Database
WordPress Vulnerability Database (page 1351)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Remote Code Execution
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium6.4Stored Cross-Site Scripting
Launcher: Coming Soon & Maintenance Mode
<1.0.11Update to 1.0.11
- Medium6.5Authenticated Denial of Service
PS PHPCaptcha WP
≤1.1.0Update to 1.2.0
- Medium5.4PHP Object Injection
Advanced Custom Fields (ACF®)
≤5.7.11Update to 5.7.12
- Medium6.1Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤7.0Update to 7.0.1
- Medium6.5Upload Directory Traversal
WP Cost Estimation & Payment Forms Builder
<9.660Update to 9.660
- Critical9.8Missing Authorization to Arbitrary File Upload/Delete
WP Cost Estimation & Payment Forms Builder
<9.644Update to 9.644
- Medium6.1Cross-Site Scripting
Newspaper - News & WooCommerce WordPress Theme
<9.2.2Update to 9.2.2
- High8.8SQL Injection
Accessibility Suite by Ability, Inc
<2.0.11Update to 2.0.11
- Medium6.4Directory WordPress Theme | Directory & Listings <= 2.9.2 - Stored Cross-Site Scripting
Superlist - Directory WordPress Theme | Directory & Listings
≤2.9.2No patch available
- Medium6.32.0.21 - Missing Authorization
Simple Social Media Share Buttons – Social Sharing for Everyone
2.0.4 – 2.0.21Update to 2.0.22
- Medium6.1Cross-Site Scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.6Update to 1.6
- Medium6.5SQL Injection
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
<1.6Update to 1.6
- Medium6.1Reflected Cross-Site Scripting
NextScripts: Social Networks Auto-Poster
<4.2.8Update to 4.2.8
- Medium6.1Cross-Site Scripting
GiveWP – Donation Plugin and Fundraising Platform
<2.3.1Update to 2.3.1
- Medium6.1Cross-Site Scripting
3CX Free Live Chat, Calls & Messaging
<8.0.18Update to 8.0.18
- Medium6.1Reflected Cross-Site Scripting via poll_id Parameter
YOP Poll
<6.0.3Update to 6.0.3
- Medium6.1Reflected Cross-Site Scripting
WP Go Maps – Google Map, OpenStreetMap, Leaflet & Store Locator
≤7.10.41Update to 7.10.43
- Medium6.1Reflected Cross-Site Scripting
Contact Form Email
<1.2.66Update to 1.2.66
- Medium6.1Reflected Cross-Site Scripting
Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
≤2.8Update to 2.8.1
- High7.2Stored Cross-Site Scripting
WP Support Plus Responsive Ticket System
<9.1.2Update to 9.1.2
- High8.8PHP Object Injection
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤3.1.5Update to 3.1.6
- Medium6.1Stored Cross-Site Scripting
WP Support Plus Responsive Ticket System
<9.1.2Update to 9.1.2
- Medium6.1Cross-Site Scripting
Parallax Scroll by adamrob.co.uk
<2.1Update to 2.1
- High8.1WordPress Custom Fields Framework <= 4.16.2 - File Deletion via attachment_id Parameter
Meta Box – A Framework for Dynamic Websites
<4.16.3Update to 4.16.3
- High7.5Mishandling of File Upload
Meta Box – A Framework for Dynamic Websites
≤4.16.1Update to 4.16.2
- High7.5Distributed Denial-of-Service
OneLogin SAML SSO
≤2.8.0Update to 3.0.0
- Critical9.8Unauthenticated PHP Object Injection
YASR – Yet Another Star Rating Plugin for WordPress
≤1.8.6Update to 1.8.7
- Medium4.3Path Traversal
Health Check & Troubleshooting
≤1.2.3Update to 1.2.4
- Medium6.1Reverse Tabnabbing
Wise Chat
<2.7Update to 2.7