Database
WordPress Vulnerability Database (page 1341)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
OptionTree
≤2.5.5Update to 2.6
- Critical9.8SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<4.0.9Update to 4.0.9
- Medium6.1Cross-Site Scripting
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress
<4.0.2Update to 4.0.2
- High8.8Cross-Site Request Forgery
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
≤5.6Update to 5.6.1
- High8.8Cross-Site Request Forgery
Contact Form Email
≤1.2.65Update to 1.2.66
- Medium6.1Cross Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.3Update to 2.0.4
- Medium4.3Unauthorized Image File Upload
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.3Update to 2.0.4
- Medium4.3Directory Traversal
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.4Update to 2.0.4
- Medium6.1Cross Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤1.3.88Update to 2.0.4
- Critical9.8Donation Plugin and Fundraising Platform <= 2.5.0 - SQL Injection
GiveWP – Donation Plugin and Fundraising Platform
≤2.5.0Update to 2.5.1
- Medium6.1Cross-Site Scripting
Contact Form Email
≤1.2.65Update to 1.2.66
- Medium5.3Insecure Direct Object Reference
Wishlist for WooCommerce
≤1.2.6Update to 1.2.7
- High8.8Cross-Site Request Forgery
Social Feed Gallery
<2.4.8Update to 2.4.8
- High8.8Unauthenticated HTML Injection & Cross-Site Request Forgery
cformsII
<15.0.2Update to 15.0.2
- High7.2Missing Authorization
Simple 301 Redirects – Addon – Bulk Uploader
<1.2.5Update to 1.2.5
- Medium6.1Missing Authentication on Option Changes
Simple 301 Redirects – Addon – Bulk Uploader
<1.2.5Update to 1.2.5
- Medium5.4Authenticated Stored Cross-Site Scripting
PPOM – Product Addons & Custom Fields for WooCommerce
<18.4Update to 18.4
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Social LikeBox & Feed
≤2.8.4Update to 2.8.5
- High7.5Arbitrary Post Deletion
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
≤2.2.5Update to 2.2.6
- Critical9.8Options Change
Restaurant Reservations
≤1.3Update to 1.5
- Critical9.8PHP Object Injection
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<4.02.01Update to 4.02.01
- High8.8Cross-Site Request Forgery to Remote Code Execution
WP SVG Icons
<3.2.3Update to 3.2.3
- High8.8< 2.3 - Cross-Site Request Forgery
Pricing Table Plugin
<2.3Update to 2.3
- Medium6.1Unauthenticated Settings Update
Login or Logout Menu Item
<1.2.0Update to 1.2.0
- Medium6.3Missing Authorization on AJAX Actions
File Manager
≤4.8Update to 4.9
- Medium6.1Open Redirect
Learning Courses
≤4.7Update to 4.8
- Critical9.8SQL Injection
Popup Builder – Create highly converting, mobile friendly marketing popups.
≤3.44Update to 3.45
- Critical9.6Unauthenticated Arbitrary Options Update
Hotel Booking
<2.5Update to 2.5
- Medium6.4Authenticated (Admin+) Stored Cross-Site Scripting
Rencontre – Dating Site
<3.2.2Update to 3.2.2
- Medium6.1Open Redirect
Travel Management
≤1.6.1Update to 1.7