Database
WordPress Vulnerability Database (page 1329)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
Gmedia Photo Gallery
<1.18.5Update to 1.18.5
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Real-Time Find and Replace
≤3.9Update to 4.0.2
- High8.8SQL Injection
Duplicate Page and Post
<2.5.7Update to 2.5.7
- Medium6.4Authenticated Stored Cross-Site Scripting
YOP Poll
<6.1.5Update to 6.1.5
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting
Avada | Website Builder For WordPress & WooCommerce
<6.2.3Update to 6.2.3
- Medium6.1Unauthenticated Stored Cross-Site Scripting
WP GDPR
≤2.1.1No patch available
- Medium5.3Information Disclosure
Advanced Woo Search – Product Search for WooCommerce
≤1.99Update to 2.00
- High7.3Missing Authorization Checks
WP GDPR
≤2.1.1No patch available
- Medium6.1Reflected Cross-Site Scripting
Catch Breadcrumb
<1.5.5Update to 1.5.5
- High7.3Missing Authorization
Timetable and Event Schedule by MotoPress
≤2.3.8Update to 2.3.9
- Medium6.4Authenticated Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.9.7Update to 2.9.8
- High8.1Privilege Escalation via accept-to-be-teacher action parameter
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.2.6.8Update to 3.2.6.9
- Medium6.5Unauthenticated Settings Update to Stored Cross-Site Scripting
WP Mega Menu
≤1.3.6Update to 1.3.7
- Medium6.1Reflected Cross Site Scripting
Translate WordPress with GTranslate
≤2.8.51Update to 2.8.52
- High7.1Authenticated Page Creation and Status Modification
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.2.6.8Update to 3.2.6.9
- Medium5.4Missing Authorization
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.42.2Update to 1.0.42.2
- High7.4Unauthorized Widget Import to Stored Cross-Site Scripting
Widget Settings Importer/Exporter
≤1.5.3No patch available
- Critical9.8Missing Authorization
TS Poll – Survey, Versus Poll, Image Poll, Video Poll
<1.3.4Update to 1.3.4
- Medium5.4Arbitrary Plugin Installation, Activation and Deactivation
Kustom Checkout for WooCommerce
<2.0.10Update to 2.0.10
- Medium6.1Cross-Site Scripting
Advanced Order Export For WooCommerce
<3.1.4Update to 3.1.4
- High8.3Cross-Site Request Forgery
WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X
≤0.99No patch available
- Medium5.4Authenticated Stored Cross-Site Scripting
WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X
<0.99Update to 0.99
- High7.2Stored Cross-Site Scripting
WordPress Landing Page – Squeeze Page – Responsive Landing Page Builder Free – WP Lead Plus X
≤0.98Update to 0.99
- Medium6.1Unauthenticated Stored Cross-Site Scripting
Car Rental System
≤1.3No patch available
- Medium6.1Marketplace Digital Products PHP7 <= 2.1 - Cross-Site Scripting
Vanguard - Marketplace Digital Products PHP7
≤2.1No patch available
- High7.2Cross-Site Scripting
Online Hotel Booking System Pro
≤1.1No patch available
- Critical9.8Unauthenticated Settings Update
OneTone Companion
≤1.1.1No patch available
- Medium5.5Stored Cross-Site Scripting
WP Last Modified Info
≤1.6.5Update to 1.6.6
- High7.2Stored Cross-Site Scripting
OneTone Companion
≤1.1.1No patch available
- High8.3Cross-Site Request Forgery
WooCommerce Subscription
<3.0.3Update to 3.0.3