Database
WordPress Vulnerability Database (page 1400)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Responsive Touch Slider <= 2.5.1 - Authenticated Blind SQL Injection
Master Slider – Responsive Touch Slider
<2.5.2Update to 2.5.2
- Critical9.8SQL Injection
404 to 301 – Redirect Manager, 301 Redirection, 404 Error Logs & 404 Monitoring
<2.0.3Update to 2.0.3
- Medium6.1Cross-Site Scripting
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
≤1.3.17Update to 1.3.18
- Medium5.4Multiple Cross-Site Scripting
WP Job Manager
<1.23.8Update to 1.23.8
- Medium6.1Responsive Photo Gallery <= 1.5.5 - Reflected Cross-Site Scripting
Image Gallery - Responsive Photo Gallery
<1.5.6Update to 1.5.6
- Medium6.1Reflected Cross-Site Scripting
Subscribe To Comments Reloaded
<150820Update to 150820
- Medium6.1Reflected Cross-Site Scripting
Alpine Photo Tile for Instagram
<1.2.7.6Update to 1.2.7.6
- Medium6.5Cross-Site Scripting
WP Social Bookmarking Light
<1.7.10Update to 1.7.10
- High7.2Stored Cross-Site Scripting
Social Media Widget by Acurax
<2.2Update to 2.2
- Medium6.1Reflected Cross-Site Scripting
WP Google Fonts
<3.1.4Update to 3.1.4
- Medium6.1Cross-Site Scripting
Category Order and Taxonomy Terms Order
<1.4.6.0Update to 1.4.6.1
- Medium6.1Cross-Site Scripting
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import Export
<3.8.1Update to 3.8.1
- Medium6.1Reflected Cross-Site Scripting
WP Latest Posts
≤3.7.4Update to 3.7.5
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
<0.5.28Update to 0.5.28
- Medium6.1Cross-Site Scripting
All-In-One Security (AIOS) – Security and Firewall
<3.9.8Update to 3.9.8
- Critical9.1Open Proxy
google-adsense-and-hotel-booking
≤1.05No patch available
- High7.2Stored Cross-Site Scripting
WP-Polls
≤2.70Update to 2.71
- Medium6.1Cross-Site Scripting
WP REST API (WP API)
≤1.2.2Update to 1.2.3
- High8.8Cross-Site Request Forgery to Cross-Site Scripting
my-category-order
≤4.3Update to 4.4.2
- Medium6.4Authenticated Stored Cross-Site Scripting
Translate WordPress – Google Language Translator
<5.0.0Update to 5.0.0
- Medium6.1Cross-Site Scripting
Hide My WP - Amazing Security Plugin for WordPress!
<4.54Update to 4.54
- Medium5.4Reflected Cross-Site Scripting
Add Link to Facebook
<2.2.8Update to 2.2.8
- Medium6.1Reflected Cross-Site Scripting
Contact Bank – Contact Form Builder for WordPress
<2.0.226Update to 2.0.226
- Medium4.8Cross-Site Request Forgery to Cross-Site Scripting
Ad Inserter – Ad Manager & AdSense Ads
≤1.5.5Update to 1.5.6
- Critical9.8Pseudorandom Number Generation
WP OAuth Server (OAuth Authentication)
<3.1.5Update to 3.1.5
- Medium6.1Cross-Site Scripting
WordPress Share Buttons Plugin – AddThis
<5.0.13Update to 5.0.13
- Medium6.1Refletced Cross-Site Scripting
Dynamic Widgets
<1.5.11Update to 1.5.11
- Medium5.4Cross-Site Scripting
Dynamic Widgets
<1.5.11Update to 1.5.11
- Medium4.8Authenticated Cross-Site Scripting
WordPress Share Buttons Plugin – AddThis
<5.0.13Update to 5.0.13
- Medium6.1Reflected Cross-Site Scripting
iframe
≤3.0Update to 4.0