Database
WordPress Vulnerability Database (page 1348)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8SQL Injection
I Recommend This – Love/Like Button for WordPress Posts
<3.7.3Update to 3.7.3
- Medium4.3Reflected Cross-Site Scripting
MaxButtons – Create buttons
<1.26.1Update to 1.26.1
- High7.4Authenticated Access or Cross-Site Request Forgery leading to SQL Injection via orderby, order Parameters
All-In-One Security (AIOS) – Security and Firewall
<3.8.3Update to 3.8.3
- High8.8Authenticated (Subscriber+) SQL Injection via Shortcode
I Recommend This – Love/Like Button for WordPress Posts
≤3.7.2Update to 3.7.3
- High7.3Authorization Bypass
MailPoet Newsletters (Previous)
≤2.6.7Update to 2.6.8
- Medium6.3Cross-Site Request Forgery
MailPoet Newsletters (Previous)
<2.6.11Update to 2.6.11
- Critical9.8SQL Injection
gallery-objects
≤0.4No patch available
- Medium6.11.6.1 - Cross-Site Scripting
Cakifo
1.0 – 1.6.1Update to 1.6.2
- Medium6.3Multiple Cross-Site Request Forgery
Disqus Comment System
<2.79Update to 2.79
- High7.1Cross-Site Scripting
Login Widget With Shortcode
<3.2.1Update to 3.2.1
- Medium5.3Improper Input Validation
WP-Ban
<1.64Update to 1.64
- High7.3Cross-Site Scripting via range Parameter
WooCommerce
<2.2.3Update to 2.2.3
- Critical9.8SQL Injection
WP Support Plus Responsive Ticket System
<4.2Update to 4.2
- Medium5.3Full Path Disclosure
WP Support Plus Responsive Ticket System
<4.2Update to 4.2
- Critical9.8Arbitrary File Download
Epic Church by Organized Themes
≤3.6No patch available
- High7.5Arbitrary File Download
Antioch
≤1.3No patch available
- High8.8Responsive Photo Gallery <= 1.0.7 - SQL Injection
Image Gallery - Responsive Photo Gallery
≤1.0.7Update to 1.0.8
- High8.8Arbitrary File Upload
Slideshow Gallery LITE
<1.4.7Update to 1.4.7
- Medium5.3Security Bypass
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤2.9.2Update to 1.9.4 or 2.0.9 or 2.1.4 or 2.2.7 or 2.3.7 or 2.4.4 or 2.5.2 or 2.6.3 or 2.7.2 or 2.8.2 or 2.9.3
- Medium6.1Cross-Site Scripting
Memphis Documents Library
<3.0Update to 3.0
- Medium6.1Reflected Cross-Site Scripting
Iptanus File Upload
≤2.4.3Update to 2.4.4
- High7.2Arbitrary File Overwrite
Access Governance for WordPress (aka AAM)
<2.8.3Update to 2.8.3
- High7.5Directory Traversal
WP Source Control
<3.1.1Update to 3.1.1
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Improved user search in backend
≤1.2.5Update to 1.2.6
- Medium5.4Cross-Site Request Forgery
Disqus Comment System
<2.76Update to 2.76
- Medium6.1Cross-Site Scripting
MobiLoud – WordPress Mobile Apps – Convert your WordPress Website to Native Mobile Apps
<2.3.8Update to 2.3.8
- High8.3SQL Injection
GB Gallery Slideshow
<1.6Update to 1.6
- Medium6.3Cross-Site Request Forgery
Iptanus File Upload
<2.4.2Update to 2.4.2
- Medium6.5Unauthenticated Stored Cross-Site Scripting
Job Board by BestWebSoft
≤1.0.0Update to 1.0.1
- Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
BestWebSoft's Twitter
≤1.3.2Update to 1.3.7