Database
WordPress Vulnerability Database (page 1390)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Critical9.8Remote Code Execution
Robo Gallery – Photo & Image Slider
<2.0.15Update to 2.0.15
- High7.5Sensitive Information Disclosure
Easy Photo Album
≤1.1.5Update to 1.1.6
- High8.8Cross-Site Request Forgery
WP Database Backup – Unlimited Database & Files Backup by Backup for WP
≤4.3Update to 4.3.1
- Medium6.1Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
<1.3.40Update to 1.3.40
- Critical9.8SQL Injection
All-In-One Security (AIOS) – Security and Firewall
<4.0.7Update to 4.0.7
- Medium6.1Reflected Cross-Site Scripting
Post Duplicator
≤2.16Update to 2.17
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Lightbox Plus
≤2.7.2No patch available
- Low3.3Authenticated Cross-Site Scripting
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
<5.3.5Update to 5.3.5
- Medium6.1Cross-Site Scripting
WP Customer Reviews
<3.0.9Update to 3.0.9
- High8.8Authenticated Privilege Escalation
User Role Editor
<4.25Update to 4.25
- High7.2Stored Cross-Site Scripting
WP Cerber Security, Anti-spam & Malware Scan
<2.7Update to 2.7
- Medium6.1Cross-Site Scripting
ScoreMe
≤2016-04-01No patch available
- High7.5Directory Traversal
Zedna eBook download
<1.2Update to 1.2
- Medium6.1Unauthenticated Cross-Site Scripting
WP Favorite Posts
≤1.6.5Update to 1.6.6
- Medium6.1Cross-Site Scripting
Claptastic Clap! Button
≤1.3No patch available
- High7.1Cross-Site Scripting
Cloudflare
<1.3.21Update to 1.3.21
- Medium6.1Cross-Site Scripting
Music Store – WordPress eCommerce
≤1.0.41Update to 1.0.43
- High7.5Local File Inclusion
IMDB Profile Widget
<1.0.9Update to 1.0.9
- Medium6.4Authenticated Stored Cross-Site Scripting
External Links – nofollow, noopener & new window
<1.81Update to 1.81
- High8.1Unauthenticated Local File Inclusion
Issuu Panel
<1.6.6No patch available
- High7.5Arbitrary File Download
Memphis Documents Library
≤3.1.5Update to 3.1.6
- Critical9.8Local/Remote File Inclusion
Brandfolder – Digital Asset Management Simplified.
<3.0.1Update to 3.0.1
- Critical9.8Local File Inclusion
A/B Test for WordPress
≤1.0.7No patch available
- Medium6.1Cross-Site Scripting
Slideshow Gallery LITE
≤1.6Update to 1.6.1
- High7.2Stored Cross-Site Scripting
Resume Submissions & Job Postings
≤2.5.3No patch available
- High7.2Cross-Site Scripting
BulletProof Security
≤.53.2Update to .53.3
- High8.8Cross-Site Request Forgery
Nextend Social Login and Register
≤1.5.8Update to 1.5.9
- Medium6.1Reflected Cross-Site Scripting
Soundy Background Music
≤3.1Update to 3.2
- High8.8Cross-Site Request Forgery via wp_ajax_wp_compression_test
WordPress
<4.5Update to 4.5
- High7.2Reflected Cross-Site Scripting
DZS Video Gallery
≤8.60No patch available