Database
WordPress Vulnerability Database (page 1327)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.8Update to 2.9.9
- Critical9.8Contact Form 7 <= 1.3.3.2 - Arbitrary File Upload
Drag and Drop Multiple File Upload for Contact Form 7
≤1.3.3.2Update to 1.3.3.3
- High7.2Authenticated SQL Injection
AdRotate Banner Manager
<5.8.4Update to 5.8.4
- High7.1Reflected Cross-Site Scripting
JobSearch WP Job Board
<1.5.1Update to 1.5.1
- Medium6.1Reflected Cross-Site Scripting
Newspaper - News & WooCommerce WordPress Theme
≤10.3.3Update to 10.3.4
- Medium6.1Cross-Site Scripting
Careerfy - Job Board WordPress Theme
<3.9.0Update to 3.9.0
- High7.4Authorization Bypass to Settings Updates
Brizy – Page Builder
<1.0.126Update to 1.0.126
- Medium4.8Cross-Site Scripting
FooGallery Photo Gallery : Image, Video & Masonry Galleries
≤1.8.12Update to 1.8.18
- High7.2Authenticated (Admin+) Arbitrary File Upload
Allow svg files
<1.1Update to 1.1
- High7.3Authenticated CSV Injection
Connections Business Directory
≤9.6Update to 9.7
- High7.5Insecure direct object reference via permalinks manipulation
ACF to REST API
≤3.2.0Update to 3.3.0
- High8.8Authenticated SQL Injection
Blog2Social: Social Media Auto Post & Scheduler
≤6.3.0Update to 6.3.1
- Medium4.8Authenticated (Admin+) Stored Cross-Site Scripting via the forums list table
bbPress
≤2.6.4Update to 2.6.5
- High7.4Missing Authorization to Cross-Site Scripting
Page Builder: Pagelayer – Drag and Drop website builder
<1.1.2Update to 1.1.2
- Critical9.8Unauthenticated Privilege Escalation
bbPress
≤2.6.4Update to 2.6.5
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Page Builder: Pagelayer – Drag and Drop website builder
<1.1.2Update to 1.1.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Image Photo Gallery Final Tiles Grid
≤3.4.18Update to 3.4.19
- High8.8Remote Code Execution via Improper Capability Checks in AJAX Calls
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
≤2.54.5Update to 2.54.6
- High7.2SQL Injection
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.13.35Update to 1.13.36
- Critical9.8Unauthenticated SQL Injection
MailerLite – Signup forms (official)
<1.4.4Update to 1.4.4
- Medium5.4Stored Cross-Site Scripting
ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
≤3.9.2Update to 3.9.3
- Medium5.4Cross-Site Request Forgery
MailerLite – Signup forms (official)
<1.4.5Update to 1.4.5
- High7.2Cross-Site Scripting
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
<1.6.0.2Update to 1.6.0.2
- Medium4.3Sensitive Information Disclosure
Site Kit by Google – Analytics, Search Console, AdSense, Speed
≤1.7.1Update to 1.8.0
- Medium6.5Cross-Site Request Forgery
multi Scheduler
≤1.0.0No patch available
- Medium4.7Authenticated SQL Injection
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
<2.3.3Update to 2.3.3
- High8.8Cross-Site Request Forgery
WP Frontend Profile
≤1.2.1Update to 1.2.2
- Medium5.5Multiple Cross-Site Scripting
Visual Composer Website Builder
≤26.0Update to 27.0
- High7.2SQL Injection
Ajax Load More – Infinite Scroll, Load More, & Lazy Load
<5.3.2Update to 5.3.2
- Medium6.5Arbitrary File Deletion
Simple File List
≤4.2.7Update to 4.2.8