Database
WordPress Vulnerability Database (page 1396)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.8Cross Site-Scripting
Recent Posts Widget Extended
≤0.9.9.3Update to 0.9.9.4
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
Events Made Easy
<1.5.50Update to 1.5.50
- High8.8Authenticated SQL Injection
Dynamic Widgets
≤1.5.10Update to 1.5.11
- Medium6.1Cross-Site Scripting
Akismet Anti-spam: Spam Protection
<3.1.5Update to 3.1.5
- Medium6.1Cross-Site Scripting
Connect Matomo – Analytics Dashboard for WordPress
<1.0.5Update to 1.0.5
- Medium6.3Authenticated SQL Injection
Pie Register – User Registration, Profiles & Content Restriction
<2.0.19Update to 2.0.19
- Medium4.9Path Traversal
Font – official webfonts plugin of Fonts For Web. NO CODING! Just click & change font size, color and font face visually!
≤7.5Update to 7.5.1
- High7.5Full Path Disclosure
JM Twitter Cards
<6.2Update to 6.2
- Medium6.1Reflected Cross-Site Scripting
Pie Register – User Registration, Profiles & Content Restriction
<2.0.19Update to 2.0.19
- High8.8Arbitrary File Upload
Ajax Load More – Infinite Scroll, Load More, & Lazy Load
≤2.8.1.1Update to 2.8.1.2
- Critical9.8SQL Injection
Limit Attempts by BestWebSoft – WordPress Anti-Bot and Security Plugin for Login and Forms
<1.1.1Update to 1.1.1
- High7.5Arbitrary File Download
History Collection
≤1.1.1No patch available
- Critical9.8SQL Injection
Support Ticket System
<1.2.1Update to 1.2.1
- Critical9.8Directory Traversal and Local File Inclusion
Easy2Map
≤1.2.9Update to 1.3.0
- Medium6.1Reflected Cross-Site Scripting
Easy2Map
≤1.2.9Update to 1.3.0
- Medium6.12.7.9 - Unauthenticated DOM Cross-Site Scripting
uDesign - Responsive WordPress Theme
2.3.0 – 2.7.9Update to 2.7.10
- Medium6.1Reflected Cross-Site Scripting
Payment Form for PayPal Pro
<1.0.2Update to 1.0.2
- Medium6.1Reflected Cross-Site Scripting
ResAds
<1.0.2Update to 1.0.2
- Medium6.1Cross-Site Scripting
Quotes and Tips by BestWebSoft
<1.20Update to 1.20
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Relevant – Related, Featured, Latest, and Popular Posts by BestWebSoft
<1.0.8Update to 1.0.8
- Medium6.1Reflected Cross-Site Scripting
AdPush
≤1.29Update to 1.30
- Medium5.3Information disclosure
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤3.7.1Update to 3.7.2
- High7.2Stored Cross-Site Scripting
Jetpack – AI Agents & MCP, Security, Backup & Analytics
≤3.7.1Update to 3.7.2
- High8.4CSV Injection
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤2.9.27Update to 2.9.28
- High7.5Directory Traversal to Unauthenticated Arbitrary File Read
mTheme-Unus
<2.3Update to 2.3
- High8.8Unauthenticated Remote Command Execution
WordPress Landing Pages
<1.9.2Update to 1.9.2
- Critical9.8Local File Inclusion
mTheme-Unus
all versionsNo patch available
- Critical9.8SQL Injection
Appointment Booking Calendar
≤1.1.7Update to 1.1.8
- Medium6.1Multiple Reflected Cross-Site Scripting
Appointment Booking Calendar
≤1.1.7Update to 1.1.8
- Medium5.3Directory Listing
WP Super Cache
<1.4.5Update to 1.4.5