Database
WordPress Vulnerability Database (page 1326)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Reflected Cross-Site Scripting
Booking Calendar Contact Form
≤1.0.23Update to 1.0.24
- Critical9.8Blind SQL Injection
Booking Calendar Contact Form
<1.0.24Update to 1.0.24
- High8.1Shortcode SQL Injection
Booking Calendar Contact Form
≤1.0.23Update to 1.0.24
- Medium6.1Reflected Cross-Site Scripting
Elfsight Instagram Widget – Instagram Gallery
<1.1.2Update to 1.1.2
- Medium6.4Cross-Site Scripting
Universal Analytics
≤1.3.0Update to 1.3.1
- Medium6.5Unauthorized Settings Change
WP-Invoice – Web Invoice and Billing
≤4.1.0Update to 4.1.1
- Medium5.3Insecure Direct Object Reference
WP-Invoice – Web Invoice and Billing
≤4.1.0Update to 4.1.1
- Medium5.3Missing Authorization
WP-Invoice – Web Invoice and Billing
≤4.1.0Update to 4.1.1
- Medium5.3Missing Authorization
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
- High8.8Privilege Escalation
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
- Medium5.3Missing Authorization
WP-Invoice – Web Invoice and Billing
<4.1.1Update to 4.1.1
- Medium6.4Server-Side Request Forgery
WordPress
≤4.4.1Update to 3.7.13 or 3.8.13 or 3.9.11 or 4.0.10 or 4.1.10 or 4.2.7 or 4.3.3 or 4.4.2
- High8.8Multiple SQL Injections
eShop
≤6.3.14No patch available
- High8.8Cross-Site Request Forgery
Simple add pages or posts
<1.7Update to 1.7
- Medium5.4Open Redirect via wp_validate_redirect
WordPress
≤4.4.1Update to 3.7.13 or 3.8.13 or 3.9.11 or 4.0.10 or 4.1.10 or 4.2.7 or 4.3.3 or 4.4.2
- Medium6.1Multiple Cross-Site Scripting
eShop
≤6.3.14No patch available
- Medium6.1Cross-Site Scripting
Connections Business Directory
<8.5.9Update to 8.5.9
- Medium6.4Cross-Site Scripting
Sola Support Tickets
<3.13Update to 3.13
- Medium6.1Reflected Cross-Site Scripting
IMPress Listings
≤2.0.1Update to 2.0.2
- High8.8SQL Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
≤1.07.11Update to 2.0
- Critical9.8SQL Injection
Appointment Booking Calendar
<1.1.24Update to 1.1.24
- High7.5Authentication Bypass
OneLogin SAML SSO
<2.2.0Update to 2.2.0
- Medium5.5Cross-Site Scripting via Theme Names
WordPress
≤4.4Update to 3.7.12 or 3.8.12 or 3.9.10 or 4.0.9 or 4.1.9 or 4.2.6 or 4.3.2 or 4.4.1
- Medium5.3Remote Code Execution
Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
<1.1.4.6Update to 1.1.4.6
- High8.8Unrestricted File Upload
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.10Update to 2.1.15
- Medium6.4Stored Cross-Site Scripting
mTouch Quiz
≤3.1.2Update to 3.1.3
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
mTouch Quiz
<3.1.3Update to 3.1.3
- Medium6.1Reflected Cross-Site Scripting
mTouch Quiz
≤3.1.2Update to 3.1.3
- Medium6.5Cross-Site Request Forgery
mTouch Quiz
<3.1.3Update to 3.1.3
- High8.8SQL Injection
Welcart e-Commerce
<1.5.3Update to 1.5.3