Database
WordPress Vulnerability Database (page 1398)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium4.3Cross-Site Request Forgery
WatuPRO
<4.9.0.8Update to 4.9.0.8
- Medium6.1Cross-Site Request Forgery to Stored Cross-Site Scripting
Testimonial Slider
≤1.2.5Update to 1.3.0
- Medium6.4Cross-Site Scripting
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.9Update to 2.1.10
- Medium6.1Reflected Cross-Site Scripting
CKEditor for WordPress
≤4.5.3Update to 4.5.3.1
- Medium6.1Cross-Site Scripting
sourceAFRICA
≤0.1.3No patch available
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
Responsive Thumbnail Slider
<1.0.1Update to 1.0.1
- Medium6.5Path Traversal
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.7Update to 2.1.9
- Medium6.5Local File Inclusion
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
≤2.1.10Update to 2.1.15
- Medium6.1Stored Cross-Site Scripting
Captain Slider
≤1.0.6No patch available
- High7.5Insecure Direct Object Reference
Job Manager
≤0.7.25No patch available
- Medium6.1Reflected Cross-Site Scripting
SoundCloud Is Gold
<2.3.2Update to 2.3.2
- Medium5.5Cross-Site Scripting
Embeds for YouTube
<3.3.3Update to 3.3.3
- Medium6.1Reflected Cross-Site Scripting
Navis DocumentCloud
<0.1.1Update to 0.1.1
- High8.8Multiple Cross-Site Request Forgery
Private Only
≤3.5.1No patch available
- Medium6.1Reflected Cross-Site Scripting
smart-slider-2
<2.3.12Update to 2.3.12
- High7.3Cross-Site Request Forgery
Simple Slideshow Manager
≤2.1Update to 2.1.1
- High7.1Reflected Cross-Site Scripting
Role Scoper (Obsolete – Please install PublishPress Permissions)
≤1.3.64Update to 1.3.65
- Critical9.8SQL Injection
Car Rental System
<3.1Update to 3.1
- High8.8Authenticated Blind SQL Injection
GoCodes
≤1.3.5No patch available
- High8.8SQL Injection
WordPress Meta Robots
≤2.1No patch available
- Medium6.1Reflected Cross-Site Scripting
WP Page Widget
<2.8Update to 2.8
- Medium6.5Stored Cross-Site Scripting
Page Restrict
<2.2.2Update to 2.2.2
- Medium6.1Reflected Cross-Site Scripting
Olevmedia Shortcodes
<1.1.9Update to 1.1.9
- Medium6.1Stored Cross-Site Scripting
SEO Redirection Plugin – 301 Redirect Manager
<4.3Update to 4.3
- Medium6.1Reflected Cross-Site Scripting
Anti-Spam, Spam FireWall by CleanTalk
<5.22Update to 5.22
- Medium6.3Cross-Site Request Forgery
Multicons
<3.0Update to 3.0
- Medium5.4Cross-Site Scripting
GoCodes
≤1.3.5No patch available
- Medium6.5Cross-Site Request Forgery leading to Stored Cross-Site Scripting
plugnedit
<6.2.0Update to 6.2.0
- Medium6.1Reflected Cross-Site Scripting
OnePress Social Locker
<4.2.5Update to 4.2.5
- Medium5.4Authenticated Stored Cross-Site Scripting
plugnedit
<6.2.0Update to 6.2.0