Database
WordPress Vulnerability Database (page 1342)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.2Unauthenticated Arbitrary Options Change
Donations
<1.4Update to 1.4
- High8.8Missing Authorization to Settings Import
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
<2.2.5Update to 2.2.5
- Medium6.1Unauthenticated WordPress Options Update
ND Shortcodes
<6.0Update to 6.0
- Critical9.8SQL Injection
JoomSport – for Sports: Team & League, Football, Hockey & more
<3.4Update to 3.4
- Critical9.1Directory Traversal
WP Fastest Cache – WordPress Cache Plugin
≤0.8.9.5Update to 0.8.9.6
- High8.8Cross-Site Request Forgery
Simple Membership
<3.8.5Update to 3.8.5
- Medium6.5Cross-Site Request Forgery
Custom Simple Rss
<2.0.7Update to 2.0.7
- High7.2Unauthenticated HTML injection
Contact Form & SMTP Plugin for WordPress by PirateForms
<2.5.2Update to 2.5.2
- Medium6.1Cross-Site Scripting
Animate It!
≤2.3.5Update to 2.3.6
- Medium6.1Cross-Site Scripting
Animate It!
≤2.3.5Update to 2.3.6
- High8.8Cross-Site Request Forgery
Animate It!
≤2.3.5Update to 2.3.6
- Critical9.8SQL Injection
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.5.31Update to 1.5.31
- Critical9.8SQL Injection
Blog2Social: Social Media Auto Post & Scheduler
<5.6.0Update to 5.6.0
- Medium6.1Reflected Cross-Site Scripting
DTX – Dynamic Text Extension for Contact Form 7
<2.0.3Update to 2.0.3
- Medium5.3Arbitrary Media File Disclosure
WPS Cleaner
≤1.4.4Update to 1.4.5
- Critical9.8Authorization Bypass via IP Spoofing
WPS Limit Login
<1.4.6.1Update to 1.4.6.1
- Medium5.3Login Page Disclosure via 'action=rp'
WPS Hide Login
≤1.5.2.2Update to 1.5.3
- High8.8Multiple Cross-Site Request Forgery
WPS Bidouille
≤1.12.2Update to 1.12.4
- Critical9.8Directory Traversal
WPS Child Theme Generator
≤1.1Update to 1.2
- High7.2Stored Cross-Site Scripting
WPS Limit Login
<1.4.6.1Update to 1.4.6.1
- Medium6.3Missing Authorization Checks
WPS Cleaner
≤1.4.4Update to 1.4.5
- High8.8Cross-Site Request Forgery
WPS Limit Login
<1.4.6.1Update to 1.4.6.1
- Medium5.3Login Page Disclosure via 'action=confirmaction'
WPS Hide Login
<1.5.3Update to 1.5.3
- Medium5.3Login Page Disclosure via Referer Header
WPS Hide Login
≤1.5.2.2Update to 1.5.3
- Medium6.4Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.53Update to 2.0.54
- Critical9.8SQL Injection
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤4.1.7Update to 4.1.8
- Medium5.3Login Page Disclosure via 'adminhash'
WPS Hide Login
≤1.5.2.2Update to 1.5.3
- Critical9.8SQL Injection
OnionBuzz
<1.2.7Update to 1.2.7
- Medium6.4Stored Cross-Site Scripting
Real Estate 7 WordPress
<2.9.1Update to 2.9.1
- Critical10.0OnionBuzz < 1.2.2 - SQL Injection
OnionBuzz
≤1.2.1Update to 1.2.2