Database
WordPress Vulnerability Database (page 1403)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
Broken Link Manager
<0.6.0Update to 0.6.0
- High8.8Multiple SQL Injections
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
<4.4.4Update to 4.4.4
- Critical9.8SQL Injection
NEX-Forms – Ultimate Forms Plugin for WordPress
<4.6.1Update to 4.6.1
- Critical9.8SQL Injection
Auto Affiliate Links
<5.0Update to 5.0
- High7.1Cross-Site Scripting
FLASH PLAYER PLUGIN
≤1.3No patch available
- High7.1Multiple Cross-Site Scripting
Welcart e-Commerce
<1.4.18Update to 1.4.18
- High7.5Arbitrary File Download
WP Attachment Export
<0.2.4Update to 0.2.4
- High7.2Local File Includion
Subscribe to Comments
≤2.1.2Update to 2.3
- High8.8SQL Injection
Abandoned Cart Lite for WooCommerce
<1.9Update to 1.9
- High8.8Authenticated SQL Injection
Smooth Slider
≤2.6.5Update to 2.7
- High8.8Cross-Site Request Forgery
BuddyPress Activity Plus
≤1.5Update to 1.6.2
- Critical9.8Arbitrary File Upload
WPE Indoshipping
≤2.5.0No patch available
- Critical9.8WordPress Chat Plugin < 1.0.3 - SQL Injection
FrieChat - WordPress Chat Plugin
<1.0.3Update to 1.0.3
- High7.5Arbitrary File Download
NativeChurch
≤1.6.1Update to 1.6.2
- Medium6.4Stored Cross-Site Scripting
Plotly
≤1.0.2Update to 1.0.3
- Medium6.1Cross-Site Scripting
The Events Calendar: Eventbrite Tickets
<3.10.2Update to 3.10.2
- Medium6.4Stored Cross-Site Scripting
Plotly
<1.0.3Update to 1.0.3
- High7.5Directory Traversal
Recent Backups
≤0.7No patch available
- High7.5Arbitrary File Download
candidate-application-form
≤1.3No patch available
- Critical9.8Unauthenticated Arbitrary File Upload
WP Front-End Repository Manager
≤1.1No patch available
- Medium5.3Full Path Disclosure
MP3-jPlayer
<2.5Update to 2.5
- Critical9.8Blind SQL Injection
filedownload
<1.4Update to 1.4
- Medium6.1Cross-Site Scripting
filedownload
≤1.4Update to 2.0
- High8.8Unauthenticated Cross-Site Request Forgery
WPBook
≤2.7Update to 2.7.1
- Critical9.8Arbitrary File Upload
MailCWP
≤1.100No patch available
- High7.5Arbitrary File Download
CP Image Store with Slideshow
<1.0.6Update to 1.0.6
- High7.5Arbitrary File Download
CP Image Store with Slideshow
<1.0.7Update to 1.0.7
- High7.5Improper Input Validation
Sell Downloads
<1.0.8Update to 1.0.8
- High7.2Directory Traversal
forumAttachments for bbPress
<2.3Update to 2.3
- High7.2SQL Injection
CP Contact Form with PayPal
<1.1.6Update to 1.1.6