Database
WordPress Vulnerability Database (page 1350)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High7.4SQL Injection
Duplicate Page
≤3.3Update to 3.4
- High7.2VulnCrest analysisKEVPoCUnauthenticated Arbitrary Settings Update
Social Sharing Plugin – Social Warfare
<3.5.3Update to 3.5.3
- Medium6.1Reflected Cross-Site Scripting
Font Organizer
≤2.1.1No patch available
- High7.5Sensitive Information Disclosure
WP Human Resource Management
<2.2.6Update to 2.2.6
- Critical9.8Missing Authorization to Arbitrary Options Update
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more
<1.3.9.1Update to 1.3.9.1
- High8.8SQL Injection via Order By
User Login History
1.7.0 – 1.7.0Update to 1.7.1
- High8.8SQL Injection via OrderBy
User Login History
1.7.0 – 1.7.0Update to 1.7.1
- Critical9.3SQL Injection
Better Search – Relevant search results for WordPress
<2.2.3Update to 2.2.3
- High8.8Cross-Site Request Forgery
Import and export users and customers
<1.14.0.3Update to 1.14.0.3
- Critical9.8Missing Authorization
Speed Optimizer – The All-In-One Performance-Boosting Plugin
<5.0.13Update to 5.0.13
- Medium6.1Cross-Site Scripting
Import and export users and customers
<1.14.0.3Update to 1.14.0.3
- Critical9.8Local File Inclusion
GraceMedia Media Player
≤1.0No patch available
- Critical9.8Missing Authorization
Caldera Forms Pro
<1.8.2Update to 1.7.7 or 1.8.2
- Critical9.8Remote Code Execution via unrestricted file upload
wp-live-chat-support-pro
≤8.0.06Update to 8.0.07
- Medium6.1Stored Cross-Site Scripting
WooCommerce Subscription
<2.6.3Update to 2.6.3
- High7.2Stored Cross-Site Scripting
Abandoned Cart Lite for WooCommerce
<5.2.0Update to 5.2.0
- High7.2Authenticated (Admin+) SQL Injection
Rencontre – Dating Site
≤3.2.1Update to 3.2.2
- Medium6.1Cross-Site Scripting
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
≤6.2.1Update to 6.2.2
- High8.8Cross-Site Request Forgery to Back-Up Deletion
Smash Balloon Social Photo Feed – Easy Social Feeds Plugin
<1.12Update to 1.12
- Medium6.1Cross-Site Scripting via tribe_paged Parameter
The Events Calendar
<4.8.2Update to 4.8.2
- High8.8Cross-Site Request Forgery
Smart Forms – when you need more than just a contact form
<2.6.26Update to 2.6.26
- High8.3Remote Image File Inclusion
Indeed Membership Pro
≤7.5Update to 7.6
- High8.8Cross-Site Request Forgery
FormCraft – Form Builder
≤1.2.1Update to 1.2.2
- Critical9.8Arbitrary File Upload
Indeed Membership Pro
≤7.5Update to 7.6
- High8.8Cross-Site Request Forgery
FormCraft – Form Builder
<1.2.2Update to 1.2.2
- High8.8Missing Authorization to Arbitrary Options Update
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
<3.1.7Update to 3.1.7
- High8.8Multiple Cross-Site Request Forgery vulnerabilities
LoginWP (Formerly Peter's Login Redirect)
≤2.9.1Update to 2.9.2
- High7.5Authorization Bypass
WP Human Resource Management
<2.2.6Update to 2.2.6
- Medium6.1Stored Cross-Site Scripting
WooCommerce
<3.5.5Update to 3.5.5
- Medium6.5Path Traversal and Local File Inclusion
WordPress
≤5.0.2Update to 5.0.3