Database
WordPress Vulnerability Database (page 1334)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
Ultimate Addons for Beaver Builder
≤1.24.3Update to 1.25.0
- Critical9.8Arbitrary Code Execution
AccessAlly
<3.3.2Update to 3.3.2
- Medium6.1Cross-Site Scripting
Chatbot with IBM watsonx Assistant
<0.8.21Update to 0.8.21
- Medium5.3Insecure Direct Object Reference via order_id Parameter
WooCommerce
<4.7.0Update to 4.7.0
- Medium5.9Unauthenticated Backup Download
All-in-One WP Migration and Backup
<7.15Update to 7.15
- Medium5.4Authorization Bypass
Slideshow, Image Slider by 2J
≤1.3.31Update to 1.3.33
- High7.2Cross-Site Scripting
Elementor Website Builder – more than just a page builder
≤2.8.3Update to 2.8.4
- High8.8Cross-Site Request Forgery
Marketo Forms and Tracking
≤1.0.2No patch available
- Medium6.4Stored Cross-Site Scripting
Contextual Adminbar Color
≤0.2Update to 0.3
- Critical9.1Unauthenticated Database Reset
Database Reset
≤3.1Update to 3.15
- Medium6.1Reflected Cross-Site Scripting
Resim Ara
≤1.0No patch available
- Critical9.9Privilege Escalation
Database Reset
≤3.1Update to 3.15
- Medium6.1Reflected Cross-Site Scripting
Chained Quiz
<1.1.8.2Update to 1.1.8.2
- Medium6.4CSV Injection
Flamingo
≤2.1Update to 2.1.1
- Medium6.1Reflected Cross Site Scripting issue on the [ld_profile] search field
LearnDash LMS
3.0.0 – 3.1.1Update to 3.1.2
- Medium6.1Reflected Cross-Site Scripting
YOP Poll
<6.1.2Update to 6.1.2
- Medium6.1WordPress Directory & Listing Theme < 2.5.4 - Cross-Site Scripting
ListingPro - WordPress Directory & Listing Theme
<2.5.4Update to 2.5.4
- Critical9.8Authentication Bypass
InfiniteWP Client
≤1.9.4.4Update to 1.9.4.5
- Medium6.4Authenticated Stored Cross-Site Scripting
Contact Form Clean and Simple
<4.7.1Update to 4.7.1
- Critical9.8Authentication Bypass
Backup and Staging by WP Time Capsule
<1.21.16Update to 1.21.16
- Medium6.4Multiple Vulnerabilities
Real Estate 7 WordPress
<2.9.5Update to 2.9.5
- High8.3Cross-Site Scripting
Travel Booking WordPress Theme
<2.7.8.6Update to 2.7.8.6
- Medium5.3Insecure Direct Object Reference
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.1.3Update to 2.1.3
- Medium6.6Authenticated (Admin+) Stored Cross-Site Scripting
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
<2.0Update to 2.0
- High7.1Cross-Site Scripting
Videos on Admin Dashboard
<1.1.4Update to 1.1.4
- Medium6.1Reflected Cross-Site Scripting
Houzez
≤1.8.3Update to 1.8.4
- Medium6.0Store Exporter <= 2.3.1 - CSV Injection
Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers
≤2.3.1Update to 2.4
- High8.8Cross-Site Request Forgery
Ultimate Category Excluder
≤1.1Update to 1.2
- Medium5.4Missing Authorization to Export Settings/Theme Change
Minimal Coming Soon – Coming Soon Page
<2.17Update to 2.17
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting and Setting Changes
Minimal Coming Soon – Coming Soon Page
≤2.10Update to 2.15