Database
WordPress Vulnerability Database (page 1343)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Authentication Bypass to Arbitrary File Upload
Pixabay Images
≤2.0Update to 2.4
- High8.8Arbitrary File Upload
Pixabay Images
≤2.3Update to 2.4
- Medium6.1Cross-Site Scripting
Pixabay Images
<2.4Update to 2.4
- Critical9.8Arbitrary File Upload
Holding Pattern
≤0.6No patch available
- High7.3Missing Authorization
Pie Register – User Registration, Profiles & Content Restriction
≤2.0.13Update to 2.0.14
- High7.5Directory Traversal
GI-Media Library
<3.0Update to 3.0
- Medium4.8Authenticated Stored Cross-Site Scripting
Simple Security
≤1.1.5Update to 1.1.6
- Medium6.1Stored Cross-Site Scripting
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
<3.5.6Update to 3.5.6
- Medium6.1Cross-Site Scripting
Pods – Custom Content Types and Fields
≤2.4.3Update to 2.5
- Critical9.6Multiple Cross-Site Request Forgery
Pods – Custom Content Types and Fields
≤2.4.3Update to 2.5
- Critical9.8Unauthenticated Blind SQL Injection via order_by Parameter
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
<1.2.8Update to 1.2.8
- Medium6.1Reflected Cross-Site Scripting
Greg's High Performance SEO
<1.6.2Update to 1.6.2
- High8.8Arbitrary File Upload
WP EasyCart: Shopping Cart and eCommerce Store
<3.0.16Update to 3.0.16
- Medium6.1Cross-Site Scripting
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
<3.9.3Update to 3.9.3
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
simpleflickr
≤3.0.3No patch available
- Medium6.1Cross-Site Scripting
Relevanssi – A Better Search
<3.3.8Update to 3.3.8
- High8.8Cross-Site Request Forgery
Banner Effect Header
<1.2.8Update to 1.2.8
- Medium6.5WordPress Ecommerce < 1.5.4 - Directory Traversal to Arbitrary File Disclosure
Cart66 Lite :: WordPress Ecommerce
<1.5.4Update to 1.5.4
- Critical9.8Arbitrary File Upload
cformsII
<14.8Update to 14.8
- High7.5Arbitrary File Read
Sell Downloads
≤1.0.1Update to 1.0.2
- Medium6.1Cross-Site Scripting
Frontend Uploader
<0.9.4Update to 0.9.4
- High8.8SQL Injection
Cart66 Lite :: WordPress Ecommerce
<1.5.4Update to 1.5.4
- Medium6.1Reflected Cross-Site Scripting
wordpress-backup-to-dropbox
<4.1Update to 4.1
- Medium6.1Cross-Site Request Forgery
PictoBrowser
≤0.3.1No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
PWGRandom
≤1.11No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
wp-unique-article-header-image
≤1.0No patch available
- High8.8Cross-Site Request Forgery
gSlideShow
≤0.1No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
Post to Twitter
≤0.7No patch available
- High8.8Cross-Site Request Forgery leading to Cross-Site Scripting
wp-limit-posts-automatically
≤0.7No patch available
- High7.2Cross-Site Scripting
Slider Revolution
≤4.2.2Update to 4.2.3