Medium6.4Cross-Site Scripting
Responsive Lightbox2
<1.0.3Update to 1.0.3
- High8.6CSV injection via form entry
weForms – Easy Drag & Drop Contact Form Builder For WordPress
≤1.4.7Update to 1.4.8
- High7.5Unauthenticated Resource Access to Site Backups
File Manager
≤6.4Update to 6.5