Database
WordPress Vulnerability Database (page 1395)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.5Stored Cross-Site Scripting
Social Share Button
≤2.1Update to 2.1.1
- Medium6.1Reflected Cross-Site Scripting
SEO Rank Reporter
≤2.2.2No patch available
- Medium6.1Reflected Cross-Site Scripting
Websimon Tables
≤1.3.4No patch available
- High7.2Authenticated SQL Injection
WP-Stats-Dashboard
≤2.9.4No patch available
- Critical9.8SQL Injection
Google Map
<2.2.6Update to 2.2.6
- Critical9.8SQL Injection
Double Opt-In for Download
<2.0.9Update to 2.0.9
- Medium6.1Reflected Cross-Site Scripting
Contact Form Manager
≤1.4.1Update to 1.4.2
- High7.2Authenticated (Admin+) SQL Injection
Contact Form by WD – responsive drag & drop contact form builder tool
<1.7.31Update to 1.7.31
- High7.1Reflected Cross-Site Scripting
Email Newsletter
≤20.13.6Update to 20.13.7
- Medium5.5Authenticated Cross-Site Scripting
My Link Order
≤4.3No patch available
- Medium6.1Reflected Cross-Site Scripting
Theme Test Drive
≤2.9Update to 2.9.1
- Medium5.4Reflected Cross-Site Scripting
JW Player for Flash & HTML5 Video
≤2.1.14No patch available
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
My Page Order
≤4.3Update to 4.4
- High7.2Authenticated (Admin+) SQL Injection
Watu Quiz
≤2.6.7Update to 2.6.8
- Medium5.5Cross-site Scripting
WooCommerce
<2.4.9Update to 2.4.9
- High8.8Arbitrary File Upload
Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin
<1.5.59Update to 1.5.59
- Critical9.8SQL Injection
WP Fastest Cache – WordPress Cache Plugin
<0.8.4.9Update to 0.8.4.9
- High8.8Privilege Escalation
BuddyPress
≤2.3.4Update to 2.3.5
- Medium6.1Reflected Cross-Site Scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
<2.2.5Update to 2.2.5
- High8.8Cross-Site Request Forgery
Tag Miner (Automatic Tag Extraction)
<1.1.5Update to 1.1.5
- High7.2Cross-Site Scripting
Toolset Types – Custom Post Types, Custom Fields and Taxonomies
≤1.8.7.2Update to 1.8.8
- Medium6.1Cross-Site Scripting
Tag Miner (Automatic Tag Extraction)
<1.1.5Update to 1.1.5
- Medium6.1Reflected Cross-Site Scripting
neuvoo-jobroll
≤2.0No patch available
- Medium6.1Reflected Cross-Site Scripting
neuvoo-jobroll
≤2.0No patch available
- Critical9.0Remote File Inclusion
Gwolle Guestbook
<1.5.4Update to 1.5.4
- Medium6.1Cross-Site Scripting
WordPress Calls to Action
<2.5.1Update to 2.5.1
- Critical9.8Arbitrary File Upload
Iptanus File Upload
<3.4.1Update to 3.4.1
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Crony Cronjob Manager
<0.4.7Update to 0.4.7
- Critical9.8SQL Injection
Visitors Online by BestWebSoft
≤0.3Update to 0.4
- High8.8SQL Injection
wp-championship
<5.9Update to 5.9