Database
WordPress Vulnerability Database (page 1347)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Privilege Escalation
Slick Popup: Contact Form 7 Popup Plugin
<1.7.2Update to 1.7.2
- Medium6.1Cross-Site Scripting
SAML Single Sign On – SSO Login
<4.8.73Update to 4.8.73
- High8.8Cross-Site Request Forgery
Affiliates Manager
<2.6.6Update to 2.6.6
- High8.8Cross-site Request Forgery
Related YouTube Videos
<1.9.9Update to 1.9.9
- High7.2Stored Cross-Site Scripting
Hostel
≤1.1.3Update to 1.1.4
- High7.8Unauthenticated CSV Injection
Hustle – Email Marketing, Lead Generation, Optins, Popups
≤6.0.7Update to 6.0.8.1
- High7.2Cross-Site Scripting
Event Monster – Event Manager, Event Booking, Event Ticket & Registration
<1.0.6Update to 1.0.6
- High8.6Arbitrary File Deletion
Simple File List
≤3.2.4Update to 3.2.5
- High7.5Arbitrary File Download
Simple File List
≤3.2.7Update to 3.2.8
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
<4.8.4Update to 4.8.4
- Medium5.4Server Side Request Forgery
W3 Total Cache
≤0.9.7.3Update to 0.9.7.4
- High8.8Unauthenticated Arbitrary Options Update
User Email Verification for WooCommerce
≤3.3.0Update to 3.4.0
- Critical9.8Cross-Site Request Forgery
WP Booking System – Booking Calendar
<1.5.2Update to 1.5.2
- Medium6.1Unauthenticated Stored Cross-Site Scripting from Visitors
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce
≤4.8Update to 4.8.1
- Critical9.8SQL Injection
FV Flowplayer Video Player
<7.3.15.727Update to 7.3.15.727
- Medium6.1Unauthenticated Stored Cross-Site Scripting
FV Flowplayer Video Player
≤7.3.13.727Update to 7.3.14.727
- Medium5.3Sensitive Information Exposure
FV Flowplayer Video Player
≤7.3.14.727Update to 7.3.15.727
- High8.8Cross-Site Request Forgery
SAML Single Sign On – SSO Login
≤4.8.75Update to 4.8.76
- High8.1Object Injection Bypass
OptionTree
≤2.7.2Update to 2.7.3
- High8.1Object Injection Bypass
OptionTree
≤2.7.2Update to 2.7.3
- Medium6.1Open Redirect
Newsletter Manager
≤1.4Update to 1.5
- Medium5.4Cross-Site Scripting via show_products_page_limit parameter
Woocommerce Products Price Bulk Edit
≤2.0No patch available
- High7.2Unauthenticated Stored Cross-Site Scripting
Live Chat with Messenger Customer Chat
≤1.4.6Update to 1.4.7
- Medium4.8Cross-Site Scripting
Toggle The Title
≤1.4No patch available
- Medium5.3Sensitive Data Exposure
FV Flowplayer Video Player
<7.3.15.727Update to 7.3.15.727
- Critical9.3Unauthenticated SQL Injection
FV Flowplayer Video Player
<7.3.15.727Update to 7.3.15.727
- Medium6.1Unauthenticated Stored Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
≤8.0.26Update to 8.0.27
- Medium4.9Authenticated Local File Inclusion
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
≤1.5.24Update to 1.5.25
- Medium5.4Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.4.7Update to 2.4.7
- High8.3Unauthenticated Stored Cross-Site Scripting
Register IPs
<1.8.1Update to 1.8.1