Database
WordPress Vulnerability Database (page 1353)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1WordPress Core < 5.0.1 Reflected Cross-Site Scripting
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- High7.5Sensitive Information Disclosure
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium4.3Authorization Bypass
WordPress
≤5.0Update to 3.7.28 or 3.8.28 or 3.9.26 or 4.0.25 or 4.1.25 or 4.2.22 or 4.3.18 or 4.4.17 or 4.5.16 or 4.6.13 or 4.7.12 or 4.8.8 or 4.9.9 or 5.0.1
- Medium5.4Cross-Site Scripting via post_meta
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤6.4.2Update to 6.5
- Medium6.1Import Cross-Site Scripting
Import and export users and customers
<1.12.1Update to 1.12.1
- High7.5Arbitrary File Read
WebP Express
<0.14.11Update to 0.14.11
- High7.1Reflected Cross-Site Scripting
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
<1.4.8.1Update to 1.4.8.1
- Critical9.8Cross-Site Scripting
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
≤2.9.1Update to 3.0.0
- High8.8Authenticated PHAR Deserialization
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN
≤3.0.0Update to 3.0.1
- Medium5.8Information Exposure
CSS & JavaScript Toolbox
≤8.4.1Update to 8.4.2
- Medium6.4Authenticated Stored Cross-SIte Scripting
LoginPress | wp-login Custom Login Page Customizer
<1.1.16Update to 1.1.16
- Medium5.4Author+ Stored Cross-Site Scripting
Advanced Custom Fields (ACF®)
<5.7.8Update to 5.7.8
- Critical9.8Local File Inclusion
WP Payeezy Pay
<2.98Update to 2.98
- High8.8Authenticated SQL Injection via Settings Import
LoginPress | wp-login Custom Login Page Customizer
<1.1.16Update to 1.1.16
- Medium5.3User Enumeration
WP JobHunt
<2.4Update to 2.4
- High8.8Unauthenticated Arbitrary Password Reset
WP JobHunt
<2.4Update to 2.4
- Medium4.7Authenticated Open Redirect
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤3.3.19Update to 3.3.19.1
- Medium5.5Authenticated Stored Cross-Site Scripting
WooCommerce
≤3.5.1Update to 3.5.2
- Critical9.8Improper Access Control
User Email Verification for WooCommerce
≤3.1.15Update to 3.2.0
- Medium6.1Cross-Site Request Forgery
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤2.0.32Update to 2.0.33
- Medium6.1Stored Cross-Site Scripting
Easy Testimonials
<3.6Update to 3.6
- Critical9.8PHP Object Injection
Patreon WordPress
<1.2.2Update to 1.2.2
- Medium5.4Stored Cross-Site Scripting
AMP for WP – Accelerated Mobile Pages
≤0.9.97.20Update to 0.9.97.21
- Critical9.8Remote Code Execution
Property Hive
<1.4.26Update to 1.4.26
- Medium6.1Cross-Site Scripting via begin_date, end_date, or form_id Parameter
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
<3.3.18Update to 3.3.18
- Medium5.4Authenticated Stored Cross-Site Scripting
Master Slider – Responsive Touch Slider
≤3.7.0Update to 3.7.5
- High8.8Cross-Site Request Forgery to Remote Code Execution
Redirection
≤3.6.3Update to 3.6.4
- Medium6.1Cross-Site Scripting
Weblizar Pin Feeds
<1.1.2Update to 1.1.2
- High8.8Cross-Site Request Forgery
Weblizar Pin Feeds
<1.1.2Update to 1.1.2
- Medium5.4Stored Cross-Site Scripting
Easy Custom Auto Excerpt
<2.4.7Update to 2.4.7