Database
WordPress Vulnerability Database (page 1330)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated Stored Cross-Site Scripting
Contact Form 7 Datepicker
≤2.6.0No patch available
- High7.2Stored Cross-Site Scripting
Login by Auth0
≤3.11.3Update to 4.0.0
- Critical9.8CSV Injection
Login by Auth0
≤3.11.3Update to 4.0.0
- Medium4.3Insecure Direct Object Reference
Login by Auth0
≤3.11.3Update to 4.0.0
- Critical9.8Unauthenticated SQL Injection
LearnDash LMS
≤3.1.5Update to 3.1.6
- Medium6.5Authenticated Map Creation/Deletion to Stored Cross-Site Scripting & Remote Code Execution
MapPress – Free Map Plugin for Google Maps & OpenStreetMap
<2.53.9Update to 2.53.9
- High8.8Cross-Site Request Forgery
Login by Auth0
≤3.11.3Update to 4.0.0
- Critical9.8Arbitrary File Write
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
<3.37.15Update to 3.37.15
- Medium5.5Stored Cross-Site Scripting
Login by Auth0
≤3.11.3Update to 4.0.0
- Medium6.5Authorization Bypass
Elementor Website Builder – more than just a page builder
≤2.9.5Update to 2.9.6
- Medium5.5Missing Authorization
Spectra Legacy – Gutenberg Blocks
≤1.14.7Update to 1.14.8
- Medium5.4Authenticated Cross-Site Scripting
Easy Forms for Mailchimp
<6.6.3Update to 6.6.3
- Critical9.8SQL Injection
Custom Searchable Data Entry System
≤1.7.1No patch available
- Medium6.4Authenticated Stored Cross-Site Scripting
CM Pop-Up – Create engaging popups to capture attention and boost interaction
≤1.4.10Update to 1.5.0
- Medium5.4Authenticated Stored Cross-Site Scripting
IMPress for IDX Broker
<2.6.2Update to 2.6.2
- Medium6.1Bootstrap Admin Theme with AngularJS <= 1.3 - Reflected Cross-Site Scripting
Xenon - Bootstrap Admin Theme with AngularJS
≤1.3No patch available
- High8.1Authenticated Arbitrary Post Creation, Modification, and Deletion
IMPress for IDX Broker
<2.6.2Update to 2.6.2
- Critical9.8Privilege Escalation via Unprotected REST API Endpoint
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
<1.0.41Update to 1.0.41
- High7.4Redirect Creation via Unprotected REST API Endpoint
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
≤1.0.40Update to 1.0.41
- High8.8Cross-Site Request Forgery
Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables
≤1.9.91Update to 1.9.92
- Medium6.3Missing Authorization on AJAX Actions
Data Tables Generator by Supsystic – Excel-like, WooCommerce & Pricing Tables
≤1.9.91Update to 1.9.92
- Medium4.9Sensitive Information Disclosure
WPvivid — Backup, Migration & Staging
<0.9.36Update to 0.9.36
- Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
Read More Without Refresh
≤3.1Update to 3.2
- Critical9.8File Uploads Extension <= 3.3.0 - Arbitrary File Upload
Ninja Forms - File Uploads
≤3.3.0Update to 3.3.1
- High8.8SQL injection
WP All Import Pro
<4.1.2Update to 4.1.2
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Custom Post Type UI
<1.7.4Update to 1.7.4
- Medium6.1Reflected Cross-Site Scripting
Advanced Ads – Ad Manager & AdSense
<1.17.4Update to 1.17.4
- Medium6.4Unprotected AJAX Action to Stored/Reflected Cross-Site Scripting
Accordions
<2.2.9Update to 2.2.9
- Medium5.5CSV Injection
Newsletter – Send awesome emails from WordPress
≤6.5.3Update to 6.5.4
- High7.1Privilege Escalation
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
≤3.2.6.6Update to 3.2.6.8