Database
WordPress Vulnerability Database (page 1401)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium5.4Cross-Site Scripting
Dynamic Widgets
<1.5.11Update to 1.5.11
- High7.2Blind SQL Injection
WP Symposium
<15.8Update to 15.8
- Medium6.1Cross-Site Scripting
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress
<2.9.1Update to 2.9.1
- Medium5.3Reflected Cross Site Scripting
Email Users
<4.7.6Update to 4.7.6
- Medium6.1Cross-Site Scripting
EZP Coming Soon Page
<1.0.1Update to 1.0.1
- Low3.8Google Analytics Dashboard for WordPress <= 5.4.4 - Authenticated Stored Cross-Site Scripting
MonsterInsights – Google Analytics Dashboard for WordPress (Website Stats Made Easy)
≤5.4.4Update to 5.4.5
- Medium6.1Cross-Site Scripting
Email Encoder – Protect Email Addresses and Phone Numbers
<1.4.2Update to 1.4.2
- Medium6.1Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
≤9.5.1Update to 9.5.2
- Medium6.1Cross-Site Scripting
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.6Update to 5.6
- Critical9.8Code Injection
Events Manager – Calendar, Bookings, Tickets, Appointments and more!
<5.6Update to 5.6
- Medium6.4Authenticated Stored Cross-Site Scripting via easy-table-test-area parameter
Easy Table
<1.5.3Update to 1.5.3
- Medium6.4Stored Cross-Site Scripting
iframe
≤4.0Update to 4.1
- Critical9.8Unauthenticated SQL Injection
WP Symposium
<15.8Update to 15.8
- Medium5.4Cross-Site Request Forgery to Cross-Site Scripting
bookmarkify
≤1.1.3No patch available
- Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Monetize
≤1.03No patch available
- High7.3Unspecified Vulnerability
MainWP Dashboard: Self-hosted WordPress Management for Agencies
≤2.0.22Update to 2.0.23
- Medium6.5Cross-Site Scripting
Avenir-soft Direct Download
≤1.0No patch available
- Medium6.1Reflected Cross-Site Scripting
Qtranslate Slug
≤1.1.16Update to 1.1.17
- Medium5.5Cross-Site Scripting via Widget Title
WordPress
≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
- Medium5.3Timing Side-Channel Attack
WordPress
≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
- High8.8SQL Injection
WordPress
≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
- Critical9.6Cross-Site Request Forgery to Post Lockage
WordPress
≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
- Medium6.1< 0.7.23 - Stored Cross-Site Scripting
Job Manager
<0.7.23Update to 0.7.23
- Medium6.1Cross-Site Scripting in Theme Preview
WordPress
≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
- Medium5.4Stored Cross-Site Scripting via accessibility-helper Title
WordPress
≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
- Medium5.4Reflected Cross-Site Scripting
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
≤2.9.21Update to 2.9.22
- Medium6.1Reflected Cross-Site Scripting
YITH Maintenance Mode
≤1.1.4Update to 1.2.0
- Medium6.5Remote File Download
Simple Image Manipulator
≤1.0No patch available
- High8.8Cross-Site Request Forgery
Vertical Image Slider – Responsive Thumbnail Slider with Lightbox
<1.2Update to 1.2
- Medium6.4Stored Cross-Site Scripting
Livefyre Comments 3
≤4.1.4Update to 4.1.5