Database
WordPress Vulnerability Database (page 1349)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery
WDContactFormBuilder
<1.0.69Update to 1.0.69
- Medium6.4Authenticated Stored Cross-Site Scripting
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
<2.8.2Update to 2.8.2
- Medium6.1Cross-Site Scripting
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤5.1.1Update to 5.1.2
- Medium6.4Authenticated Stored Cross-Site Scripting
CarSpot – Dealership Wordpress Classified Theme
<2.1.7Update to 2.1.7
- Critical9.8Arbitrary File Upload
SupportCandy – Helpdesk, Support Ticket System & AI Chatbot
<2.0.1Update to 2.0.1
- High8.1PHP Object Injection
OptionTree
≤2.6.0Update to 2.7.0
- Medium6.1Reflected Cross-Site Scripting via URL parameter
MailPoet – Newsletters, Email Marketing, and Automation
<3.23.2Update to 3.23.2
- Medium6.1Cross-Site Scripting
Download Manager
<2.9.94Update to 2.9.94
- Critical9.6Cross-Site Request Forgery to Cross-Site Scripting via Comments
WordPress
≤5.1Update to 3.7.29 or 3.8.29 or 3.9.27 or 4.0.26 or 4.1.26 or 4.2.23 or 4.3.19 or 4.4.18 or 4.5.17 or 4.6.14 or 4.7.13 or 4.8.9 or 4.9.10 or 5.0.4 or 5.1.1
- Critical9.8Unauthenticated Arbitrary Options Update
Visual CSS Style Editor
<7.2.1Update to 7.2.1
- High8.5SQL Injection
Advanced Contact form 7 DB
<1.6.1Update to 1.6.1
- High8.1File Uploads <= 3.0.22 - Unauthenticated Arbitrary File Upload
Ninja Forms - File Uploads
<3.0.23Update to 3.0.23
- High7.2Missing Authorization to Stored Cross-Site Scripting
YUZO
<5.12.94Update to 5.12.94
- Medium6.1Referer Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤12.6.3Update to 12.6.4
- High8.8Remote Code Execution
Groundhogg — CRM, Newsletters, and Marketing Automation
<1.3.5Update to 1.3.5
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Rencontre – Dating Site
≤3.1.3Update to 3.2
- High7.3Missing Authorization and No Direct File Access Restrictions
ARI Adminer – WordPress Database Manager
≤1.1.14Update to 1.1.15
- High8.1Cross-Site Request Forgery to Local File Inclusion
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.13.4Update to 1.13.5
- High8.8Cross-Site Request Forgery
Contact Form by WD – responsive drag & drop contact form builder tool
<1.13.5Update to 1.13.5
- High8.8Cross-Site Request Forgery
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<2.0.40Update to 2.0.40
- Critical9.8Backdoor
Pipdig Power Pack (P3)
≤4.7.3Update to 4.8.0
- High7.5Denial of Service
article2pdf
≤0.27No patch available
- Medium4.3Insufficient Restrictions on Option Changes
Easy Updates Manager
≤8.0.4Update to 8.0.5
- Medium6.1Reflected Cross-Site Scripting
Social Media Share Buttons & Social Sharing Icons
≤2.1.7Update to 2.1.9
- Medium6.4Cross-Site Scripting
Easy Google Adsense and Banner Ads Manager – AdsforWP
<1.6Update to 1.6
- Medium6.4Missing Authorization
Nested Pages
≤3.0.7Update to 3.0.8
- Critical9.10.27 - Information Disclosure
article2pdf
≤0.27No patch available
- High7.2Cross-Site Scripting
PWA for WP – Progressive Web Apps Made Simple
<1.0.9Update to 1.0.9
- Critical9.8Unauthenticated Settings Update to Remote Code Execution
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤5.1.2Update to 5.1.3
- High7.4SQL Injection
Duplicate Page
≤3.3Update to 3.4