Database
WordPress Vulnerability Database (page 1346)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery to Site Settings Changes
Facebook Chat Plugin – Live Chat Plugin for WordPress
<1.3Update to 1.3
- Medium6.1Cross-Site Scripting
Download Manager
<2.9.97Update to 2.9.97
- High8.8Privilege Escalation
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.39Update to 2.0.40
- High8.8Cross-Site Request Forgery to Arbitrary File Upload
LionScripts: IP Blocker Lite
≤10.4Update to 10.5
- Medium4.3Unauthorized Profile Modification
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.39Update to 2.0.40
- High8.8Cross-Site Request Forgery
WP-Members Membership Plugin
≤3.2.7Update to 3.2.8.1
- Medium6.1Cross-Site Scripting
Real Estate Manager – Property Listing and Agent Management
≤6.8Update to 7.0
- High8.8Cross-Site Request Forgery
Contest Gallery Commerce – Upload, Vote & Sell with PayPal & Stripe
≤10.4.4Update to 10.4.5
- Medium6.1Stored Cross-Site Scripting
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
<2.9.16Update to 2.9.16
- High8.8Arbitrary File Upload
Insert or Embed Articulate Content into WordPress
<4.2999Update to 4.2999
- Medium6.4Authenticated Stored Cross-Site Scripting
Support Board
<1.2.9Update to 1.2.9
- High8.8Cross-site Request Forgery
Attendance Manager
≤0.5.6Update to 0.5.7
- Medium6.1Cross-Site Scripting
Online Lesson Booking
≤0.8.6Update to 0.8.7
- Medium6.1Stored Cross-Site Scripting
Attendance Manager
≤0.5.6Update to 0.5.7
- High8.8Cross-Site Request Forgery
Online Lesson Booking
≤0.8.6Update to 0.8.7
- Critical9.8Local File Inclusion
Revamp CRM for WooCommerce
<1.0.4Update to 1.0.4
- High8.8Cross-Site Request Forgery
Breadcrumbs by menu
≤1.0.1Update to 1.0.3
- Medium6.1Cross-Site Scripting
Breadcrumbs by menu
<1.0.3Update to 1.0.3
- High7.5Unauthorized Account Creation
ConvertPlus
≤3.4.4Update to 3.4.5
- High8.8Arbitrary File Upload
Crelly Slider
≤1.3.4Update to 1.3.5
- Medium4.3Cross-Site Request Forgery
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
<7.11.28Update to 7.11.28
- High7.2Open Redirect
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
≤2.0.5Update to 2.0.6
- Medium6.1Cross-Site Scripting
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
≤1.0.8Update to 1.0.9
- High7.2Stored Cross-Site Scripting
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
<1.0.9Update to 1.0.9
- Medium6.4Stored Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.6.5Update to 12.6.6.1
- High8.8Cross-Site Request Forgery
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
<1.0.9Update to 1.0.9
- Critical9.8Unprotected Functions
3CX Free Live Chat, Calls & Messaging
<8.0.33Update to 8.0.33
- High8.8Cross-Site Request Forgery
Zoho SalesIQ – Live chat, chatbots, and visitor tracking
≤1.0.8Update to 1.0.9
- Critical9.8Unauthenticated Administrator Creation
ConvertPlus
<3.4.3Update to 3.4.3
- High8.8Authenticated Arbitrary File Upload
Finale Lite – Sales Countdown Timer & Discount for WooCommerce
<2.9.1Update to 2.9.1