Database
WordPress Vulnerability Database (page 1397)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.1PHP Object Injection
WP Super Cache
<1.4.5Update to 1.4.5
- Medium5.3Directory Listing
WP Super Cache
<1.4.5Update to 1.4.5
- Medium6.4Cross-Site Scripting
MyBookTable Bookstore by Stormhill Media
≤2.1.4Update to 2.1.5
- Medium6.1Cross-Site Scripting
Vertical Image Slider – Responsive Thumbnail Slider with Lightbox
<1.2Update to 1.2
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
ALO EasyMail Newsletter
<2.6.01Update to 2.6.01
- Medium6.1Cross-Site Scripting
xPinner Lite
≤2.2No patch available
- Medium5.4Authorization Bypass to Information Disclosure
WordPress
≤4.3Update to 3.7.11 or 3.8.11 or 3.9.9 or 4.0.8 or 4.1.8 or 4.2.5 or 4.3.1
- Medium6.4Authenticated Cross-Site Scripting
WordPress
≤4.3Update to 3.7.11 or 3.8.11 or 3.9.9 or 4.0.8 or 4.1.8 or 4.2.5 or 4.3.1
- Medium6.4Cross-Site Scripting via Shortcodes
WordPress
≤4.3Update to 3.7.11 or 3.8.11 or 3.9.9 or 4.0.8 or 4.1.8 or 4.2.5 or 4.3.1
- Critical9.8SQL Injection
CP Reservation Calendar
<1.1.7Update to 1.1.7
- Critical9.8Local File Inclusion
mypixs
≤0.3No patch available
- High8.8Cross-Site Request Forgery
xPinner Lite
≤2.2No patch available
- High8.8Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Shop
<3.4.3.19Update to 3.4.3.19
- Medium6.1Reflected Cross-Site Scripting
PowerPress Podcasting plugin by Blubrry
≤6.0.4Update to 6.0.5
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.15Update to 2.1.23
- High7.5Path Traversal
estrutura-basica
all versionsNo patch available
- Medium6.1Cross-Site Scripting
RoyalSlider
<3.2.7Update to 3.2.7
- Medium6.1Cross-Site Scripting
Replyable – Subscribe to Comments and Reply by Email
<1.4.6Update to 1.4.6
- Medium6.5Cross-Site Forgery Request and Reflected Cross-Site Scripting
eShop
≤6.3.13Update to 6.3.14
- Medium6.1Cross-Site Scripting
Fast Secure Contact Form
≤4.0.37Update to 4.0.38
- Medium6.1Multiple Cross-Site Scripting
MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites
≤2.0.27Update to 2.0.28
- Medium6.1Reflected Cross-Site Scripting
WP Symposium
≤15.8.1Update to 15.9
- Medium6.1Cross-Site Scripting
Gallery – Photo Albums Plugin
<1.3.50Update to 1.3.50
- Medium6.6PHP Object Injection
SecureMoz Security Audit
≤1.0.5No patch available
- Critical9.8SQL Injection
WP Limit Login Attempts
<2.0.1Update to 2.0.1
- Medium6.3Cross-Site Request Forgery
Contact Form Generator : Creative form builder for WordPress
≤2.1.86Update to 2.5.0
- Critical9.8Local File Inclusion
Memphis Documents Library
≤2.6.16Update to 3.0
- Critical9.8Remote File Inclusion
Memphis Documents Library
<3.0Update to 3.0
- Critical9.8Remote File Inclusion via TimThumb
BJ Lazy Load
0.7.5 – 0.7.5Update to 1.0
- Medium6.1Cross-Site Scripting in Accept-Language Header
WPML Multilingual CMS
2.9.3 – 3.2.6Update to 3.2.7