Database
WordPress Vulnerability Database (page 1333)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.4Authenticated Stored Cross-Site Scripting and Authorization Bypass
CookieYes – Cookie Banner, Cookie Consent & Cookie Notice for GDPR/CCPA
≤1.8.2Update to 1.8.3
- High7.5SQL Injection
Participants Database
<1.9.5.6Update to 1.9.5.6
- High7.1Unauthenticated CSV Injection
Events Manager Pro
<2.6.7.2Update to 2.6.7.2
- Critical9.88.6 - Authentication Bypass
Indeed Membership Pro
7.3 – <8.6.1Update to 8.6.1
- Medium6.38.6 - Missing Authorization Checks
Indeed Membership Pro
7.3 – 8.6Update to 8.6.1
- High7.5Unauthenticated Information Disclosure
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤5.5Update to 5.5.1
- High8.0Authenticated (Subscriber+) Arbitrary File Deletion
WP Fastest Cache – WordPress Cache Plugin
<0.9.0.3Update to 0.9.0.3
- Medium5.5CSV Injection
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
≤5.9.7.1Update to 5.9.7.2
- High8.3Cross-Site Request Forgery leading to Arbitrary File Deletion and Site Reset
Merge + Minify + Refresh
<1.10.8Update to 1.10.8
- High8.8Cross-Site Request Forgery
Tutor LMS – eLearning and online course solution
<1.5.3Update to 1.5.3
- Medium6.4Stored Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.4.23Update to 3.4.23
- High8.0Authenticated (Author+) CSV Injection
TablePress – Tables in WordPress made easy
≤1.14Update to 2.0
- Medium6.1Stored Cross Site Scripting
Strong Testimonials
≤2.40.0Update to 2.40.1
- High8.8Cross-Site Request Forgery
Htaccess by BestWebSoft – WordPress Website Access Control Plugin
≤1.8.1Update to 1.8.2
- Medium6.13.11.2 - Cross-Site Scripting
Login by Auth0
3.11.0 – 3.11.2Update to 3.11.3
- Medium6.4Cross-Site Scripting
gistpress
<3.0.2Update to 3.0.2
- Medium6.1Cross-Site Scripting
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
≤4.6.0.1Update to 4.6.0.3
- Medium6.1Reflected Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.8.4Update to 2.8.5
- Medium4.3Cross-Site Request Forgery
Portfolio Filter Gallery – Photo Gallery
≤1.1.2Update to 1.1.3
- High8.8Cross-Site Request Forgery to Remote Code Execution
Code Snippets
≤2.13.3Update to 2.14.0
- Medium6.4Stored Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.7.5Update to 2.7.6
- Medium6.1Cross-Site Scripting
SAML Single Sign On – SSO Login
≤4.8.83Update to 4.8.84
- Critical9.8Authentication Bypass
Wordable – Export Google Docs to WordPress
<3.1.2Update to 3.1.2
- Medium6.4Stored Cross-Site Scripting
CarSpot – Dealership Wordpress Classified Theme
≤2.2.3Update to 2.2.4
- Medium5.3Hidden Login Page Location Disclosure
WPS Hide Login
≤1.5.4.2Update to 1.5.5
- High7.5Insecure Direct Object Reference
CarSpot – Dealership Wordpress Classified Theme
≤2.2.3Update to 2.2.4
- Medium6.1Cross-Site Scripting
Multiple Domain
≤1.0.2Update to 1.0.3
- High8.8Privilege Escalation
wpCentral
<1.4.8Update to 1.4.8
- High7.1Cross-Site Scripting
DS FAQ Plus
<1.4.2Update to 1.4.2
- Medium6.1Cross-Site Scripting
Ultimate Addons for Beaver Builder
≤1.24.3Update to 1.25.0