Database
WordPress Vulnerability Database (page 1343)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.5Local File Inclusion
Adaptive Images for WordPress
<0.6.67Update to 0.6.67
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
WP Code Highlight.js
<0.6.3Update to 0.6.3
- High7.5Arbitrary File Deletion
Adaptive Images for WordPress
<0.6.67Update to 0.6.67
- High8.8Cross-Site Request Forgery
Category Specific RSS feed Subscription
≤2.0Update to 2.1
- Critical9.8SQL Injection
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
<1.5.0Update to 1.5.0
- Medium5.5Authenticated Stored Cross-Site Scripting
All-in-One WP Migration and Backup
<7.0Update to 7.0
- Medium6.4Stored Cross-Site Scripting
OneSignal – Web Push Notifications
≤1.17.7Update to 1.17.8
- Medium6.5Unauthenticated Settings Reset
Coming Soon Page & Maintenance Mode
≤1.8.1Update to 1.8.2
- High7.2Stored Cross Site Scripting
Coming Soon Page & Maintenance Mode
<1.8.2Update to 1.8.2
- High8.8SQL Injection
WebLibrarian
≤3.5.4Update to 3.5.5
- High8.8Cross-Site Request Forgery
WordPress Ultra Simple Paypal Shopping Cart
≤4.4Update to 4.5
- High8.8Authenticated Remote Code Execution
Ad Inserter – Ad Manager & AdSense Ads
≤2.4.21Update to 2.4.22
- High8.8Cross-Site Request Forgery
School Management System for Wordpress
<57.0Update to 57.0
- Medium6.1Cross-Site Scripting
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
≤4.1.6Update to 4.1.7
- High7.1Cross-Site Scripting
WP Code Highlight.js
≤0.6.3No patch available
- High7.5Authenticated Path Traversal
Ad Inserter – Ad Manager & AdSense Ads
≤2.4.19Update to 2.4.20
- Critical9.8SQL Injection
FV Flowplayer Video Player
≤7.3.18.727Update to 7.3.19.727
- High8.8Cross-Site Request Forgery
One Click SSL
<1.4.7Update to 1.4.7
- Medium6.3Unauthorized Settings Update
LoginPress | wp-login Custom Login Page Customizer
≤1.1.13Update to 1.1.14
- High7.2Authenticated SQL Injection
AdRotate Banner Manager
≤5.2Update to 5.3
- Medium6.5Missing Authorization to Arbitrary Options Update
Hybrid Composer
≤1.4.6Update to 1.4.7
- Medium6.5Information Exposure
WPGraphQL
≤0.3.4Update to 0.3.5
- Medium6.1Reflected Cross-Site Scripting
Gallery PhotoBlocks
<1.1.43Update to 1.1.43
- Medium6.4Cross-Site Scripting
Icegram Engage – Popups, Welcome Bars, Optins, Slide-Ins & Lead Generation for WordPress
≤1.10.28.2Update to 1.10.29
- Medium6.1Cross-Site Scripting
Appointment Hour Booking – Booking Calendar
<1.1.46Update to 1.1.46
- Medium6.1Reflected Cross-Site Scripting
Simple Link Directory – AI Powered
<7.3.5Update to 7.3.5
- Medium6.4Authenticated Stored Cross Site Scripting
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤11.5Update to 11.6-RC5
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
<7.11.35Update to 7.11.35
- Medium6.4Real Estate <= 4.1 - Cross-Site Scripting
Zoner - Real Estate WordPress Theme
≤4.1Update to 4.1.1
- High7.2SQL Injection
Rencontre – Dating Site
<3.1.3Update to 3.1.3