Database
WordPress Vulnerability Database (page 1341)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Arbitrary File Upload
Work The Flow File Upload
≤2.5.2Update to 2.5.3
- High7.2Stored Cross-Site Scripting
WooCommerce
<2.3.6Update to 2.3.6
- Medium5.4Authenticated Cross-Site Scripting
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.2.13Update to 1.2.13
- Critical9.8SQL Injection
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets
<3.2.5Update to 3.2.5
- High7.2Authenticated (Admin+) SQL Injection
Responsive Slider – Image Slider – Slideshow for WordPress
<2.7.0Update to 2.7.0
- Critical9.8SQL Injection
Contact Form, Drag and Drop Form Builder Plugin – Live Forms
<3.2.0Update to 3.2.0
- Medium6.1Cross-Site Scripting
wpml
<3.1.9Update to 3.1.9
- High8.8Blind SQL Injection
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤1.7.3Update to 1.5.7 or 1.6.4 or 1.7.4
- Critical9.8SQL Injection via lang Parameter
WPML Multilingual CMS
≤3.1.9Update to 3.1.9.1
- High7.5Arbitrary Deletion of Content
WPML Multilingual CMS
≤3.1.9Update to 3.1.9.1
- High7.5Cross-Site Request Forgery
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤1.7.3.3Update to 1.5.7 or 1.6.4 or 1.7.4
- Critical9.8Arbitrary File Upload
WPshop 2 – E-Commerce
<1.3.9.6Update to 1.3.9.6
- Medium4.9Authenticated (Admin+) Path Traversal
IP Blacklist Cloud
≤3.42Update to 3.43
- Low3.1Cross-Site Request Forgery
All-In-One Security (AIOS) – Security and Firewall
≤3.8.9Update to 3.9.0
- Critical9.0SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<3.8.8Update to 3.8.8
- Critical9.8Arbitrary File Upload
DesignFolio Pllus
all versionsNo patch available
- Medium4.3Cross-site request forgery via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php
Contact Form DB
≤2.8.29Update to 2.8.32
- Medium5.3CAPTCHA Bypass
reCaptcha by BestWebSoft
<1.13Update to 1.13
- Medium5.4Authorization Bypass
WPML Multilingual CMS
<3.1.9Update to 3.1.9.1
- Medium6.1Cross-Site Scripting
WP Media Cleaner
≤2.2.6Update to 2.4.0
- High8.83.0.20 - Privilege Escalation
WP EasyCart: Shopping Cart and eCommerce Store
1.1.30 – 3.0.20Update to 3.0.21
- Medium6.1Reflected Cross-Site Scripting
WP All Import Pro
≤4.1.1Update to 4.1.2
- Medium6.5Authenticated Cross-Site Scripting
Contact Form DB
≤2.8.26Update to 2.8.28
- High8.8Blind SQL Injection
WonderPlugin Audio Player
≤2.0Update to 2.1
- High7.1Multiple Cross-Site Scripting
WonderPlugin Audio Player
<2.1Update to 2.1
- High8.2Arbitrary Backup Creation and Download
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
<0.5.10Update to 0.5.10
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Easy Social Icons
≤1.2.2Update to 1.2.3
- Medium5.4Reflected Cross Site Scripting
Image Metadata Cruncher
≤1.8No patch available
- Medium6.1Reflected Cross-Site Scripting
PlusCaptcha
≤2.0.6Update to 2.0.14
- High8.8Arbitrary File Upload
Fusion
≤3.1No patch available